Security for operators of essential services, in any country.
F Creative Studio 360 helps operators of energy, water, health, transport, communications and other essential services see cyber risk across corporate and operational systems.
Essential services are not one sector.
The useful question is which assets keep the service running, and which of them a hostile party could disrupt. In the United States, CISA publishes guidance for critical infrastructure. In Australia, the Security of Critical Infrastructure Act applies only to assets that Act actually covers.
F Creative Studio 360 does not file a regulatory report and does not claim to be an appointed government assessor.
- IT and operational technology
- Corporate systems and the systems that run the service are both in view when the scope includes them. They are not treated as the same network.
- The statute is named only when it binds
- SOCI obligations, including a risk programme and incident reporting, are used when the operator is actually subject to that Act. Other countries use their own rule.
- Testing does not trip the plant
- Active testing of operational technology is allowed only with written authorisation, an approved window and a stop condition.
- Suppliers run pieces of the service
- A hosted control system or a maintenance vendor is part of the asset picture.
What can be in scope
The sector changes the assets. The method is the same.
- Essential assets
- The systems whose failure would stop or degrade the service.
- Paths between office and plant
- Remote access, historian links and flat networks that join the two.
- Incident duties
- Who must be told, under the law that applies. We prepare facts. Counsel files.
- Suppliers
- Parties that operate or maintain an essential system.
How an engagement runs
Operators with sites in more than one country can scope one service or several.
- 1
Name the service
Which assets are essential, and which law applies to them.
- 2
Separate IT from operations
So a corporate finding is not written as if it were a plant finding.
- 3
Review or test, as agreed
Operational testing is never a surprise and never a denial-of-service test.
- 4
Hand back a programme the operator can run
Ownership stays with the operator.
What you receive
- An asset view of the essential service in scope.
- A note of paths between corporate and operational systems.
- Supplier and access findings.
- A prioritised list. No government filing by F Creative Studio 360.
Neighbour pages
Industrial control systems and operational-technology security are separate pages when the question is the plant itself, rather than the operator’s wider duty.
Common questions
Is this an Australian SOCI programme?+
Only when the asset is actually covered by that Act. Operators in other countries use the same method against the rule that binds them.
Will you report an incident to a government agency?+
No. We help establish the facts. The operator and its counsel make the report the law requires.
Where do you deliver this?+
For organisations in any country. A local rule is used only when that organisation is actually subject to it. F Creative Studio 360 does not limit the work to one jurisdiction.
How much does it cost, and how long does it take?+
It depends on the systems in scope and whether you want an assessment only or help afterwards. A scoping conversation with F Creative Studio 360 is the way to get a quote. There is no obligation to proceed.
Name the service that must keep running.
F Creative Studio 360 will look at the assets and the law that applies, then say what a sensible review includes.