Operational technology, industrial control systems, and AI security advisory for pipeline, energy, and critical-infrastructure operators. Houston, Texas.https://windlassconsulting.com/https://windlassconsulting.com/blog/active-vs-passive-vulnerability-assessment-ot/https://windlassconsulting.com/blog/active-vs-passive-vulnerability-assessment-ot/Active scanning finds vulnerabilities by interacting with a target. Passive assessment finds them by watching what's already there. In OT, the choice between the two isn't a preference, it's a constraint, and each has real blind spots.Wed, 23 Sep 2026 00:00:00 GMThttps://windlassconsulting.com/blog/cybersecurity-assessment-plan-annual-cycle/https://windlassconsulting.com/blog/cybersecurity-assessment-plan-annual-cycle/SD Pipeline-2021-02G requires a Cybersecurity Assessment Plan, submitted annually, that proves the Implementation Plan actually works. What the schedule requires, what counts as an assessment method, and what the annual report has to say.Wed, 23 Sep 2026 00:00:00 GMThttps://windlassconsulting.com/blog/cybersecurity-coordinator-responsibilities/https://windlassconsulting.com/blog/cybersecurity-coordinator-responsibilities/SD Pipeline-2021-01G requires a named Cybersecurity Coordinator and an alternate. The designation itself is administrative. What the role does afterward is where programs succeed or stall.Wed, 23 Sep 2026 00:00:00 GMThttps://windlassconsulting.com/blog/cybersecurity-implementation-plan-maintenance/https://windlassconsulting.com/blog/cybersecurity-implementation-plan-maintenance/TSA approval of a Cybersecurity Implementation Plan isn't the finish line. SD Pipeline-2021-02G requires the plan to stay current, and sets specific deadlines for reporting the changes that keep it that way.Wed, 23 Sep 2026 00:00:00 GMThttps://windlassconsulting.com/blog/it-ot-segmentation-pipeline-environments/https://windlassconsulting.com/blog/it-ot-segmentation-pipeline-environments/Most pipeline networks aren't unsegmented on paper. They're unsegmented in practice, one historian export or remote-access jump host at a time. What the zone-and-conduit model actually requires, and where real segmentation projects usually find the gap.Wed, 23 Sep 2026 00:00:00 GMThttps://windlassconsulting.com/blog/pipeline-cybersecurity-incident-response-it-ot/https://windlassconsulting.com/blog/pipeline-cybersecurity-incident-response-it-ot/SD Pipeline-2021-02G requires an Incident Response Plan built around four specific objectives, one of them explicitly about isolating IT from OT. What that means in practice, and why the same containment step reads differently on each side of the boundary.Wed, 23 Sep 2026 00:00:00 GMThttps://windlassconsulting.com/blog/preparing-leadership-tsa-cybersecurity-assessment/https://windlassconsulting.com/blog/preparing-leadership-tsa-cybersecurity-assessment/The Cybersecurity Coordinator can produce every document TSA asks for and the meeting can still go sideways if the executives in the room can't speak to the program behind the paperwork. What leadership actually needs to know going in.Wed, 23 Sep 2026 00:00:00 GMThttps://windlassconsulting.com/blog/it-vs-ot/https://windlassconsulting.com/blog/it-vs-ot/Active vulnerability scanning is standard IT hygiene. Pointed at an OT network, the same scan can trip a control outage, and NIST 800-82r3 explains why the two environments need different playbooks.Sun, 06 Sep 2026 00:00:00 GMT