OT Cybersecurity Policy for Utilities

Introduction and Expectations for Participants

Instructor: Introductions, course objectives, and setting expectations for a practical, interactive learning experience

Participant Introductions

OT Role Play
Hands-on exercise

Understanding the OT Landscape and Cyber Risk

The Unique Nature of OT:

• Defining Operational Technology (OT) vs. Information Technology (IT) in utilities
• Key characteristics of OT systems
• Resilience, Reliability, and Safety

The Evolving Risk Landscape:

• Common cyber threats targeting OT
• Real-world examples of OT cyber incidents in critical infrastructure
• Understanding the motivations of adversaries
• The active role of regulatory, compliance, and policy leaders

Interactive Activity:
Bridging the Gap: Why utility operational knowledge is crucial for effective cybersecurity, and why security experts need to understand utility regulatory processes and financial considerations.

Interactive Discussion:
What are your biggest concerns about cyber risk to your current operational area that you feel comfortable discussing publicly?

Cybersecurity Frameworks for Utility Professionals

Demystifying Frameworks:

• Overview of foundational cybersecurity frameworks applicable to OT with a focus on practical application
• How these frameworks provide a structured approach to managing cybersecurity risk
• Translating framework concepts into actionable steps for utility leaders

Key Security Controls:

• Identity, Access, and Authentication - A Case Study Review
• Quantum and Cryptography

The Foundation of Strong Security:

• Developing effective OT cybersecurity policies: scope, objectives, and key components
• Aligning internal policies with industry best practices and emerging regulations

Regulatory Compliance Beyond NERC CIP:

• Understanding the role of state public utility commissions (PUCs) and other relevant regulatory bodies
• Key compliance areas and requirements for OT cybersecurity

Annual Filings and Briefings to Regulators:
Strategies for clear, concise, and impactful reporting on cybersecurity posture and initiatives

Incident Response:
Emergency Preparation, Business Continuity, and Stakeholder Engagement

Management of Documentation:
The importance of comprehensive and up-to-date cybersecurity documentation

• Chain of custody
• Accessibility and relevance

Interactive Roundtable Exercise: Incident Response Scenario

Scenario Introduction:
Cyber incident impacting utility OT

Guided Discussion:
Each group discusses their initial response, policy implications, communication strategy (internal and external), and immediate actions.

Debrief and Learnings:
Facilitated discussion on the challenges, interdependencies, and importance of a coordinated response across the organization with an emphasis on policy adherence

Wrap Up

Overview of key concepts, lessons learned, insights, and Day 2 goals