These examples show common ways Systems Risk Advisory can help organizations move from concern to a defined scope, practical findings, and next steps.
AWIA RRA and ERP Update for a Water Utility
Typical client
Municipal water or wastewater utility
Need
Update risk and resilience assessment material and emergency response planning so the documents better reflect current operations, cyber risk, physical security concerns, and continuity needs.
Common activities
- Review existing RRA and ERP materials
- Conduct leadership, operations, IT, OT, and emergency management discussions
- Review cyber, physical, operational, and emergency response dependencies
- Identify practical improvement items and planning gaps
- Prepare updated plan language and leadership-ready summaries
Possible outputs
- Updated RRA and ERP content
- Findings and improvement list
- Executive summary or board briefing material
- Suggested training and exercise follow-up
OT/ICS and SCADA Remote Access Review
Typical client
Utility, public works department, electric power organization, or infrastructure operator
Need
Understand who can remotely access control-system environments, how vendors connect, where shared access may exist, and which paths create operational risk.
Common activities
- Map remote access paths used by staff, vendors, integrators, and support providers
- Review VPN, remote support tools, accounts, MFA, approval steps, and logging practices
- Identify paths from business systems into OT or SCADA assets
- Review vendor support practices and emergency access assumptions
- Prioritize controls that reduce risk without disrupting operations
Possible outputs
- Remote access findings summary
- Vendor access improvement recommendations
- Prioritized remediation roadmap
- Leadership briefing on access risk and next steps
Ransomware Readiness Assessment
Typical client
Utility, local government, public works department, or infrastructure organization
Need
Prepare for ransomware that affects billing, email, work orders, file shares, backups, remote access, vendor coordination, public messaging, or operational visibility.
Common activities
- Review backup, restoration, account, endpoint, and remote access practices
- Assess likely operational impacts if business systems or visibility tools are unavailable
- Review escalation, decision authority, insurance, legal, vendor, and communication assumptions
- Identify first-hour and first-day decisions that leaders should prepare before an incident
- Develop improvement priorities tied to continuity of service
Possible outputs
- Ransomware readiness findings
- First-hour decision checklist
- Recovery priority recommendations
- Executive risk briefing or tabletop exercise option
Cybersecurity Assessment for a Small or Mid-Sized Utility
Typical client
Water, wastewater, public works, or municipal utility organization
Need
Identify the most important cybersecurity gaps without overwhelming limited staff or producing an unused technical report.
Common activities
- Review policies, accounts, MFA, remote access, patching, backups, endpoint protection, and logging
- Discuss roles across leadership, IT, OT, operations, engineering, finance, and administration
- Review internet exposure and third-party dependencies at a practical level
- Separate quick fixes from larger planning items
- Prepare findings in plain language for leadership and staff use
Possible outputs
- Prioritized cybersecurity assessment report
- Near-term fix list
- Management roadmap
- Briefing material for executives, boards, councils, or commissioners
Physical Security Review for Critical Facilities
Typical client
Utility, public works department, electric power organization, facility operator, or critical infrastructure site owner
Need
Review facility security conditions that could affect operations, safety, incident response, or continuity of essential services.
Common activities
- Review access control, keys, gates, fencing, doors, lighting, cameras, signage, yards, and field sites
- Discuss after-hours response, law enforcement coordination, and emergency access needs
- Assess cyber-physical dependencies such as communications, control cabinets, telemetry sites, and power dependencies
- Prioritize findings by operational consequence and feasibility
- Recommend practical improvements aligned to site conditions and budget constraints
Possible outputs
- Physical security findings summary
- Site-specific improvement recommendations
- Prioritized action list
- Optional briefing or exercise scenario inputs
Cyber-Physical Incident Response Planning
Typical client
Critical infrastructure organization with connected cyber, physical, operational, and public communication dependencies
Need
Prepare for incidents where cyber events, facility access, field operations, public messaging, vendors, and emergency response must be coordinated.
Common activities
- Review existing incident response and emergency response procedures
- Clarify roles, escalation paths, decision authority, vendor contacts, and external coordination
- Identify where cyber response and emergency operations need to connect
- Develop decision points for containment, continuity, public messaging, and recovery
- Prepare plan language that can be used during an actual incident
Possible outputs
- Incident response planning improvements
- Role and escalation matrix
- Cyber-physical decision checklist
- Tabletop exercise scenario option
Tabletop Exercise for a Utility Cyber-Physical Incident
Typical client
Water utility, wastewater utility, electric power organization, public works department, or local government team
Need
Test how leadership, operations, IT, OT, communications, emergency management, and outside partners make decisions under incident pressure.
Common activities
- Design a realistic scenario based on utility operations and likely decision points
- Develop injects that test communications, containment, continuity, public messaging, and recovery
- Facilitate discussion with executives, operators, IT, OT, emergency management, and public information staff
- Capture strengths, gaps, assumptions, and unresolved decisions
- Prepare after-action findings and improvement recommendations
Possible outputs
- Exercise plan and facilitation materials
- Scenario injects and discussion questions
- After-action summary
- Improvement plan with practical next steps
Executive or Board Cyber Risk Briefing
Typical client
Board, council, commission, executive team, general manager, city manager, public works director, or senior leadership group
Need
Help decision-makers understand cyber, physical, and operational risk in terms of service continuity, public trust, cost, and leadership responsibility.
Common activities
- Review current concerns, recent findings, regulatory drivers, and leadership questions
- Translate technical risks into decision-ready language
- Explain risk scenarios without unnecessary technical detail
- Frame investment options, governance issues, and practical improvement priorities
- Support discussion around next steps and management accountability
Possible outputs
- Executive briefing deck or memo
- Leadership risk discussion points
- Recommended next-step options
- Optional follow-on assessment or workshop scope
Emergency Response Planning and Continuity Workshop
Typical client
Utility, public works department, local government organization, or critical infrastructure operator
Need
Improve emergency response planning for disruptions that affect operations, staffing, communications, facilities, vendors, public messaging, and recovery.
Common activities
- Review current emergency response, continuity, and communication materials
- Identify decision points for degraded operations and loss of normal tools
- Discuss roles across leadership, operations, emergency management, public information, IT, OT, and vendors
- Develop practical updates to planning materials
- Identify training and exercise needs
Possible outputs
- Planning workshop summary
- Updated plan language or improvement recommendations
- Continuity decision checklist
- Training and exercise recommendations
Electric Power Control-System Readiness Review
Typical client
Municipal electric utility, public power agency, electric cooperative, or organization with electric power operational dependencies
Need
Review cyber, physical, and operational readiness issues affecting substations, field assets, remote access, distribution automation, control systems, and incident response.
Common activities
- Discuss control-system architecture, remote access, field assets, vendor support, and operational dependencies
- Review physical security issues affecting substations, yards, cabinets, communications, and access points
- Identify incident response considerations for loss of visibility, abnormal control activity, or remote support compromise
- Prioritize improvements that account for reliability and safety
- Prepare leadership-ready findings and next steps
Possible outputs
- Control-system readiness findings
- Cyber and physical improvement priorities
- Incident response planning recommendations
- Optional tabletop exercise or training scope
