A state distribution utility, ahead of a CEA audit

The situation

A state distribution utility with a CEA audit approaching. The internal position, documented and repeated for several years, was that the corporate IT network and the operational technology estate were air-gapped. The audit would test that claim.

What we found

Four routable paths between the two estates. One was documented and managed. Three were not: a vendor support link left in place after a commissioning project, a shared management VLAN introduced during a switch replacement, and a dual-homed engineering workstation.

None was malicious and none was recent. All three were the ordinary residue of operational work done under time pressure, which is where this class of finding almost always comes from.

What we did

Mapped the boundary properly, then sequenced closure against the utility's maintenance windows rather than against our own reporting timetable. Two paths closed inside existing windows; the third needed a vendor change that was scheduled rather than forced.

The evidence pack was built as the work proceeded, so the audit submission was a by-product of the remediation rather than a separate exercise afterwards.

What changed

The utility went into the audit with a documented boundary, a closure record and a monitoring rule that alerts if a new path appears. The last part matters most: the finding was not a one-off condition but a recurring consequence of how operational work happens.