Energy and utilities
Oil and Gas
From wellhead to fuel pump, oil and gas runs on control and safety systems spread across remote sites, long pipelines and dense refineries.
How the process runs
From wellhead to customer
Upstream produces, midstream moves and stores, downstream refines and sells. Each stage has its own control systems, and its own safety systems that stop a bad day from becoming a disaster.
Stage 1: Production
Wells, gathering lines and separators bring oil and gas to the surface and split them.
Control systemsWellhead RTUsProduction SCADAEmergency shutdown (ESD)Challenge2Stage 3: Refining and processing
Refineries and gas plants separate and convert crude and gas into fuels and feedstock.
Control systemsRefinery DCSSafety instrumented systems (SIS)Fire and gas systemsChallenge1Stage 4: Storage and terminals
Tank farms and terminals store product and load ships, rail wagons and trucks.
Control systemsTank gaugingTerminal automationLoading gantry PLCsStage 6: Distribution
City gas networks and fuel stations deliver to homes, industry and vehicles.
Control systemsCity gas SCADAFuel station automation
Attackers rarely go straight for a controller. They travel through these shared systems, so this is where we look first.
For product makers
Building products for oil and gas?
Safety systems, control systems and metering are built by specialist makers, and operators now expect them to show how the product is secured, not just that it works.
- Safety instrumented systems
- DCS and SCADA platforms
- Flow computers and metering skids
- Wellhead RTUs and gateways
- Online analysers
Operators ask for certified components and a secure development process, especially for safety systems.
The owner must assess SIS security (clause 8.2.4), so the SIS maker is asked for security guidance and evidence.
Aramco suppliers need a cybersecurity compliance certificate under SACS-210 (formerly SACS-002), which now has an OT category.
Controllers, gateways and software sold in the EU need CE marking under the CRA from 11 December 2027.
For plant owners
Where it gets hard, and how we tackle it
We start from how your process runs, fix what matters most first, and use what you already own wherever we can.
Safety systems are a named target
In 2017, TRITON malware reached the safety instrumented system of a petrochemical plant in Saudi Arabia and was found only after the plant tripped. The attackers came in through the IT network and an engineering workstation. Source: CISA
How we tackle itWe assess the SIS as its own zone: who can reach it, which workstation can program it, and whether the key switch is left in PROGRAM. The result is the SIS security risk assessment that IEC 61511 asks for.
Risk AssessmentRemote sites on public links
Wellheads and pipeline stations report over cellular, satellite or radio, often through gateways with default settings, hours from the nearest engineer.
How we tackle itWe harden and document every remote link: encrypted tunnels, gateway configuration, only the traffic the process needs, and monitoring at the control centre.
Cybersecurity SolutionsLose IT, lose the pipeline
In 2021, Colonial Pipeline halted its fuel pipeline for five days as a precaution after ransomware hit its IT network. The ransomware was on the IT side, yet the pipeline still stopped. Source: US Senate testimony
How we tackle itWe map which IT services operations truly depend on, separate them properly, and write a plan to keep running, or restart safely, when IT is lost. Then we test that plan in a tabletop exercise.
Incident Response TTXMetering numbers are money
Flow computer settings decide what a buyer pays. A changed factor or configuration can move money quietly for months.
How we tackle itWe restrict who can change metering configuration, add change detection, and keep an audit trail your commercial team can check.
Cybersecurity Solutions
Where plant owners usually start
Three ways in
Rules and standards
What applies in oil and gas
- IEC 62443International
Zones, conduits and security levels for production, pipeline and refinery control systems.
- IEC 61511International
Functional safety for safety instrumented systems. Clause 8.2.4 requires a security risk assessment of the SIS.
- API 1164United States
Cybersecurity for pipeline control systems (third edition, 2021).
- NCA OTCC-1:2022 and Aramco SACS-210Saudi Arabia
OTCC for critical infrastructure operators. SACS-210 (formerly SACS-002) for Aramco suppliers, now with an OT category.
- NIS2European Union
Oil and gas operators are in the energy sector, with risk management and incident reporting duties.
- CERT-In Directions, 2022India
Cyber incidents must be reported to CERT-In within 6 hours.
Talk to RelyBlue
Operating in oil and gas?
An honest conversation about your OT environment. No sales pressure, no fear tactics.
- You talk to a senior advisor, never a salesperson