Energy and utilities
Electric Utilities
Utilities carry power from plants to homes through thousands of substations, most of them unmanned and spread across a state or a country.
How the process runs
From substation to meter
Power leaves the plant at high voltage, is stepped down through transmission and distribution substations, and reaches customers through feeders and meters. Control centres watch and switch all of it in real time, over the utility's own telecom network.
Stage 2: Telecom backbone
Fibre, microwave and radio links carry control traffic between substations and control centres.
Control systemsUtility fibre and radioMPLS and leased linesSerial-to-IP gatewaysStage 3: Grid control centres
Load despatch and control centres watch the grid and switch it remotely, in real time.
Control systemsSCADA and EMSIEC 60870-5-104 linksInter-centre links (ICCP)Challenge5Stage 4: Distribution network
Distribution substations, feeders and ring main units take power into towns and industry.
Control systemsDistribution SCADA and DMSRTUs and FRTUsReclosers and ring main unitsChallenge1Stage 5: Smart metering
Smart meters record use and can connect or disconnect supply remotely.
Control systemsSmart metersMetering head-endMeter data managementChallenge4Stage 6: Field maintenance
Crews and contractors test relays and configure RTUs on site.
Control systemsRelay setting softwareEngineering laptopsContractor accessChallenge3
Attackers rarely go straight for a controller. They travel through these shared systems, so this is where we look first.
For product makers
Building products for electric utilities?
Substations and meters run on devices from a small number of makers. Utilities now ask those makers for secure protocols, certified components and a vulnerability process they can rely on.
- Protection relays and IEDs
- RTUs and substation gateways
- SCADA, EMS and DMS software
- Smart meters and meter gateways
- Utility communication equipment
Security for IEC 61850, IEC 60870-5-104 and other power system protocols, built into the device.
Utilities ask for certified components and a certified development process.
Smart meter gateways are critical products under the CRA (Annex IV) and need third-party conformity assessment. Relays, RTUs and most other grid devices fall in the default class.
Indian transmission and distribution companies must buy OT from trusted sources.
For plant owners
Where it gets hard, and how we tackle it
We start from how your process runs, fix what matters most first, and use what you already own wherever we can.
Hundreds of unmanned sites
Substations are spread across a state or a country with nobody on site. A new device on a bay network, or a changed setting, can go unnoticed for months.
How we tackle itWe set a security baseline for each substation type and add passive monitoring at station level and in the control centre, so unexpected devices and changes raise an alert without a site visit.
Cybersecurity SolutionsSubstation protocols trust what they hear
GOOSE, sampled values and IEC 60870-5-104 were built for speed, not for checking who sent a message. A device on the station network can send commands that relays will act on.
How we tackle itWe segment station and process buses, restrict who can reach them, and monitor for traffic that should not be there. Where your relays support it, we plan the move to IEC 62351 authentication.
Risk AssessmentContractors hold the keys
Relay settings and RTU configuration are often done by contractors on their own laptops, with shared passwords that outlive the contract.
How we tackle itWe set rules for contractor access and portable media, move to utility-owned engineering laptops, retire shared passwords, and train field staff on what to check before they plug in.
Job Readiness TrainingSmart meters add millions of endpoints
A head-end that can disconnect thousands of homes at once is a high-value target, and meter rollouts move faster than security reviews.
How we tackle itWe review the metering architecture and head-end access before scale-up, and set the controls and tests the vendor must pass, so remote disconnect cannot be misused.
Risk AssessmentThe grid is a national target
Attacks on grid control systems cut power in Ukraine in 2015 and 2016. In India, researchers reported state-linked groups targeting regional and state load despatch centres in 2021 and 2022. Source: Recorded Future
How we tackle itWe rehearse the bad day in a tabletop exercise with the control room, IT, management and your reporting line, so everyone knows how to run the grid manually and who calls whom.
Incident Response TTX
Where plant owners usually start
Three ways in
Rules and standards
What applies in electric utilities
- IEC 62443International
Zones, conduits and security levels for substations, control centres and field devices.
- IEC 62351International
Security for power system protocols, including IEC 61850 GOOSE and sampled values, and IEC 60870-5-104.
- CEA Cyber Security in Power Sector Regulations, 2026India
In force from 1 April 2027 for transmission and distribution entities whose OT is linked to the grid.
- NCA OTCC-1:2022Saudi Arabia
Mandatory OT controls for critical national infrastructure operators, built on the NCA Essential Cybersecurity Controls.
- NIS2 and the Network Code on CybersecurityEuropean Union
Risk management and incident reporting for transmission and distribution operators, with extra rules for high-impact and critical-impact entities.
Talk to RelyBlue
Operating in electric utilities?
An honest conversation about your OT environment. No sales pressure, no fear tactics.
- You talk to a senior advisor, never a salesperson