Validate IT network security and IT/OT segmentation
The Enhanced CIRMP Rules now set network segregation of critical systems as the benchmark for lateral-movement risk (s 8C). NodeZero tests whether yours holds. Energy utilities operate converged IT/OT networks where a compromised corporate system can become a pathway to operational technology. NodeZero tests the IT layer — corporate networks and control centre IT systems — and tests whether segmentation stops lateral movement from IT into OT environments.
Your specific challenges
Enhanced CIRMP requirements
Critical electricity, gas and liquid fuel assets are among the nine classes under the Enhanced CIRMP Rules 2026, phasing in over 24 months (to June 2028). Assets designated as Systems of National Significance can also be required to undertake vulnerability assessments and cyber security exercises.
IT/OT convergence risk
Attackers typically compromise IT networks first, then look for a path into OT. Segmentation between corporate IT and SCADA networks decides whether they find one.
AESCSF under the enhanced rules
Enhanced energy assets that choose the AESCSF must meet Security Profile 2 of the 2023 AESCSF Framework Core (s 8A(3)); Essential Eight ML2, C2M2 MIL-2, ISO/IEC 27001:2023, NIST CSF 2.0 or an equivalent framework (s 8A(4)) are the alternatives.
Built for your situation
IT/OT segmentation testing
NodeZero tests whether compromised IT systems can reach SCADA data collectors, control centre systems, or OT networks. Shows whether isolation held under test.
Vulnerability assessment evidence
Internal and external pentesting, with Quick Verify re-runs for internal environments. Reports show each proven weakness with CVSS-aligned scores and fix guidance — evidence you can put in front of a CISC reviewer.
Pair with OT-specific tools
NodeZero covers the IT layer and the IT/OT boundary; it does not test inside OT/SCADA networks. Pair it with an OT security platform such as Claroty, Dragos or Nozomi Networks for OT asset visibility and threat detection.
Validate your IT/OT segmentation
See how NodeZero tests the IT layer and IT/OT boundary in energy environments