Your Cybersecurity Guide for the Digital Road Ahead
Advanced communications and smart technologies have revolutionized the way utilities operate and serve their communities – they’ve also made utilities more vulnerable than ever before. Today, designing and building in cybersecurity measures as these new technologies are introduced into critical infrastructure is as practical as it is necessary, regardless of the type of network being built. Let Black & Veatch guide you.
Backed by nearly 100 years of utility infrastructure design, engineering, construction, and operations experience, we bridge the gap between information technologies (IT), operational technologies (OT), and regulatory drivers like standards for the North American Electric Reliability Corporation, Critical Infrastructure Protection (NERC CIP) and the National Institute of Standards & Technology (NIST). We approach network architecture as integration between cybersecurity and network design, working directly with clients through planning, assessment, design, and deployment to ensure solutions meet business and operational needs.
Achieve Your Cybersecurity Objectives
Black & Veatch Management Consulting is accredited by the Cybersecurity Maturity Model Certification Accreditation Body (CMMC-AB) to provide readiness assessment to federal contractors. This readiness service will help federal contractors ensure they meet the pre-determined set of controls and maturity level established by the CMMC program to retain their federal contractor status.
We offer comprehensive services to support federal contractors as they prepare for their Level 1 or Level 3 CMMC certification. Our consulting professionals bring decades of global expertise and provide readiness services to support a broad range of certification and compliance requirements. As a CMMC-AB Registered Provider, we have the required knowledge and expertise of the CMMC framework to assist your organization as it seeks compliance.
Black & Veatch’s Security Assessment Services were developed to not only identify the vulnerabilities of your current network but to also get a clear picture of how well your current security system is performing. This comprehensive view of our clients’ current level of prevention helps us ensure they have the technology to protect their infrastructure, and the tools and procedures to use that technology effectively. This, complemented by our understanding of regulatory and standards drivers (NERC CIP, ISA99, NIST IR 7628, SP800-82, etc.), results in a full suite of cybersecurity assessment services:
- Vulnerability and Penetration Testing Services: Vulnerability and penetration testing of infrastructure (servers/workstations/other endpoints along with network devices) are designed to find and validate vulnerabilities due to misconfigured systems or missing patches.
- AMI Security Assessment: A targeted assessment that focuses on the inherent security of a proposed or actual AMI deployment, from the meters (and their security as built by the vendor) to the head-end and AMI-specific infrastructure like analytics and MDMS infrastructure.
- NERC CIP Gap Analysis: An overall look at the policies, procedures, and actual activities (including creation and management of artifacts) to find places where intended and actual compliance activities do not match, and where potential violations may be found. Suggested corrective actions are provided with the final report.
- Physical Security Assessment: An examination of the physical security of a facility or even an entire organization, taking into account access controls, access monitoring, processes, and procedures around granting/controlling/revoking access and environmental factors.
- Network Architecture Security Assessment: The examination of a network’s overall architecture, mapping data flows and security controls to find opportunities for improvement in network design from the perspective of security and appropriate reliability.
- Smart Grid Security Assessment: An in-depth examination of smart grid security as implemented, taking into account the particular technologies implemented, the security around them, potential impacts relating from subversion or interruption of control, and regulatory outlook with regard to compliance.
Regulatory compliance should not be viewed as an event. It should be viewed as an ongoing business process. To ensure your organization continues to meet current and future compliance standards, it is important that compliance requirements are integrated into your organization’s daily operations. Black & Veatch cybersecurity professionals keep a pulse on NERC regulations, from existing Version 3 standards to the development of Versions 4 and 5. We utilize NIST standards and control frameworks – and know how to integrate them into an electric utility’s operations.
Black & Veatch emphasizes a life cycle approach for cybersecurity compliance. Our expertise in the utility domain enables us to develop a plan that meets your unique objectives and requirements based on your available resources. This approach supports the continuous improvement cycle for incorporating ongoing regulations into daily operations.
Black & Veatch’s cybersecurity professionals have authored policies and procedures to meet federal, state, and local regulations; sponsored successfully funded grant applications; and have aligned security programs to meet international business requirements. Most projects are initiated with an assessment of documents and assets evaluating strategic cybersecurity risks to current and planned mission critical systems. Our standards-based designs help promote “soft” attributes, such as technical staff knowledge sharing. We confidently turn over operation of new network infrastructure to our customers knowing they have been an integral part of the network development process and are ready to effectively operate, monitor, and sustain new network infrastructure.
Improved or revised policies are often the second step to improving cybersecurity posture. Remediation planning, tracking and implementation close the cycle in preparation for re-evaluation.
Smart Utility eBook
Industry Benchmarks for Progress and Future Actions
To understand U.S. utility grid modernization progress and obstacles, Black & Veatch conducted surveys in 2020 and 2021 and researched industry trends and data points to form a comprehensive snapshot. In an era of ever - increasing risks and investment in rapidly changing technologies, this eBook benchmarks utility progress and provides signposts to guide future actions in Distribution Modernization, Cybersecurity, Asset Management, and Resilience.