I design industrial control systems and the defenses around them. I have done it for power stations, a gas facility, electricity substations and government cyber units, in Israel, Turkey, Ghana, Singapore and Japan. US operators answer to several regulators at once. This page sets out which rules apply to whom, and where an outside OT engineer helps.

Which rules apply

Electric utilities: NERC CIP

Owners and operators of the Bulk Electric System must meet the NERC CIP reliability standards, approved and enforced under FERC. The work starts with categorizing BES Cyber Systems as high, medium or low impact (CIP-002) and continues through electronic security perimeters (CIP-005), system security management (CIP-007), incident response (CIP-008), recovery plans (CIP-009), configuration change management and vulnerability assessments (CIP-010) and supply-chain risk management (CIP-013).

In June 2025 FERC approved CIP-015-1, internal network security monitoring. It requires monitoring of the traffic inside the electronic security perimeter for high-impact systems and for medium-impact systems with external routable connectivity, with a phased implementation plan.

Pipelines: TSA security directives

Owners and operators of TSA-designated critical pipelines work under the Security Directive Pipeline-2021-02 series. It asks for a Cybersecurity Implementation Plan approved by TSA, network segmentation so that OT keeps running if the IT network is compromised, access control, continuous monitoring and detection, timely patching or compensating measures, an incident response plan, and an annual cybersecurity assessment plan that tests whether the measures work.

Water and wastewater: AWIA

Under America's Water Infrastructure Act of 2018, community water systems serving more than 3,300 people must assess their risk and resilience, including their electronic, computer and automated systems, prepare an emergency response plan, and certify both to the EPA, then review them every five years. The cyber part of that assessment is a control-system question first: what is connected, to what, and who can reach it.

Every sector: ISA/IEC 62443 and NIST SP 800-82

The regulations say what must be achieved. ISA/IEC 62443 and NIST SP 800-82 say how: zones and conduits, security levels, and the requirements placed on suppliers and integrators. CISA's cross-sector cybersecurity performance goals point the same way. I work to these in every sector, regulated or not.

How the four services map to it

Risk assessments The inventory that CIP-002 categorization, a TSA architecture review and an AWIA assessment all start from: every controller, station, switch, firewall and diode, the paths in, the attack scenarios, and a report written for the regulator.
OT cyber-security architecture Electronic security perimeters and IT/OT segmentation (CIP-005, the TSA directives), IEC 62443 zones and conduits, controlled vendor access, and passive monitoring inside the control network of the kind CIP-015 now requires.
Control-system design New plants and upgrades with the security requirements written into the design documents and the supplier contracts, so configuration baselines (CIP-010) and supply-chain controls (CIP-013) are designed in, not added later.
Business consulting For the executives who approve the program: priorities, budget, and where AI may and may not touch operational data.

Operators who need hands-on OT training can take the ICS security course, with attack and defense labs on real controllers.

Work already done

ICL power stations, 2017 and 2018. A complete map of the control systems, assets, subsystems, switches, stations, servers, firewalls and diodes; the result was submitted to the regulator. Risk assessments
EnerjiSA hydro-electric plants, Turkey, 2017. A risk assessment after cyber attacks on the plants: the control network mapped, the vulnerabilities shown, and the sources of the attacks traced.
Delek gas facility, 2016. A risk assessment of the facility.
Nine electricity substations, Ghana, 2018. GRAPHENE, passive intrusion detection, monitoring the substations' control networks.
SPARTA. A protection module for the HMI server, patented in the US as 11,621,972 B2.
Government training. A three-week ICS security course for Singapore's Ministry of Home Affairs and a two-week course for Japan's police cyber units. The course

This work was done in Israel, Turkey, Ghana, Singapore and Japan. The method is the same one the US rules ask for: inventory first, then segmentation, monitoring and a plan for the day something goes wrong.

Start with a call

A first call is free and takes half an hour. Tell me the sector, the regulator you report to, and roughly how many sites and controllers you run. Inventories are done at the plant; analysis, design and reviews can be done remotely.

Book a first call

Or write to mail@ilanshaya.com.

OT security for US critical infrastructure