When the Colonial Pipeline cyber incident occurred, there were no formal regulations or laws geared toward preventing such occurrences. Within less than a year, initial regulations were established with updates and refinements garnered from the industry and from acknowledged best practices in an effort to prevent a repeat. The Upstream sector is currently not cyber-regulated, as (knock on wood) there haven’t been any overtly public cyber incidents targeting an Upstream operation, that is, a bellwether event similar to Colonial Pipeline. 

However, if such an Upstream incident were to occur, it could rapidly change the regulatory landscape. Even sans a cyber event, regulators and critical infrastructure oversight agencies are keen to prevent the lurking menace of an attack that could happen due to a lack of assurances that regulations can provide. This is the reason it makes sense for Upstream operations to ensure that its cybersecurity processes demonstrably leverage industry best practices used across many diverse industries, not just oil and gas.  This proactive behavior could reduce the need for regulations as well as provide society and oversight agencies with assurance that the Upstream industry is doing all that it can do to ensure safe, secure, environmentally sound, and uninterrupted operations across the entire segment. 

No one likes the risk of new regulations, and there’s a concern that those imposing these regulations are not fully familiar with the systems they are tasked with protecting, nor do they fully understand the threats against that which they are protecting. Waterfall provides a very high level of security to protect operations. As a side benefit, most regulations and compliances are fully met by using Waterfall’s Unidirectional Gateways. There are even aspects of certain regulations that have network areas exempt from certain details of compliance if those network areas are behind a Waterfall Unidirectional Gateway.