A utility runs control systems with long lifecycles alongside business platforms that change quickly. The boundary between them is an architecture question.
Control and business systems share neither update cadence nor tolerance for change. Connecting them calls for declared, logged gateways rather than access opened case by case.
A fine-grained reading reveals identifiable household habits. Where it is hosted, and which law applies to the provider, deserve the same analysis as any customer file.
European risk management obligations already apply to covered entities. A Canadian federal framework on the protection of critical cyber systems would also cover energy; its status is worth checking before building a plan on it.
Business environments are written as code, with network segmentation that denies paths towards the control domain by default. Exceptions are explicit, named and logged.
Eight weeks to put an agent into service on intervention reports, maintenance procedures and equipment documentation. The corpus is frozen before we start and sources are cited in every answer.
The programme follows an inventory of document spaces and a rework of permissions. Directories holding grid or consumption data are handled separately.
Migration from Windows Server to Linux and from Active Directory to FreeIPA, aligned to existing outage windows. Each wave stays reversible until the next one starts.
Since September 2023, transferring personal information outside Quebec requires a documented assessment of the legal regime of the receiving state. Customer and consumption data fall within that scope.
The European directive places risk management and incident notification obligations on covered entities, energy among them. Accountability rests with management bodies.
A company subject to US law can be compelled to produce data it holds, regardless of where the server physically sits. A European data centre run by a US company remains in scope, which is why operators such as OVHcloud, Scaleway or Infomaniak come into the discussion.
If the boundary between control and business systems is under discussion at your end, we can talk about it without it becoming a project.
See your external surface →