Identity for Energy & Utilities

The job identity does in energy and utilities

In energy and utilities an identity compromise can have physical consequences. The center of gravity is operational technology (OT) access: who can reach control systems, with what rights, and whether that access is monitored, time-bound and recoverable. Around it sit a corporate workforce, field crews, vendor-maintenance contractors, and control rooms where operators share workstations across shifts.

The sector accounts for 1 of the 123 incidents in the Identity Breach Database, and it is the incident that prompted TSA's pipeline cybersecurity directives.

The identity threat picture, from the incident record

A legacy VPN account with a password and nothing else. DarkSide affiliates logged into Colonial Pipeline through a legacy VPN profile the company believed was no longer in use, with a valid password. CEO Joseph Blount told the Senate on 8 June 2021 that the account had only single-factor authentication; how the password was obtained was never determined. The ransomware that followed led Colonial to shut down its fuel pipeline in May 2021. Colonial paid about $4.4 million, of which the Justice Department later seized about $2.3 million. The failure was lifecycle: an orphaned account nobody had disabled.

The remote access edge is shared with every other sector. Utilities run the same VPN products as everyone else, and the database records repeated identity bypasses against them: Pulse Connect Secure webshells harvesting credentials on critical infrastructure networks in 2021, and in 2026 a PAN-OS GlobalProtect authentication bypass and an Ivanti Connect Secure flaw used to harvest Active Directory credentials. When the VPN sits in front of OT, treat it as an identity system.

The regulatory floor

NERC CIP (North American bulk electric system). The identity requirements are specific and auditable:

Standard	Identity requirement
CIP-004-7 R3 to R5	Personnel risk assessments within the last seven years; quarterly check that everyone with access is authorized; privilege review every 15 calendar months; Interactive Remote Access and physical access removed within 24 hours of a termination; transfers revoked by the end of the next calendar day; shared passwords the leaver knew changed within 30 days
CIP-005-7 R2 and R3	Interactive Remote Access through an encrypted Intermediate System with "multi-factor authentication for all Interactive Remote Access sessions"; methods to see and disable active vendor remote access; the same for vendor connections to EACMS and PACS
CIP-007-6 R5	Enforce authentication where technically feasible; inventory generic accounts and who uses shared ones; change default passwords; for password-only access, eight characters (or the device maximum), three character types, a change every 15 calendar months, and limits or alerts on failed attempts
CIP-003-9 Attachment 1, Section 6	For low impact assets, methods for determining and disabling vendor electronic remote access, and for detecting known or suspected inbound and outbound malicious communications on those connections

The pattern: MFA is mandatory on the remote path, while CIP-007 governs password-only access inside the perimeter.

TSA pipeline security directives. The Security Directive Pipeline-2021-02 series, first issued in 2021 after Colonial and reissued in lettered versions since, sets outcomes through a TSA-approved implementation plan. TSA's November 2024 proposed rule to codify it calls for MFA or controls that give "risk mitigation commensurate to multi-factor authentication," with named compensating controls wherever OT access lacks MFA. Shared accounts are limited to those critical for operations, anyone who no longer needs access must not know the secret, and logs must allow "positive user identification." Domain trusts get regular review. It carries forward the directive's narrow exception: an operator complying with PHMSA control room rules may rely on the room's physical security instead of MFA on ICS workstations. Comments closed on 5 February 2025.

NIS2 (EU). Annex I lists energy (electricity, district heating and cooling, oil, gas and hydrogen), drinking water and waste water as sectors of high criticality. Article 21(2) requires access control policies and "multi-factor authentication or continuous authentication solutions... where appropriate." Essential entities face fines up to at least EUR 10 million or 2% of worldwide turnover. Member States review their entity lists by 17 April 2027. See identity controls for NIS2.

IEC 62443 covers industrial control system security; IEC 62443-4-2 builds component requirements on seven foundational requirements, starting with identification and authentication control. Grid equipment vendors selling in the EU also face the Cyber Resilience Act from 11 December 2027.

Control rooms, shared accounts and contractors

Control room workstations. TSA's exception lets PHMSA-compliant pipeline operators rely on control room physical security instead of MFA at ICS consoles. Wherever you rely on that, document the compensating controls and keep logs that tie each shared session to a person.
Shared and generic accounts. Inventory them (CIP-007 R5.2), list who can use them (R5.3), and change the secret within 30 days when one of those people leaves (CIP-004 R5.4). See shared accounts.
Vendor remote access. Every vendor path should be visible and switchable off quickly, as CIP-005 R2.4 and R2.5 require. Brokered, recorded sessions through PAM fit both NERC and TSA.

The identity controls that matter most

MFA on every remote access login, with no legacy exceptions. Then disable every VPN profile that has not logged in recently; quarterly reviews must cover VPN profiles and local accounts, not just the directory. See MFA rollout.
Fast revocation tied to HR. A 24-hour removal clock for terminations is only achievable with automated deprovisioning from HR events. See joiner-mover-leaver.
Separate OT administration from the corporate domain. Audit domain trusts, and give OT its own privileged accounts. See lateral movement.
Revoke sessions after edge-device flaws. Patching leaves stolen sessions and credentials valid; rotate both.
ITDR across IT and OT. Watch jump hosts and the domain controllers that serve OT. See ITDR.
Tested break-glass. Vaulted emergency accounts that work when the IdP is down and alert on use. See break-glass and the incident response runbook.

Vendors and fit

Privileged and OT remote access: Idira (formerly CyberArk) and BeyondTrust; WALLIX for OT and industrial settings with EU data residency. See best compliant PAM platforms and best PAM for enterprises.
Hard-to-cover accounts: Silverfort for agentless MFA on legacy systems, service accounts and OT.
Identity threat detection: Microsoft Defender for Identity or Semperis for Active Directory; see best ITDR for Active Directory.
Workforce IAM: Okta or Microsoft Entra ID, with Yubico keys; see best phishing-resistant MFA.
Zero trust access: Appgate for self-hosted critical infrastructure deployments. See best zero trust tools.

Background: identity for energy and utilities.

Common pitfalls

Dormant VPN profiles that outlive the people who used them.
Shared operator and vendor accounts without positive user identification.
Control room MFA exceptions that are assumed rather than documented.
Domain trusts that let a corporate compromise reach OT.

Where it is heading

TSA's proposed rule would turn the pipeline directives into permanent regulation, NERC has extended vendor remote access controls down to low impact assets in CIP-003-9, and NIS2 holds EU energy and water operators to MFA and access control baselines.

Frequently asked questions

How did attackers get into Colonial Pipeline?

Through a legacy VPN profile Colonial believed was unused, with a valid password and no MFA, according to CEO Joseph Blount's Senate testimony. How the password was obtained was not determined.

Does NERC CIP require MFA?

Yes for Interactive Remote Access to high impact and medium impact (with External Routable Connectivity) BES Cyber Systems, under CIP-005-7 R2 Part 2.3. Local access inside the perimeter falls under CIP-007 password controls.

Do TSA pipeline rules require MFA on control room workstations?

Not where the operator complies with PHMSA control room rules; control room physical security, documented with compensating controls, can stand in.