# Electric OT cybersecurity

> Substation automation, distribution SCADA and generation controls from NERC CIP medium-impact assets to the cooperatives below the threshold. The grid is the sector everything else depends on.

Canonical: https://blackbirdcyber.com/sectors/electric  
Blackbird Cyber · https://blackbirdcyber.com/ · sales@blackbirdcyber.com

## The exposure — Below the CIP threshold is still the grid.

Distribution utilities and cooperatives carry the same protocols and the same vendors as the bulk electric system, without the compliance program. Relays and RTUs speaking DNP3 are reachable from more places than anyone has drawn.

Regulations and guidance: NERC CIP, IEC 62351, IEEE 1686.

- Substation and relay access control
- DNP3 and IEC 61850 exposure across the WAN
- DER and inverter control integration

## Typical topology

A representative control network for electric utilities, by Purdue level:

- L3.5 · DMZ: EMS DMZ
- L2 · HMI: Control center HMI
- L2 · SCADA: Distribution SCADA
- L2 · Historian: PI historian
- L1 · PLC: Substation gateway
- L1 · RTU: Feeder RTU
- L1 · Safety: Protective relays
- L0 · Process: Breakers · transformers · DER · load

Exposed path: vendor VPN → L2 · Historian (PI historian).

## Where we start — Recommended engagements for electric utilities.

- [OT Cyber Audit](https://blackbirdcyber.com/capabilities/ot-cyber-audit): A site-level assessment of control system exposure, ranked by consequence.
- [OT Cyber Program Review](https://blackbirdcyber.com/capabilities/ot-cyber-program-review): An independent review of your OT security program against the standards your regulators cite.