Physical isolation for transmission, distribution and substation control

Electricity networks now stretch from corporate trading systems down to IEC 61850 protection inside the substation. When those paths converge, a single compromise can move from an office to a breaker. Control puts a real boundary at every step.

• Ransomware in EMS and SCADA
• IT to OT lateral movement
• Third-party vendor access
• IEC 61850 substation risk

Electricity control networks are converging faster than they can be defended.

IT, OT and market convergence

Trading, settlement and ENCC interfaces sit close to the same control rooms that operate the grid. Attackers traverse those interfaces to reach EMS and SCADA.

Legacy protection alongside IEC 61850

Substations carry a mix of legacy RTUs and modern IEC 61850 IEDs. They cannot all be patched on the same cycle without risking operational disruption.

Distributed energy resources

Inverter-based resources and DER orchestration multiply the number of remotely reachable controllers across the distribution grid.

Energy

"We assumed our substations were isolated. They were, until a vendor laptop was trusted on both sides at the same time."

Where each module is deployed, and what it does there.

One row per module. Placement on the network, then plain-English purpose at that point.

1. 

   Isolate

   At every Purdue boundary

   Office, ICCP, control centre and substation fabrics are physically separate. A compromise on the corporate side cannot reach protection.

2. 

   Firebreak

   On the L5 to L4 link and the L4 to L3.5 link

   A real off switch on the public and office boundaries when an incident is in flight.

3. 

   Validate

   On the L5 to L4 link and inside the L3.5 DMZ

   ICCP and engineering traffic is checked for origin, integrity and authority before it reaches operations.

4. 

   Relay

   Inside the L3.5 DMZ

   Cross-domain data moves on scheduled routes. Nothing streams unattended into the control centre.

5. 

   Execute

   Inside the L3.5 DMZ and on the L2 to L1 link

   Firmware, settings and switching actions hold until the right authority signs them off.

6. 

   Lock

   On the L3 to L2 link and the L1 to L0 link

   The closer you get to primary plant, the tighter the named access. Standing access into substations is the exception.

Sovereign grid data

Grid control and protection data remains within the agreed jurisdiction in carefully selected Firevault Bunkers.

Multi-party control

Critical switching and protection changes require sign-off from both control room and security teams.

Regulatory evidence

Continuous compliance evidence for NIS2, NERC CIP and Ofgem cyber expectations.

Out-of-band management

Cellular and dedicated paths keep the control plane reachable when primary networks are compromised.

Tamper-proof logging

Every access, configuration change and switching command lands in immutable logs on physically separate infrastructure.

Verified configuration baselines

Verified baselines of EMS, IED and SCADA configuration enable a known-good restore of control-plane state.

Network assessment

Map every path between corporate IT, ICCP, EMS, SCADA and substation networks to identify convergence and persistent vendor connections.

Zone architecture design

Design physically separated zones aligned to your control rooms and substation estate, with Control modules at each boundary.

Non-production pilot

Deploy in a test environment mirroring an EMS and substation pair with full zone separation, multi-party authorisation and compliance logging.

Operational deployment

Full deployment across the grid estate with verified configuration baselines, continuous compliance evidence and 24/7 out-of-band management.