About
I'm a former Senior Director, Infrastructure, Telecom, SCADA & Data Center after a decade at a regulated pipeline operator. My oversight there covered network architecture, enterprise business continuity, the SCADA platform supporting the regulated pipeline lines, and the TSA Pipeline Security Directive controls, all structured against NIST CSF. I was directly involved in on-site TSA audit meetings, stepping in on auditor questions the team's paperwork alone didn't settle. Windlass starts from that vantage point: the SCADA environment and the regulatory relationship behind it, along with the network around them.
The problems that program addressed show up in OT environments well beyond TSA-regulated pipelines: IT/OT segmentation, a SCADA environment that can't take the patching or scanning cadence of a corporate network, and a security program that has to hold up under outside review. I work from NIST CSF, NIST SP 800-82 Rev. 3, and IEC 62443, whether or not a specific federal directive applies.
How engagements work
Assessments are vendor-neutral: recommendations follow what the assessment finds, not a product line. Findings map to NIST CSF and to the regulatory requirements your operation already answers to. Assessment work is passive by design, on both the OT and IT side: architecture review, configuration audit, and protocol capture that characterize a network without sending it traffic it was not built to handle. TheICS and OT security assessment page covers what an engagement includes.
To discuss an engagement