What happened
Dragos, Accenture, the SANS Institute and Elastic launched the Community Cyber Resilience Foundation, committing $10 million in free OT security platform licenses, expert configuration, integration, and a year of ongoing support for up to 500 small utilities (annual revenue under $100 M). The effort targets the hardware and skill gaps that have left many rural utilities vulnerable to cyber‑attacks with potential physical impact.
Why it matters for trust and compliance
- The program illustrates why a continuous vendor‑risk management program—capturing onboarding contracts, configuration logs, and training records—is essential for demonstrating control assurance across frameworks.
- Provides a concrete example of third‑party oversight that can be mapped to control‑assurance evidence requirements.
- Shows how documented deployment and training activities create a defensible audit trail for vendor risk controls.
Who is affected
Small electric utilities Small gas utilities Small water utilities
Recommended actions
- Map third‑party onboarding, configuration, and support processes to your vendor‑risk control objective and begin collecting evidence in a continuous‑monitoring system.
- Record all OT staff training and certify competency as part of your control‑assurance documentation.