Cybersecurity Solutions | Black & Veatch
Industrial Cybersecurity

Cybersecurity from the Ground Up

Utilities, cities, governments, and enterprises own and operate some of the most critical and vulnerable infrastructure systems in the world. In the face of new and evolving vulnerabilities that demand greater protection, partner with Black & Veatch to build operational safety and security into critical projects from the ground up.

Operational Cybersecurity Starts with Resilient Design

The new digital battleground is being fought in the operational networks of critical infrastructure across numerous industries. The growing reliance on automation, digitization, and connectivity leaves systems and assets increasingly more vulnerable to cyber threats.

Given the significant danger that cyber threats pose to public and environmental safety, project site safety, and business uptime, asset owners must prioritize cybersecurity measures to mitigate these threats effectively.

We believe cybersecurity is better built-in, rather than bolted-on, and we are the first EPC company to integrate cyber at the engineering, procurement, and construction phases to proactively meet and address our clients' emerging industrial cyber needs.

We built it. We know how to protect it.

Backed by nearly 100 years of critical infrastructure design, engineering, construction, and operations experience, we build the very sites and assets our clients need to protect, and our unique approach provides a homefield advantage by changing the starting point of industrial cybersecurity.

From assessments to managed services, we help our clients design, develop, and run their cyber programs- because who better to build that homefield advantage than the people who helped build the field.

Bridging the gap between information technologies (IT), operational technologies (OT), and regulatory drivers, we help ensure solutions meet our clients’ most imperative business and operational needs.

At Black & Veatch, we build cyber in from the ground up.

Achieve Your Cybersecurity Objectives

Black & Veatch is accredited by the Cybersecurity Maturity Model Certification Accreditation Body (CMMC-AB) to provide readiness assessment to federal contractors. This readiness service will help federal contractors ensure they meet the pre-determined set of controls established by the CMMC 2.0 program to retain their federal contractor status.

We offer comprehensive services to support federal contractors as they prepare for their Level 1 or Level 2 CMMC certification. Our consulting professionals bring decades of global expertise and provide readiness services to support a broad range of certification and compliance requirements. As a CMMC-AB Registered Provider, we have the required knowledge and expertise of the CMMC framework to assist your organization as it seeks compliance.

Learn More

Black & Veatch’s Security Assessment Services were developed to not only identify the vulnerabilities of your current network but to also get a clear picture of how well your current security system is performing. This comprehensive view of our clients’ current level of prevention helps us ensure they have the technology to protect their infrastructure, and the tools and procedures to use that technology effectively. This, complemented by our understanding of regulatory and standards drivers (NERC CIP, ISA99, NIST IR 7628, SP800-82, etc.), results in a full suite of cybersecurity assessment services:

  • Vulnerability and Penetration Testing Services: Vulnerability and penetration testing of infrastructure (servers/workstations/other endpoints along with network devices) are designed to find and validate vulnerabilities due to misconfigured systems or missing patches.
  • AMI Security Assessment: A targeted assessment that focuses on the inherent security of a proposed or actual AMI deployment, from the meters (and their security as built by the vendor) to the head-end and AMI-specific infrastructure like analytics and MDMS infrastructure.
  • NERC CIP Gap Analysis: An overall look at the policies, procedures, and actual activities (including creation and management of artifacts) to find places where intended and actual compliance activities do not match, and where potential violations may be found. Suggested corrective actions are provided with the final report.
  • Physical Security Assessment: An examination of the physical security of a facility or even an entire organization, taking into account access controls, access monitoring, processes, and procedures around granting/controlling/revoking access and environmental factors.
  • Network Architecture Security Assessment: The examination of a network’s overall architecture, mapping data flows and security controls to find opportunities for improvement in network design from the perspective of security and appropriate reliability.
  • Smart Grid Security Assessment: An in-depth examination of smart grid security as implemented, taking into account the particular technologies implemented, the security around them, potential impacts relating from subversion or interruption of control, and regulatory outlook with regard to compliance.

Regulatory compliance should not be viewed as an event. It should be viewed as an ongoing business process. To ensure your organization continues to meet current and future compliance standards, it is important that compliance requirements are integrated into your organization’s daily operations. Black & Veatch cybersecurity professionals keep a pulse on NERC regulations, from existing Version 3 standards to the development of Versions 4 and 5. We utilize NIST standards and control frameworks – and know how to integrate them into an electric utility’s operations.

Black & Veatch emphasizes a life cycle approach for cybersecurity compliance. Our expertise in the utility domain enables us to develop a plan that meets your unique objectives and requirements based on your available resources. This approach supports the continuous improvement cycle for incorporating ongoing regulations into daily operations.

Black & Veatch’s cybersecurity professionals have authored policies and procedures to meet federal, state, and local regulations; sponsored successfully funded grant applications; and have aligned security programs to meet international business requirements. Most projects are initiated with an assessment of documents and assets evaluating strategic cybersecurity risks to current and planned mission critical systems. Our standards-based designs help promote “soft” attributes, such as technical staff knowledge sharing. We confidently turn over operation of new network infrastructure to our customers knowing they have been an integral part of the network development process and are ready to effectively operate, monitor, and sustain new network infrastructure.

Improved or revised policies are often the second step to improving cybersecurity posture. Remediation planning, tracking and implementation close the cycle in preparation for re-evaluation.

Federal Cybersecurity eBook cover image
Federal Cybersecurity eBook

Pathway to Federal Cybersecurity Compliance

Black & Veatch developed this eBook to help government agencies – Federal, State & Local – and Federal Contractors prepare and implement defenses against leading cyberattack vectors to our nation’s critical infrastructure security and resilience. Both will need to reduce their risk of data breaches and other disruptive and damaging cyberattacks.

Download eBook

Meet Black & Veatch

We seek partners in innovation. Let's start the conversation.