Energy and utilities
Power Generation
A power plant turns fuel, water, sun or wind into electricity on a schedule the grid sets. Its control systems run every hour of the year, which is exactly what makes them hard to secure.
How the process runs
From fuel to grid
A thermal unit is a chain: fuel in, steam raised, turbine turning, power out to the grid. Gas, hydro, solar and wind plants skip some links, but every plant ends in the same place: the switchyard and the load despatch centre.
Stage 1: Fuel handling
Coal, gas or biomass is received, stored and fed to the boiler or gas turbine.
Control systemsCoal handling PLCsGas metering skidsConveyor controlStage 4: Balance of plant
Water treatment, cooling, ash handling and compressed air keep the unit running.
Control systemsWater treatment PLCsAsh handling PLCsCooling water controlStage 6: Emissions and reporting
Emissions are measured continuously (in India, streamed live to the pollution control boards) and performance data goes to head office.
Control systemsEmissions monitoring (CEMS)Plant historianPerformance systemsChallenge4
Attackers rarely go straight for a controller. They travel through these shared systems, so this is where we look first.
For product makers
Building products for power generation?
The controls in a power plant are products: turbine and boiler controls, relays, inverters and storage systems. Plant owners and regulators now ask their makers for proof of security.
- Turbine and boiler control systems
- Excitation systems and protection relays
- Solar inverters and plant controllers
- Wind turbine controllers
- Battery energy storage systems
- Historian and performance software
Owners and EPC contractors write IEC 62443 into specifications and ask for certified components and a certified development process.
Inverters, controllers and software sold in the EU need CE marking under the CRA from 11 December 2027. Reporting duties apply since 11 September 2026.
Indian power sector entities must buy OT from trusted sources, a rule carried into the CEA Regulations, 2026.
For plant owners
Where it gets hard, and how we tackle it
We start from how your process runs, fix what matters most first, and use what you already own wherever we can.
The unit cannot stop for security work
Patches, scans and new software need an outage, and a unit gets very few planned ones. A trip in between costs generation and invites questions from the grid operator.
How we tackle itWe start with a passive gap assessment: network traffic, configurations and interviews, never scans of live controllers. Fixes are planned into your outages, and until then compensating controls carry the load.
Gap AssessmentProtection systems share the network
Burner management, turbine protection and switchyard relays prevent explosions, overspeed and equipment damage. On a flat network with the DCS and office systems, one infection can reach them.
How we tackle itWe put safety and protection systems in their own zones, with only the conduits the process needs (IEC 62443-3-2), so a problem in the DCS or the office stops at the boundary.
Risk AssessmentOEMs reach deep into the plant
Turbine, DCS and relay vendors keep remote access for diagnostics, sometimes through modems or accounts nobody reviews. Solar and wind plants go further: the inverter or turbine maker often monitors the fleet from its own cloud.
How we tackle itWe bring every vendor path onto one route the plant controls: named accounts, approval for each session, recording and time limits. For renewable fleets, we set the security terms for the OEM contract, so the owner decides who connects.
Cybersecurity SolutionsData has to leave the plant
Load despatch telemetry, emissions data for the regulator and performance data for head office all need a path out. Every path out is also a way in if it is not built carefully.
How we tackle itWe map every data flow that leaves the plant and route each one through a DMZ with only the traffic it needs. Where data only has to go out, a data diode makes the path one-way in hardware.
Cybersecurity SolutionsThe regulator now asks for proof
In India, the CEA Cyber Security in Power Sector Regulations, 2026 come into force from 1 April 2027 for generating plants of 50 MW and above: a CISO, a crisis management plan, audits and fast incident reporting. Saudi NCA OTCC and EU NIS2 ask for the same discipline. Source: CEA
How we tackle itWe build the programme once and map it to every rule that applies to you: roles, policies, crisis plan, incident reporting and audit evidence, written around how your plant already runs.
Cybersecurity Program
Where plant owners usually start
Three ways in
Rules and standards
What applies in power generation
- IEC 62443International
Zones, conduits and security levels for the control systems across the plant.
- CEA Cyber Security in Power Sector Regulations, 2026India
Notified in July 2026, in force from 1 April 2027. Covers generating plants of 50 MW and above: CISO, crisis management plan, audits and incident reporting within 6 hours.
- NCA OTCC-1:2022Saudi Arabia
Mandatory OT controls for critical national infrastructure operators, built on the NCA Essential Cybersecurity Controls.
- NIS2 and the Network Code on CybersecurityEuropean Union
NIS2 sets risk management and incident reporting for electricity companies. The network code, Regulation (EU) 2024/1366, adds rules for high-impact and critical-impact entities in cross-border electricity flows.
Talk to RelyBlue
Operating in power generation?
An honest conversation about your OT environment. No sales pressure, no fear tactics.
- You talk to a senior advisor, never a salesperson