Critical Infrastructure Complete

An operator's cyber programme has five jobs, usually held by five different people, and they are normally bought one crisis at a time.

OT Security Program Kit for the Plant — the plant itself: asset inventory with automatic risk scoring, zones and conduits with SL-T derived from consequence and exposure, the vendor remote-access broker and the six-step VPN retirement, patch and EOL strategy for equipment that cannot simply be patched, and the safety-first incident playbook built on loss of view versus loss of control.

Critical Infrastructure Regime Kit — the regulators above it: which regimes bind each asset, the NERC CIP 2026-to-2030 calendar, the TSA directive crosswalk with its 12-hour clock, the water regime sheet, twenty control families mapped across every regime with the strictest formulation named, the multi-regime incident clock, and the assessment programme planner. Every row points at the OT-01 file that produces its evidence.

CIRCIA 72/24 Reporting Readiness Pack — the federal duty: whether you are covered, whether an incident is reportable at 2 a.m., and the report drafted inside the first day.

Executive Tabletop Exercise Kit — the drill, with scenario 6 written for exactly this estate.

Director's Cyber Oversight Kit — the board layer: twelve questions with good and weak answer patterns, the oversight evidence log, the charter and expertise statement, and the annual calendar.

Why the whole set. The plant kit tells you what to build and in what order; the regime kit tells you which regulator asks for it and by when; the reporting pack is what happens in the twelve or seventy-two hours after; the tabletop is where you find out whether any of it works; and the oversight kit is what the board asks and records while you do. Build once to the strictest formulation and present each regulator its own view — that is the argument for owning the pair at the centre of this, and the other three are what turn it into a programme rather than a binder.

Safety first, throughout. These kits sit above live processes. Nothing here should be applied without plant engineering in the room, and where a compliance deadline and a safe operating state disagree, the safe state wins and the deviation gets documented.

Sold as a Standard licence at the entry tier because two of the five components are not sold as organisation licences; the vCISO / MSSP tier is available for firms running this across client estates.