CyberShield Advisory
Cybersecurity and compliance advisory. Know your risks. Fix what matters first. NIST CSF 2.0, HIPAA, C2M2, M365, vCISO. Free cybersecurity assessment. cybershieldadvisory.com
Risk observatory / Education CenterBusiness context → better questions → action
Mini-assessment / NIST CSF 2.0

Could Your Utility Keep Operating Through a Cyber Incident?

Harris Ejiofor, CISM – CyberShield Advisory

Eight yes-or-no questions to help utility and energy leaders judge whether service could continue safely if computer systems had to be shut down.

For a utility, the question that matters most is not whether an incident could happen. It is whether you could keep power, water or fuel flowing safely while you deal with it. Answer each question honestly with a yes or no. There is no score; the goal is to see where you stand.

The questions

  1. Could your operators run the most important processes by hand if the control computers had to be disconnected?
  2. Are written manual procedures and key phone numbers available on paper at every site?
  3. Have operators practised running without the control computers in the past year?
  4. Is your operations network separated from your office network, so a problem in one cannot spread freely to the other?
  5. Do you know every way someone can connect remotely to your operational systems?
  6. Are backups of control system settings and software kept offline, and has someone restored one to prove it works?
  7. Does your incident plan say who decides to disconnect operations, and when?
  8. Do you know who to call first, including your equipment vendors, insurer, state regulator and an incident response firm?

What your answers suggest

Mostly yes. You have a strong foundation. Keep practising, update procedures when equipment or vendors change, and make sure more than one person can lead the response.

A mix of yes and no. Look first at questions 1, 3 and 7. If operators cannot run by hand, or nobody knows who decides to disconnect, an incident on the office side could still interrupt service.

Mostly no. Service may be at risk in a serious incident. Start by writing down manual procedures and the decision rule for disconnecting operations, then separate the networks and protect remote access.

A C2M2 evaluation looks at these same capabilities in more depth, with clear maturity levels and a roadmap.

Take the next step

Our free NIST CSF 2.0 assessment asks five quick questions about who owns security, where sensitive data lives, sign-in, incident plans and tested backups, and gives an indicative result. It is a short check, not a formal rating.

Related reading

Take the free NIST CSF 2.0 assessment

← All articles