Critical infrastructure deserves critical engineering
Energy & Utilities
What the compliance landscape actually demands.
NERC CIP — Critical Infrastructure Protection — is the mandatory regulatory framework for bulk electric system operators, covering generation, transmission, and distribution facilities meeting the BES asset classification threshold. NERC CIP is not a single standard: it is a collection of 13 standards (CIP-002 through CIP-014) addressing different dimensions of critical infrastructure protection. CIP-002 requires identification and categorization of BES Cyber Systems. CIP-005 requires Electronic Security Perimeters — defined network boundaries segregating BES Cyber Systems from other networks, with specific requirements for interactive remote access that most OT-IT convergence architectures violate without intending to. CIP-007 requires system security management including patch management, port and service control, and malware prevention on BES Cyber Systems. CIP-013 requires supply chain security risk management. Violation fines reach $1 million per violation per day — and NERC's enforcement record shows that auditors are finding violations at utilities that believed they were compliant. TSA security directives for pipeline operators, issued following the Colonial Pipeline attack, impose analogous requirements under different regulatory authority. IEC 62443 provides the technical standard for industrial automation and control system security that underpins both NERC CIP and TSA directive compliance in OT environments.
NERC CIP compliance on paper and NERC CIP security in production are two entirely different states — and adversaries are exploiting the gap at a rate of 1,162 attacks on US utilities in 2023 alone.
1,162 cyberattacks on utilities in 2024 — 70% increase year over year. Grid vulnerability points growing by 60 per day. $174B in capital expenditure with 'patchy returns' on digital transformation. Utilities are spending massively and getting mediocre results from legacy vendors and Big 4 consultants.
Talk to an Engineer →
First call is a senior engineer — not a sales team. We understand your regulatory environment before we write a line of code.
Start a ConversationWhere Incumbents Fall Short
The US electric grid was attacked 1,162 times in 2023 — a 70% increase year over year, with vulnerability points growing by approximately 60 per day as grid edge devices proliferate. Most of these attacks targeted operational technology infrastructure running on unpatched systems, communicating over unencrypted protocols, and connected to corporate IT networks through inadequately controlled access points. NERC CIP compliance does not equal security: a utility can satisfy every NERC CIP control on paper while maintaining undetected persistent adversary access through attack vectors the NERC CIP standards don't address. The $174 billion capital expenditure cycle in US energy is creating new technology integration requirements at the grid edge — wind, solar, battery storage, EV charging infrastructure. FERC Order 2222 requires these distributed energy resources to participate in wholesale electricity markets, demanding new technology platforms for DER aggregation, dispatch, and settlement that must integrate with legacy SCADA systems and satisfy NERC CIP security requirements simultaneously. The OT-IT convergence that enables these capabilities creates compliance boundary questions that engineering teams with IT backgrounds routinely miss: is the newly connected system inside the Electronic Security Perimeter? Does it qualify as a BES Cyber Asset? What interactive remote access controls apply?
How We Approach Energy & Utilities
The Algorithm approaches energy and utilities engagements with NERC CIP compliance at the control layer — not the documentation layer — as the defining engineering requirement. BES Cyber System classification analysis begins at the architecture phase, with every connected component evaluated against the NERC CIP-002 categorization criteria before network topology decisions are finalized. Electronic Security Perimeter design follows CIP-005 requirements with documented interactive remote access controls that satisfy CIP-007 requirements — including the authentication, encryption, and session monitoring requirements that most legacy remote access implementations do not meet. OT-IT connectivity is designed with the Electronic Security Perimeter boundary explicitly defined, documented, and enforced rather than assumed. For utilities implementing DER aggregation under FERC Order 2222, the platform architecture addresses both the FERC market participation technical requirements and the NERC CIP security requirements for the control systems involved. IEC 62443 security levels are applied to OT system design, providing the defense-in-depth architecture that NERC CIP and TSA directives require but do not fully specify. Anomaly detection is implemented at the control system layer — not just at the IT network perimeter — because adversaries who have penetrated the OT environment are not visible to IT-layer monitoring tools.
What Success Looks Like
A successful engagement delivers SCADA security architecture that satisfies NERC CIP requirements at the control layer — with evidence packages organized for NERC audit, not just policy documentation. Electronic Security Perimeter boundaries are defensible. Interactive remote access controls satisfy CIP-007. Supply chain security risk management satisfies CIP-013. Anomaly detection identifies suspicious activity in OT environments before it becomes an operational event. For DER aggregation engagements, the platform participates in FERC Order 2222 wholesale markets with NERC CIP compliance maintained throughout the operational environment. The security team can demonstrate compliance with evidence from production systems rather than documentation exercises. The operations team trusts the infrastructure because it was designed for the OT environment — not adapted from an IT security framework.
Duration: 8 - 16 weeks
Output: Production system + audit documentation
A utility securing critical infrastructure typically engages at Tier II — NERC CIP native, production in months.
What We Deploy in Energy & Utilities
Energy & Utilities Compliance Assessment
A structured checklist for evaluating your AI and software vendor's readiness across the key regulatory frameworks in Energy. Free — no email required.
Download PDF →Ready When You Are
Working in Energy & Utilities?
We've deployed teams in this environment. First call is a senior engineer.
Engineering Specifics — Energy
Audit-trail architecture that captures the named user, the resource accessed, the operation performed, and the workstation identity in a format NERC CIP examiners directly accept — not a log file that requires translation for an external audit.
Access-control logic enforced at the data layer rather than the application layer — every read of a regulated record validates authorization against the live scope of the requesting principal, preventing the cross-scope exposure that has produced multiple OCR and FFIEC findings in Energy environments.
Encryption configured to the specific cipher-suite and key-management requirements NERC CIP, NIST, NIS2, FERC actually mandates, not the closest nominal default. Key rotation, key-access logging, and key-escrow architecture are designed at engagement intake, not after the first audit.
Incident-response architecture that satisfies the strictest notification timeline among NERC CIP, NIST, NIS2, FERC. Pre-staged runbooks, pre-drafted regulator-facing templates, and automated detection-to-paging pipelines make the published notification deadlines architecturally enforceable rather than procedurally aspirational.
Continuous compliance evidence generation rather than retroactive assembly — every change-control event, access-provisioning event, and configuration update produces structured records aligned to NERC CIP on the day the event happens, queued for the next audit pack with no manual reconstruction.
Quarterly audit pack delivered to your compliance officer without a request — workforce roster, access events, change attribution, incident register, training-currency report, mapped to NERC CIP, NIST, NIS2, FERC in the format your audit program already uses.
What We Ship — Energy
A working production system in your tenancy, NERC CIP-compliant from commit one, delivered on the named milestone date — not a discovery document, not a refactor backlog, not a phase-two scope-expansion request.
Compliance baseline documentation aligned to NERC CIP, NIST, NIS2, FERC for Energy — workforce attribution logs, data-flow diagrams, access-control inventory, encryption-key inventory, incident-response runbook — delivered as engagement artifacts, not assembled before the first audit.
IP and source-code transfer effective from day one — your engineering team owns the repository, the deployment pipeline, the infrastructure-as-code; we do not hold operational hostage and the cost model rewards us for delivery, not retention.
Knowledge transfer that survives the engagement — every operational decision documented in runbooks an on-call engineer can follow at 3 AM without paging us. The deliverable is autonomy, not dependency.
ALICE compliance enforcement integrated into your CI pipeline before engagement close — NERC CIP, NIST, NIS2, FERC anti-patterns are blocked before they merge, so the compliance posture does not drift between audit cycles.
Post-engagement retainer optionally available for the first six months — defined escalation path to the original engagement team for incidents or critical questions. Most clients do not need it, because the system is designed to be operated without us.
Common Findings We Remediate — Energy
Audit-trail gaps: log records that exist but cannot be joined back to a named user, a specific resource, and a timestamp from a synchronized source. Reconstructed under examination, the gaps show up as "we cannot determine who did this" — the finding regulators specifically write up under NERC CIP, NIST, NIS2, FERC.
Authorization-vs-authentication confusion: code paths that verify the requesting principal is logged in but do not verify the principal is authorized for the specific resource. The result is cross-scope data exposure that has produced OCR, FFIEC, and ICO settlements in Energy environments at scale.
Encryption configured to a nominal label rather than the specific cipher-suite, key-length, and key-management requirements NERC CIP, NIST, NIS2, FERC actually mandates. The audit finding is "encryption is implemented but not validated"; the architecture fix is to pin the implementation to a validated cryptographic module from engagement start.
Incident-response runbooks that exist as documents but have never been exercised against the specific notification timelines Energy obligations impose. The first real incident is the wrong time to discover the runbook references a tool no one configured or a contact who no longer works at the organization.
Vendor-management and BAA-equivalent gaps: third-party services that receive regulated data without the contractual basis that NERC CIP, NIST, NIS2, FERC requires. The pattern is usually accidental — a new SaaS integration added during a sprint without compliance review — and produces a finding under every modern regulatory framework.
Compliance evidence assembled retroactively before the audit cycle, then re-assembled before the next one — burning meaningful margin for engagement work that should be generated continuously by the deployment pipeline. The fix is once: instrument the systems to produce audit evidence as a byproduct of normal operations, not on demand.
Why The Algorithm — Energy
The Energy engineering market is crowded with generalist firms claiming sector competence and sector specialists with limited engineering depth. The combination — deep engineering capability and operational Energy compliance fluency — is rare, and that gap is where the most expensive vendor failures happen.
Our teams come through the Algonauts pipeline trained on NERC CIP, NIST, NIS2, FERC before they touch a client codebase in Energy. The training is not optional and not certificate-only — engineers must demonstrate working competence on representative compliance scenarios before they are deployed. This is the reason our Energy clients do not see the "compliance was an afterthought" pattern that drives most remediation engagements.
Engagement pricing is fixed. The price you agree at engagement start is the price at delivery. Scope changes that materially expand the engagement are negotiated transparently as change orders; we do not bury scope creep in velocity reports or sprint backlogs. The economic model rewards us for delivering, not for billing — and that alignment is the foundation under everything else above.
Common Procurement Questions — Energy
How is this engagement different from staff augmentation?
Staff augmentation places named contractors against an hourly rate card; the client retains accountability for delivery, methodology, and code quality. Our engagements are fixed-price commitments against named milestones; we retain accountability for delivery and ship the system as a deliverable, not the engineers as a resource. The contractual posture, the team composition, and the economic incentives are different.
What happens if the engagement scope changes?
Material scope expansions are negotiated transparently as change orders against the original engagement. We do not bury scope creep in velocity reports or sprint backlogs. Minor clarifications and emergent design decisions are absorbed without change orders — the fixed-price commitment includes a reasonable allowance for in-scope adjustments that any real engineering project requires.
What does post-delivery support look like?
The deliverable is designed to be operated by your team without our continued involvement. Documentation, runbooks, and the ALICE compliance enforcement layer continue to enforce the standards after we leave. Optional retainer support is available for organizations that want a defined escalation path to the engagement team for the first six months; most clients do not need it.
How do you handle data access during the engagement?
Production data access for our engineers is mediated through the same compliance controls that govern your internal engineering team. Named workforce documentation, framework-specific training currency, background checks, and BAA or equivalent agreements are completed before access provisioning. Access events are logged with the engineer's named identity, not a shared service account.
What is the procurement path?
Most engagements begin with a 30-minute scoping conversation, followed by a written engagement proposal within five business days that specifies scope, milestones, fixed price, and named team members. Standard contracting cycles complete within two weeks of proposal acceptance. We are familiar with enterprise procurement gating (vendor onboarding, SOC 2 review, BAA execution, MSA negotiation) and we support these processes without billable consulting overhead.