Five disciplines for an operator beyond the last tower

Whether a power station falls within the Commonwealth's critical-infrastructure regime depends on what it connects to and supplies, and our legal advice is that most of ours do not. Mining customers nevertheless write cyber controls and incident notification into their supply contracts, and a remote community depends entirely on its station. We therefore run a written risk-management programme modelled on that regime, with an annual report our board approves. I treat it as a discipline for describing risk, not a compliance project owned by my team. Each hazard domain has an executive owner: physical security and natural hazards sit with operations, personnel risk with people and culture, supply-chain risk with procurement, and cyber risk with me. I report tested controls separately from controls that exist only on paper, with a date for closing each gap.

Our remote operations centre and the control systems at forty-six stations must keep working if the corporate network is compromised. I separate the two estates by design, but I judge the separation by what actually crosses it. Every connection between them is listed with its purpose, its owner and the person who can close it. Equipment suppliers reach the stations only through one brokered gateway that the operations centre can watch and disconnect. Data the business needs from the operational side, such as generation output and fuel levels, leaves by a one-way path instead of an open query. Our operations division owns the control systems; my team secures and monitors the boundary with them. The hardest discipline is refusing a convenient exception requested in the middle of a storm, when the request always sounds reasonable.

Close to half of our technicians' jobs are at sites where a mobile signal cannot be relied on, and during a cyclone the towers that do exist often lose power. I design field applications to run offline for seventy-two hours, hold a crew's full job list, capture photographs and readings, and synchronise whenever a vehicle's satellite terminal or a base connection becomes available. Conflicts between a crew's record and the office's are settled by rules that crew leaders helped write. Station start-up instructions and safety permits stay with the operations centre's systems and voice procedures, not the application. I measure success by same-day job closure and by the number of records needing manual reconciliation, not by downloads. In Mount Isa, battery life, glare and controls that work with gloves on matter more than the feature list.

A recovery plan for northern Australia has to assume that head office, the nearest depot and the roads between them can all be affected by one event. Our corporate recovery site is now in Brisbane, more than 1,300 kilometres south, while the backup operations centre sits in our Darwin office, where trained operators already work. Before every wet season we fail over the station-monitoring, customer-notification and invoicing systems with the people who would run them, and we record how long it really took. Business owners set recovery objectives, each with its cost shown: some systems return within four hours, the finance system within twenty-four. I also plan for slower threats, including diesel deliveries to stations cut off by flooded roads and staff who are evacuating their own families. A plan that assumes everyone arrives for work is incomplete.

Our contract-invoicing system dates from 2004 and calculates energy, capacity, fuel-index and availability charges under twenty-one supply contracts, each with its own formulas. I do not regard its age as the main risk. The greater risk is that nobody inside the company can explain why a rule behaves as it does. When we outsource, I write into the contract the knowledge that must remain ours: documented configuration, named employees who shadow critical changes, and a right to offer roles to the provider's staff at renewal on fair terms. Our provider still runs hosting, networks and the service desk well. Invoicing support returned in-house in 2024 because that knowledge decided whether customers received correct invoices after each July indexation round. Replacing the system remains a separate decision, to be made on evidence rather than impatience.