Sector · Energy and utilities

The grid runs continuously. Systems have to follow.

A utility runs control systems with long lifecycles alongside business platforms that change quickly. The boundary between them is an architecture question.

What we see

  • The control system and field service management do not share a vocabulary. Data usually travels through a historian and then a file export.
  • Smart meters produce load curves per household. That is operational data and personal information at the same time.
  • Outage windows are rare and planned far ahead. A project that assumes an unplanned restart does not happen, whatever benefit is claimed for it.
What is at stake

Two domains. Two rhythms.

01

Separation of domains

Control and business systems share neither update cadence nor tolerance for change. Connecting them calls for declared, logged gateways rather than access opened case by case.

02

Consumption data

A fine-grained reading reveals identifiable household habits. Where it is hosted, and which law applies to the provider, deserve the same analysis as any customer file.

03

A moving framework

European risk management obligations already apply to covered entities. A Canadian federal framework on the protection of critical cyber systems would also cover energy; its status is worth checking before building a plan on it.

What we do

Clear boundaries. Recoverable steps.

01

Azure landing zone with strict separation

Business environments are written as code, with network segmentation that denies paths towards the control domain by default. Exceptions are explicit, named and logged.

02

AI agents on maintenance and field work

Eight weeks to put an agent into service on intervention reports, maintenance procedures and equipment documentation. The corpus is frozen before we start and sources are cited in every answer.

03

Microsoft 365 Copilot after classification

The programme follows an inventory of document spaces and a rework of permissions. Directories holding grid or consumption data are handled separately.

04

WIN TO LUX

Migration from Windows Server to Linux and from Active Directory to FreeIPA, aligned to existing outage windows. Each wave stays reversible until the next one starts.

Applicable frameworks

What applies. What remains to be checked.

Law 25 (Quebec), section 17

Since September 2023, transferring personal information outside Quebec requires a documented assessment of the legal regime of the receiving state. Customer and consumption data fall within that scope.

NIS 2

The European directive places risk management and incident notification obligations on covered entities, energy among them. Accountability rests with management bodies.

CLOUD Act

A company subject to US law can be compelled to produce data it holds, regardless of where the server physically sits. A European data centre run by a US company remains in scope, which is why operators such as OVHcloud, Scaleway or Infomaniak come into the discussion.

Start by seeing

No commitment. A technical opinion.

If the boundary between control and business systems is under discussion at your end, we can talk about it without it becoming a project.

See your external surface