能源基础设施的网络安全：为什么采购需要处于第一线

Introduction Digital transformation has fundamentally altered the energy sector, integrating AI and other highly While these technologies optimize performance and reliability, they also expose the industry to unprecedentedcybersecurity threats. Any innovation that lacks rigorous security controls is a strategic liability. Without robust security frameworks, breakthroughs in cloud computing, private LTE, and IT/OT integration can Four Technology Trends That Pose CriticalCybersecurity Threats to Energy Infrastructure 1. Artificial Intelligence and Machine Learning As AI and ML become integral to power gridmanagement, predictive maintenance, and demandforecasting, energy companies face several structures fail to keep pace with the continuous Shadow AI Compliance and Contractual Gaps Another critical cybersecurity risk involves theunregulated use of company data, typically referredto as “Shadow AI.” In the absence of strict internalgovernance, well-meaning employees often feedsensitive company data into public AI tools, unknowingly A primary vulnerability lies in outdated complianceframeworks and contractual blind spots that fail toaccount for AI’s dynamic, evolving behavior.In the absence of strong government regulation,companies are turning to voluntary frameworksdeveloped by the National Institute of Standards and Accountability Compounding this challenge is AI’s accountability risk. AIcontract clauses introduce liability shifts, where vendorsdisclaim responsibility for the quality of outputs while Slow Regulatory Updates Timing adds another layer of complexity. The irregularpace of regulatory updates further exacerbates this IT/OT convergence is the integration of informationtechnology systems with operational technology. A lackof control and governance of IT/OT convergence within Internet-connected control networks significantly expandthe attack surface for Supervisory Control and DataAcquisition (SCADA) controls, pipeline valve monitors,and grid data analytics that now interface with corporate Simple oversights, such as improper Virtual LocalArea Network (VLAN) and firewall configurations orlax Privileged Access Management (PAM), remain the To mitigate these risks, companies must go beyondtechnical controls and embed stronger security practices •Third-Party Testing:Sourcing third-partypenetration testing services that independently •Enforcing Compliance:Requiring suppliers tostrictly follow NERC CIP or ISA/IEC 62443 standards •Contractual Obligations:Mandating routine riskassessments in all technology contracts to regularly With procurement playing a central role in how ITand OT tools are selected, validated, and governed, 3. Next-Gen Connectivity inRemote Operations 4. Cloud and Off-Premise SaaSAdoption As companies continue to migrate to the cloud, they areoften compelled to adopt Software-as-a-Service (SaaS)models for core Enterprise Resource Planning (ERP) and High fiber optic rents in remote operations, coupled withthe potential for reduced insurance premiums, are drivingincreased adoption of Private Long-Term Evolution(PLTE) networks. Energy companies must accompany This reliance shifts the security burden toward externalvendors, making third-party risk management acritical priority for cyber resilience. While the cloudoffers benefits, such as faster patching and more Newfound private LTE owners often lack mature threatmonitoring on cellular traffic, as well as personnel orpartners with expertise in telecom security. Similarly,satellite links provide energy companies with theremotest coverage and a vital backup path when primary Procurement can and must play a leading role insafeguarding cloud and off-premise SaaS environments.This requires rigorously assessing vendor risk profiles Procurement can help IT departments mitigate theserisks by sourcing with encryption, traffic monitoring, and Five Strategies To Successfully AddressEmerging Cybersecurity Risks Should a vendor lose credibility, companies shouldbe able to terminate the contract immediately. This 1. Managing Third-Party Riskby Enforcing Security and Data When awarding or renewing contracts, companies mustembed forward-looking cybersecurity clauses to protect 2. Exit Planning Companies must proactively create comprehensive exitplans to ensure business continuity when switching •Essential Contract Clauses Contracts must include strict breach notificationrequirements, defined vendor security controls, and clearmandates for compliance with industry standards suchas NIST Cyber Security Framework (CSF) or ISO 27001. •OT and Private LTE Transitions For complex vendor transitions in private LTE and IT/OTenvironments, sandboxing is essential. This techniqueallows outgoing vendors to continue operations in acontrolled environment while the incoming supplier •Right to Audit and Data Sovereignty •Cloud and SaaS Portability The right to audit is particularly relevant when workingwith vendors under a SaaS model