When an EMS or SCADA environment is compromised, containment sequencing has regulatory consequences: NERC CIP-008 reporting attaches the moment an incident touches a medium or high impact BES cyber system.
The firms below have documented engagements in electric utilities, restoration of SCADA and EMS environments with reporting evidence intact, and field-device work down through the distribution layers of the Purdue model.
The dominant SCADA protocol between control centers and substations
Inter-control-center and wide-area telemetry
Substation automation and protection relaying
Legacy RTU and device-level communication
SEL, ABB, Siemens
GE Mark VI, Siemens S7, ABB
Per-firm hardware-level proficiency is collected at intake and listed once documented, this page does not claim it for any firm.
Incident reporting and response plans, the operative standard for a utility incident
Electronic security perimeters and system management
No documented engagements in this sector yet, firms are added when their case records evidence one.
Browse the full verified OT/ICS directory, filtered by certification, insurance panel, region, and documented response time, or start a structured RFP.
