A control room should rehearse running the grid without the office network

Most of the cyber security reporting I see at electricity distributors measures what has been installed: the share of systems patched, the number of controls in place, a maturity score against a framework. Those measures have their uses. My position is that the most important evidence a distributor's board can receive about operational technology is different: how long the control room has actually run the grid with its corporate network disconnected, what failed when it tried and what has been fixed since. A distributor that has never rehearsed isolated operation does not know whether its maturity score means anything on the day it matters.

I do not argue this because I think attacks on control systems are imminent everywhere, or because I believe isolation is a substitute for defence. Most serious incidents at utilities so far have begun in business systems rather than in the control network. That is precisely the point. When a large US fuel pipeline shut down in 2021, the attack had reached its business systems, and the company stopped operations partly because it could not be sure what else was affected and could not bill or schedule normally. The question for any utility is not only whether attackers can reach its control systems. It is whether the grid can be operated when the systems around the control room are untrustworthy.

The doors I once installed

Before I worked for utilities I worked for a maker of substation protection and automation systems. To support our customers, we left modems and later network connections into their substations so that our engineers could adjust settings without driving out. Customers appreciated it. Few of them kept a list of those connections, and some forgot they existed once the commissioning engineer left.

When I became chief technology officer at Quillmere in 2019, our inventory found fourteen always-on supplier connections into our control system, relay engineering tools and meter collection system. None was malicious and most were documented somewhere, but not in one place and not with an owner. Data from the control room's historian reached the corporate network through a firewall rule that nobody could explain. Closing those connections was technically simple and commercially awkward. Two suppliers raised their support fees by a combined C$640,000 a year, and one would not work through brokered access at all, so we replaced its tool for C$1.2 million. Our vice-president of operations warned that urgent fixes would take hours instead of minutes. Today, urgent supplier sessions are approved in a median of 22 minutes, recorded and closed when the work ends.

Run the isolation drill until it breaks

Closing doors is the part that maturity frameworks measure well. The harder part is knowing whether the control room can work alone. In May 2022 we disconnected our control network from the corporate network for what was planned as a seven-day drill. It lasted nine hours. Our outage management system depended on the corporate identity service, and field crews' dispatch tablets could not reach the control room once the link was cut. None of this appeared on any architecture diagram, because the dependencies had grown through convenience over a decade.

We fixed what the drill found. The control room now has its own identity and dispatch arrangements. We printed and maintain switching procedures for the 96 feeders with automated switching, and every operator has used them on a live system during a planned exercise. Our October 2025 drill ran for seventy-two hours with no loss of switching capability. We have not yet run for seven days, and I report that gap to our audit and risk committee rather than describing the programme as complete.

The drills changed people as much as systems. Before 2022 most of our operators had never switched a feeder from a printed procedure while talking to a crew by radio, because the management system had always proposed the sequence. In the first drill several of them hesitated over steps they would have clicked through without thought on a normal day. By the third drill the hesitation had gone, and two operators had rewritten procedures that did not match the field. I now regard those corrections as one of the drill's main products. A procedure that has never been used under pressure is a draft, however neatly it is filed.

The drills cost money and attention. Each one takes control-room overtime, field supervisors' time and some acceptance of risk, since we run them on the real network in mild weather with extra staff on shift. I think that is the right price. A distributor that will not accept a planned, staffed, reversible isolation on a calm day is unlikely to manage an unplanned one during a storm.

What a board should ask for instead of a score

As a distributor, Quillmere sits mostly outside the bulk-system reliability standards that bind transmitters, and our regulator's cyber security framework asks us to report our maturity every year. We file that report, and our score has improved. I do not present it to our board as the main evidence. I present four things instead: the number of always-on external connections into operational systems, which should be zero; the median time to approve an urgent supplier session; the longest period we have run the grid in isolation; and the dependencies the last drill exposed, with their status.

There are honest objections. Isolation drills can create the risk they are meant to reduce, which is why we hold them in mild weather with additional staff. Smaller distributors may lack the control-room depth to rehearse at all; for them, a shared exercise with neighbouring utilities may be more realistic. And a drill tests what its designers think to test. Ours left out the meter collection system in 2022 to keep the scope manageable, and we later found that it shared a server with the corporate network.

My advice to any utility board is to stop accepting maturity scores as the headline. Ask management how long the control room last ran alone, what broke and what it would take to run for a week. If the answer is that it has never tried, that is the most important cyber finding the board will receive this year.