Information Security Management for Energy Utilities
Inquiry This course is not yet bookable.
During a security incident at an energy utility, operations, IT/OT and management need to know who decides and when to involve others. Develop an incident plan for a supply area, including responsibilities and deputies, for discussion with management.
For one utility service, determine who is alerted during a security incident, who decides on operations and how IT and OT exchange information. Produce an incident procedure with deputies, operational assignments and review times for your area or the substitute case.
In the course case, IT reports suspicious communication on a control-centre connection at 09:00 and recommends isolation. Operations warns that remote control will be restricted and proposes local operation. Prepare the operational manager’s decision at 09:20 and specify what will be reviewed again at 09:40. Sector-specific legal questions and technical OT approvals require separate specialist review.
What you will work on
You define a supply area, its critical dependencies and the scope of the concept in a traceable way.
You assign decision rights, deputies and escalation points for a selected information security incident to the roles involved.
You prepare the decision between isolation and local operation in the case and specify the subsequent review.
Who it is for
Information security officers at energy utilities
Heads of IT/OT or grid operations with security responsibility
Leaders for risk, resilience or business continuity in a utility
Topics
Protection needs and dependencies across a supply area
Responsibilities and decisions across information security, operations, IT/OT, communications, legal and executive management
Incident classification, escalation and activation of an incident routine
Communication and restoration decisions in a prioritised scenario
Assumptions, unresolved legal and standards questions, and approval boundaries
Implementation planning, review intervals and a decision paper for management
Your result
Your incident procedure sets out alerts, operational assignments, IT/OT handovers and review times for one utility service.
Prerequisites
Experience in information security, IT/OT or critical service operations. Access to roles and dependencies for one area, or use of a course case.
Format and approach
Planned: 6–8 hours of self-study, with an annotated example and self-checks.
Unusual network traffic affects a production controller. Disconnecting it immediately could stop the process in an uncontrolled way. Compare response options and prepare a guide for decisions and restart.
When digital and physical disruptions happen together, security, IT and crisis leaders need to work together. For one site, you determine who assesses reports, coordinates protective measures and decides when priorities conflict.
Disconnecting an affected system immediately can limit the spread of a cyber incident, but it also interrupts a critical service. In this course, you decide how to proceed during the first 120 minutes: define the escalation route, prepare a situation picture and issue initial instructions.
