01Do you work directly on BES Cyber Systems or inside the ESP?
We design and configure the identity and access controls that reach into OT, and we work under your change control and CIP procedures. Where your program says only your staff may change BES Cyber Systems, we write the design and runbooks and your engineers make the changes.
02We're a pipeline operator, not a utility. Does NERC CIP apply to us?
NERC CIP applies to registered entities on the bulk electric system. TSA-designated pipeline operators fall under the TSA security directives instead. Many energy companies have both kinds of assets, and the access controls overlap heavily, so we map one control set to both and keep the evidence separate.
03Can one PAM platform cover both corporate IT and OT?
Often, yes. It depends on whether the platform can broker the protocols and vendor engineering tools your OT assets use. It also depends on how sites connect, and on whether the Intermediate System needs its own EACMS. Before recommending one platform or a split, we test with representative assets.
04What does a first engagement usually look like?
We usually start with an access assessment. We list every identity store across IT and OT, find the shared and default accounts, trace each vendor remote access path, and look at how evidence is produced today. The findings come ranked and tied to the CIP requirement or TSA outcome they affect, with a sequenced plan.
05Can you help with a CIP audit that's already scheduled?
Yes, though the scope depends on how much time is left. Close to an audit we focus on evidence, such as authorization records, quarterly verifications, revocation timing and remote access logs. Larger design changes usually wait until after the audit and go through your change control.
