Case Study: A Multi-Year OT Cybersecurity Maturity Journey for a Major Refiner
Measuring, Testing, and Strengthening Cyber Resilience Across Refineries, Pipelines, and Terminals
The client engaged UTSI to strengthen the security, resilience, and governance of its IT and OT environments across its corporate office, three refineries, and its Terminals & Pipelines organization. What began as a baseline maturity assessment grew into a multi-year program. Each year was built on the last, moving from periodic assessments toward a sustainable, measurable cybersecurity management program, helping to establish repeatable processes, measure improvement against recognized frameworks, validate response capabilities, and prepare for evolving regulatory requirements.
Problem
Securing a refining enterprise takes more than point-in-time assessments. The client needed to:
Establish a baseline: Measure cybersecurity maturity consistently across corporate, refinery, and terminal and pipeline operations.
Prepare for cyber-physical impact: Build OT-specific incident response capabilities for events that could affect physical operations.
Coordinate across sites: Make sure corporate could support field operations effectively during an incident.
Sustain progress: Put governance and expertise in place to drive improvement year over year.
Solution
UTSI delivered a phased program aligned with the NIST Cybersecurity Framework (CSF):
2024, Baseline and preparedness: Conducted a NIST CSF 1.1 maturity assessment to set a baseline for corporate, the three refineries, and Terminals & Pipelines. Created an OT-targeted Incident Response Plan and facilitated tabletop exercises (TTXs) focused on cyber-physical impact.
2025, Validation and governance: Conducted a NIST CSF 2.0 assessment that measured improvement while accounting for the framework change, and identified gaps in cyber risk and procedural documentation. Facilitated a TTX to test the new roles and procedures in the OT Incident Response Plan, and helped develop the charter for OT Steering Committee.
Ongoing support (since 2025): An OT cybersecurity support contract gives client a flexible bank of expert hours. Project management support helps with tool deployment and Steering Committee coordination.
2026, Enterprise-wide readiness: Updated the IT Incident Response Plan, created a high-level playbook and decision-flow diagram, delivered role-based OT and IT incident response training across all sites, and facilitated a multi-site TTX spanning corporate and field operations.
2026–2027, Regulatory compliance: Developing a formal, repeatable cybersecurity assessment program aligned with U.S. Coast Guard cybersecurity requirements. The work includes enterprise assessment policies, facility assessments, and documentation to support compliance.
Results
Measurable progress: Two framework-based assessments documented maturity improvement, even through the transition from CSF 1.1 to 2.0.
Tested response capabilities: OT-specific plans, playbooks, and roles were validated through annual tabletop exercises.
Stronger corporate-to-field coordination: The multi-site TTX evaluated how well corporate could support terminal and pipeline sites during an incident.
Sustained governance: An OT Steering Committee and ongoing advisory support keep improvement on track. A 2027 maturity assessment, multi-site training and TTX, and OT Incident Response Plan updates are already planned.