The 21st EnergySec Security AND Compliance Summit

A full-day, town hall-style discussion exploring the future of NERC CIP. Moderated by Lisa Carrington (APS), this interactive Mini Summit encourages attendee participation alongside insights from ERO staff and industry experts.

Monday and Full conference pass holders only. 

Spend the day exploring the wave of changes coming to NERC CIP, including:

• Internal Network Security Monitoring (CIP-015)
• New Supply Chain Security Requirements (CIP-013)
• Updated Incident Reporting Requirements (CIP-008)
• New Defined Terms and Requirements for Virtualization (multiple standards)
• Modified Requirements for System Baselines and Change Management (CIP-010)

• Expanded Scope for Remote Access Controls (CIP-005)

• New Device Categories and Applicability (multiple standards)

• Modified Requirements for Critical Facility Protection (CIP-014)

• Possible new Requirements for Large Loads (e.g. Data Centers)
• The New Suite of Standards to Address Cloud Security (CIP-102 through CIP-115)
• And more

Day Passes available for $495!

Add to Calendarcalendarcalendarcalendarcalendar

A full-day, town hall-style discussion exploring the future of NERC CIP. Moderated by Lisa Carrington (APS), this interactive Mini Summit encourages attendee participation alongside insights from ERO staff and industry experts.

Add to Calendarcalendarcalendarcalendarcalendar

Topics TBA

Add to Calendarcalendarcalendarcalendarcalendar

In 2023, SecureCyber responded to a live cyber incident at a U.S. water treatment facility involving a Russian-aligned threat actor that gained access to an operational HMI system.

While the target was water infrastructure, the tactics, techniques, and gaps uncovered are directly applicable to energy and other critical infrastructure environments.

This session walks through the incident from initial detection to containment and recovery, offering a rare, real-world look at how attackers move inside OT environments — and where organizations are most vulnerable.

Attendees will gain insight into:

• How attackers accessed an OT HMI environment without advanced exploits
• Common OT security gaps that make these systems accessible targets
• Where detection and response broke down — and why
• Practical approaches when traditional IT tools fall short in OT
• Actions energy organizations can take now to improve visibility and resilience

Led by Shawn Waldman, who directly managed and investigated the intrusion, this session delivers practical, experience-driven insights you can apply immediately.

Add to Calendarcalendarcalendarcalendarcalendar

A full-day, town hall-style discussion exploring the future of NERC CIP. Moderated by Lisa Carrington (APS), this interactive Mini Summit encourages attendee participation alongside insights from ERO staff and industry experts.

Add to Calendarcalendarcalendarcalendarcalendar

This session explores a practical, real-world framework for strengthening cyber resilience across water and wastewater operations.

Key takeaways include:

• Building cybersecurity training for operators and frontline staff
• Lessons from global water security approaches
• Insights from national lab research on critical infrastructure protection
• Innovative workforce models to address the cybersecurity talent gap

Designed for real-world application, this session highlights how organizations can build stronger, more resilient operations by engaging the people who support them every day.

Add to Calendarcalendarcalendarcalendarcalendar

Enjoy a delicious plated lunch outside. For Monday and Full Conference Pass Holders Only.

Add to Calendarcalendarcalendarcalendarcalendar

This interactive session will explore practical ways to detect wireless capabilities in commercial devices — from scanning tools to hands-on inspection techniques.

More details coming soon… but trust us, this one will spark conversation.

Add to Calendarcalendarcalendarcalendarcalendar

This full-day townhall will provide information and foster discussion on key topics affecting the future of NERC CIP. Attendee participation will be supported and encouraged along with contributions from ERO staff and others. Lisa Carrington will serve as emcee/moderator. 

Add to Calendarcalendarcalendarcalendarcalendar

How the ERO Enterprise's approach to assessing internal controls has evolved — from the early Internal Control Evaluation through FERC's Attachment D to today's COSO-based framework and maturity model — giving attendees a clear picture of how their internal control programs are actually being reviewed. More importantly, attendees will leave with practical, actionable steps for demonstrating program strength: which COSO principles most often show gaps, how to organize evidence so audit staff can quickly understand control design and implementation, and how to use compliance history as a tool for self-assessment.

Add to Calendarcalendarcalendarcalendarcalendar

This session examines emerging perspectives in OT security — from focusing on attack vectors instead of asset inventories to prioritizing credible attacks with unacceptable consequences over theoretical low-likelihood scenarios.

Attendees will gain insight into:

• The evolving difference between espionage and sabotage threats

• Why traditional cyber risk models may no longer be enough

• The growing importance of credible consequence analysis

• New developments in Cyber-Informed Engineering and OT defense strategies

• Emerging approaches to secure remote access and resilient design

Designed for security leaders, engineers, operators, and decision-makers, this session delivers strategic insight into where OT cybersecurity thinking is headed next.

Add to Calendarcalendarcalendarcalendarcalendar

CIP-015-1 is approved and October 2028 is closer than it looks, with CIP-015-2 on the horizon. This fireside chat brings together a utility security director responsible for architecture, engineering, and vulnerability management at scale and a product advisor who works these questions daily. The conversation is practical: architecture and scoping decisions, alert tuning, compliance considerations, and what utilities should be asking vendors and their own teams as they commit to a path.

Add to Calendarcalendarcalendarcalendarcalendar

Cyber Fusion Centers (CFCs) are changing the way organizations approach security by bringing together data from firewalls, endpoints, industrial control systems, asset inventories, behavioral analytics, ticketing systems, and more into a single operational picture.

By connecting these data sources, organizations can:

✔️ Improve visibility across IT and OT environments
✔️ Reduce alert fatigue through intelligent automation
✔️ Accelerate incident response and investigation
✔️ Identify early indicators of system degradation or unauthorized changes
✔️ Support predictive maintenance and operational resilience
✔️ Align cybersecurity efforts with safety, uptime, and business objectives

Drawing from real-world experience across the energy, transportation, and manufacturing sectors, this session will explore how organizations are using Cyber Fusion Centers to move beyond reactive defense and build smarter, more resilient operations.

Add to Calendarcalendarcalendarcalendarcalendar

Join us in the Expo Hall for food, fun and photo opportunities with iconic Disney Characters! All pass holders and Family members welcome!

Add to Calendarcalendarcalendarcalendarcalendar

Buffet style breakfast to start the day off right!

Add to Calendarcalendarcalendarcalendarcalendar

State-level initiatives, IBR security, and emerging priorities.

Add to Calendarcalendarcalendarcalendarcalendar

Think your keyboard is just a keyboard? Think again.

USB Human Interface Device (HID) attacks continue to be one of the simplest and most effective ways to bypass traditional security controls by impersonating trusted devices like keyboards and mice.

⚡ Trust No USB: A Hands-On HID Attack Lab

This is not a lecture.

In this practical workshop, participants will build, program, and test their own USB HID attack tool using an RP2040-based microcontroller provided during the session.

Attendees will:

✔️ Learn how HID attacks work
✔️ Program a device to emulate keyboard and mouse behavior
✔️ Explore keystroke injection and other safe attack demonstrations
✔️ Understand how attackers leverage trusted peripherals
✔️ Learn techniques for detecting and mitigating HID-based threats
✔️ Take home their own fully functional device for continued learning

With hardware provided and minimal setup required, participants will gain hands-on experience with a real-world attack technique while learning how to better defend against it.

Whether you're a red teamer, blue teamer, engineer, or simply curious about hardware security, this is one lab you won't want to miss.

Add to Calendarcalendarcalendarcalendarcalendar

As utilities and critical infrastructure organizations face accelerating AI adoption, the workforce challenge is no longer theoretical: workers need practical, trustworthy, and job-relevant training that helps them use emerging tools safely, responsibly, and effectively. This panel will share lessons from AI workforce development pilots involving IBEW Local 77 and the Los Angeles Urban League, connecting utility-sector workforce needs with union training, community-based access, and applied AI readiness.

Panelists will discuss what worked, what had to be adapted, and how pilot programs can support learners, employers, unions, and workforce partners without drifting into AI hype or unrealistic outcome claims. The conversation will focus on practical design choices: learner readiness, partner coordination, curriculum boundaries, evidence capture, and how early pilot experience can become a repeatable workforce pathway. Attendees will leave with a clearer understanding of how to evaluate AI workforce training pilots, what success signals to document, and how energy-sector partners can build training models that are useful, auditable, and grounded in real workforce conditions.

Attendees will leave able to:

1. Identify success signals for AI workforce development pilots beyond attendance and excitement.
2. Understand how union, utility, and community-based partners each define training value.
3. Recognize common friction points in AI readiness pilots, including learner confidence, partner coordination, evidence capture, and scope control.
4. Connect AI training to cybersecurity culture, compliance expectations, operational resilience, and workforce trust.
5. Apply a pilot-to-pipeline model for turning early training success into repeatable workforce development programs.

Add to Calendarcalendarcalendarcalendarcalendar

Buffet style lunch in the Expo Hall to keep you fueled.

Add to Calendarcalendarcalendarcalendarcalendar

Electric utilities face growing cyber threats while operating with limited resources and high reliability demands. This practical, utility-focused session outlines how to evaluate, develop, and implement a Cybersecurity Incident Response Plan (IRP) that aligns with operational realities.

Attendees will learn how to:

• Assess current incident response capabilities
• Define clear roles and communication paths
• Build an actionable IRP that can be exercised and improved over time

This real-world example demonstrates how a well-designed incident response plan strengthens resilience, shortens recovery time, and improves coordination during cyber events.

Add to Calendarcalendarcalendarcalendarcalendar

How Do We Build the Next Generation of Energy Cyber Defenders?

As cyber threats targeting critical infrastructure continue to grow, utilities face another major challenge: finding cybersecurity professionals who understand both cybersecurity concepts and the realities of operational environments.

Developing an Energy-Sector Cybersecurity Workforce Through Experiential, Scenario-Based Risk Assessment Training

This presentation highlights a mobile and web-based training platform designed to immerse learners in realistic utility-focused cybersecurity scenarios — helping participants build practical skills in risk assessment, OT security, and operational decision-making.

Attendees will gain insight into:

Scenario-based cybersecurity training for energy environments

Mobile cyber range and web-based learning approaches

Workforce development strategies for utilities and academic programs

Practical alignment with DOE and NIST risk management frameworks

Lessons learned from pilot implementations with students and industry contributors

Focused on real-world utility operations, this session demonstrates how experiential learning can help strengthen the cybersecurity workforce supporting critical infrastructure.

Add to Calendarcalendarcalendarcalendarcalendar

What would your team do during a real cyber incident?

This hands-on tabletop exercise workshop places participants into incident command roles within a realistic, evolving cyber scenario designed specifically for critical infrastructure environments.

Using a “choose your own adventure” format, participants will make real-time decisions that directly impact how the scenario unfolds.

Attendees will gain practical insight into:

• Incident command decision-making

• Effective tabletop exercise structure and facilitation

• Participant engagement strategies

• Evaluation and after-action practices

• Building realistic exercises for their own organizations

Designed to be interactive, engaging, and immediately applicable, this session offers a rare opportunity to experience what a successful tabletop exercise looks like from the inside.

Add to Calendarcalendarcalendarcalendarcalendar

As cloud adoption accelerates, traditional governance methods can’t keep pace — introducing delays, inconsistency, and increased risk.

💡 Build Safe by Default: Cloud Risk Controls with Infrastructure-as-Code + Open Policy Agent

In this session, you’ll learn how to:

• Apply policy-as-code using Open Policy Agent (OPA)
• Validate infrastructure early with Infrastructure-as-Code (IaC)
• Enforce continuous compliance with cloud-native controls
• Reduce misconfigurations and strengthen risk-based decision making

This is a practical look at how to build automated guardrails that keep your cloud environments secure — from development through deploymen

Add to Calendarcalendarcalendarcalendarcalendar

Agentic AI is accelerating the transformation of power utilities by enabling autonomous monitoring, optimization and decision-making across the modern grid, while simultaneously introducing a new class of cybersecurity risks. As these AI systems operate within operational technology (OT) environments and influence real-time physical outcomes, they effectively act as embedded insiders, expanding the challenge from protecting infrastructure to governing autonomous behavior. This presentation explores emerging risks such as model drift, unsafe decisions, shadow agents and cascading system impacts, and provides practical guidance for utilities to adapt, covering governance frameworks, bounded autonomy, human oversight and phased adoption strategies to ensure innovation strengthens, rather than compromises, grid reliability, resilience and trust.

Add to Calendarcalendarcalendarcalendarcalendar

• Hector R. Perez

  Head of Strategy, Global Industrial Cybersecurity

  Black & Veatch

Sponsors

Quarterly access reviews are essential for CIP compliance—but they don't have to consume countless hours of manual effort.

CIP-004 Quarterlies: Automating Access Reviews with Nova Sync

This practical session walks through the journey from traditional manual quarterly reviews to an automated approach that streamlines compliance activities and reduces administrative burden.

Attendees will learn:
✔️ The intent behind CIP-004 R4.2 and R4.3 requirements
✔️ Challenges of traditional quarterly access review processes
✔️ Lessons learned during Nova Sync implementation
✔️ How automation improved audit readiness and compliance management
✔️ Practical considerations for organizations exploring similar approaches

Whether you're responsible for compliance, identity management, or audit preparation, this session offers real-world insight into modernizing one of the most time-consuming compliance activities.

Add to Calendarcalendarcalendarcalendarcalendar

As regulatory requirements continue to expand and compliance teams face increasing resource constraints, many utilities are reevaluating traditional approaches to compliance management. This session explores the evolution of managed compliance services and how utilities can leverage external expertise, technology, and operational integration to improve efficiency while maintaining accountability.

Attendees will examine why traditional compliance models often struggle to scale, what "managed compliance" can realistically mean for utilities, and how organizations can balance regulatory obligations with operational priorities. The discussion will also explore emerging tooling trends, common implementation pitfalls, and the future role of managed services in supporting compliance, security, and risk management programs.

Participants will leave with practical insights into evaluating managed compliance strategies and preparing for the next generation of utility compliance operations

Add to Calendarcalendarcalendarcalendarcalendar

Buffet style breakfast to start the day off right!

Add to Calendarcalendarcalendarcalendarcalendar

While NERC CIP and ISO 27001 were developed for different purposes, both share a common goal: managing risk and improving organizational resilience. This session explores how utilities can leverage proven governance concepts from ISO 27001 to enhance the effectiveness, sustainability, and maturity of their CIP programs.

Attendees will examine key differences between ISO and CIP cultures, identify governance practices that translate effectively across frameworks, and learn how risk-based thinking can improve decision-making within compliance-driven environments. The discussion will highlight practical governance improvements, common implementation pitfalls, and strategies for balancing regulatory compliance with broader cybersecurity objectives.

Participants will leave with actionable ideas for building hybrid governance models that strengthen compliance programs while supporting long-term security, operational reliability, and organizational resilience.

Add to Calendarcalendarcalendarcalendarcalendar

Power utilities can apply cyber risk quantification (CRQ) to better align cybersecurity investments with grid reliability and resiliencein an increasingly digital and interconnected environment. As modernization efforts expand attack surfaces, the discussion highlights the limitations of traditional qualitative risk approaches and introduces a financial, data-driven framework that translates cyber risk into measurable business impact. Attendees will learn how to evaluate risk using concepts such as annualized loss exposure and Return on Mitigation (RoM), enabling more informed comparisons between cybersecurity and operational investments. The session examines how cyber risk evolves alongside gridtransformation and provides a practical framework for prioritizing controls, supporting compliance and positioning cybersecurity as a strategic enabler of safe, reliable and cost-effective gridmodernization.

Add to Calendarcalendarcalendarcalendarcalendar

• Anirban “Sunny” Ghosh

  NERC CIP Lead, Industrial Cybersecurity Consultant

  Black & Veatch

Sponsors

Artificial intelligence is already reshaping the risk profile of electric utilities, often in places security leaders don't directly control. AI is embedded in vendor tools, cloud platforms, and managed services that touch utility data, shape operational decisions, and sit on the critical path of grid operations. Whether or not a utility is "using AI," its third parties increasingly are, and that has real implications for security, resilience, and CIP compliance. AI is also becoming one of the most powerful tools available to improve visibility and monitoring across complex vendor ecosystems.

This session examines frontier AI through the lens of third‑party and supply chain risk, focusing on what CISOs, OT security leaders, and compliance partners need to do differently. Panelists will explore grounded scenarios where AI‑enabled vendor services change utility risk: accelerated vulnerability discovery driving patch and configuration churn, shared AI platforms becoming common‑mode dependencies, and analytics tools quietly becoming single points of operational dependency. The discussion will also highlight where AI becomes a force multiplier for defenders, from faster vendor inventory and dependency mapping to continuous monitoring, evidence review, and more risk‑based TPRM decision making.

Rather than introducing a new framework, the panel shows how to extend what utilities already know, including C2M2, NERC CIP, NIST CSF, and existing third‑party risk processes, to make them AI‑aware and resilience‑focused. Attendees will leave with practical approaches for tiering vendors by AI usage, updating due‑diligence and contract language for AI‑related risks, using AI to accelerate assessments and monitoring, and planning manual fallback when AI‑enabled services fail mid‑operations. The emphasis is on defensible, auditable artifacts that security leaders can stand behind and operators will actually use.

Attendees will learn:

How frontier AI reshapes utility third‑party, supply chain, and operational risk, including when AI exists only in vendor and platform services. Where AI can strengthen security and TPRM through vendor discovery, continuous monitoring, and evidence review. Practical updates to due‑diligence, contracting, and ongoing monitoring that address AI‑specific risks and the reliability impact of intensified vendor vulnerability management. How to adapt existing C2M2, NERC CIP, and NIST CSF activities to give CISOs integrated, auditable oversight of AI in vendor relationships, without standing up yet another standalone AI program.

Add to Calendarcalendarcalendarcalendarcalendar

 Most OT security reporting dies before it reaches a decision. It stops at raw data and risk context, handing boards CVSS scores, patch percentages, and mean-time metrics that directors have no way to act on. The result is longer board meetings, stalled budget conversations, and security leaders who walk out of the room without the authority or funding they came for. 

This hands-on workshop gives utility professionals a repeatable method for moving reporting up the chain from data to decision, using a four-stage visibility pipeline and the four business-impact lenses in which boards actually think: 

• hours of downtime, 
• lost production value, 
• safety impact, 
• and regulatory exposure. 

Working from their own environments, attendees will build a one-page board report, construct a reusable technical-to-business translation table, and rewrite a real alert as a decision the board can make. 

Participants leave with templates and a framework they can put in front of their own directors the following quarter. No new tooling required. 

Add to Calendarcalendarcalendarcalendarcalendar

Buffet style lunch, giveaways/prizes, and closing comments from the President of EnergySec, Steve Parker.

Add to Calendarcalendarcalendarcalendarcalendar