The Key Role of EPC's in Industrial Cybersecurity

### Overview In mega-projects across oil, gas, water desalination, and critical infrastructure, Engineering, Procurement, and Construction (EPC) companies play an indispensable role. These firms execute massive, multi-billion-dollar turnkey projects over 6 to 9 years. While asset owners increasingly require cybersecurity at the conceptual phase, EPCs often lack the core competencies needed to properly interpret, design, and implement these requirements. Using an analogy to "The Good, the Bad and the Ugly," the speaker highlights that cybersecurity across critical infrastructure fails not from bad intent, but from misaligned incentives, complex multi-tier supply chains, and a severe capability gap.

### Key Topics - **The Structure of Industrial Mega-Projects**: Projects typically span 6–9 years across conceptual design, front-end engineering, detailed engineering, procurement, construction, and extensive testing (FAT, IFAT, SAT). While 64% face cost overruns and 73% experience schedule delays, cybersecurity represents a miniscule fraction of the total project budget despite carrying critical operational and safety risks. - **Challenges Faced by EPCs**: EPCs typically operate under lump-sum (fixed-price) contracts with compressed schedules. While they have deep expertise in automation, piping, and physical safety, they struggle with IT/OT convergence, lack internal cybersecurity skills, and face difficulty differentiating between cybersecurity service providers. - **Supply Chain and Subcontractor Realities**: A single oil and gas mega-project may encompass ~70 main systems (e.g., ICSS, power management, telecom, ancillary systems) from roughly 20 industrial vendors. While four or five large vendors have developed mature industrial cybersecurity capabilities, many smaller tier-2/3 component vendors lack any dedicated security personnel and cannot comprehend or address risk assessment findings. - **The Scope Gap and Financial Friction**: EPCs frequently sign fixed-price contracts agreeing to broad owner security requirements without fully understanding the technical or cost implications. Years into the project—sometimes as late as year six—an independent security review reveals massive deviations between what was requested and what was built, triggering costly scope expansions, contract renegotiations, and project delays.

### Technical Details - **Project Scale Example**: Based on a real-world $3.5B project spanning 8 years: over 4 million engineering man-hours, 50,000+ design drawings, 20 million construction man-hours, 66,000 tons of infrastructure, 250 km of piping, and 225 km of cabling. - **Cybersecurity Review Scope**: Across ~70 industrial systems, cybersecurity reviews involved vetting over 1,000 IP addresses and more than 600 technical documents totaling over 220,000 pages. - **Testing & Verification**: Security validation must span architecture reviews, risk assessments, Factory Acceptance Testing (FAT), Integrated FAT (IFAT), and Site Acceptance Testing (SAT).

### Takeaways - **Build Internal EPC Capabilities**: EPCs must develop in-house industrial cybersecurity skill sets and integrate them directly into existing discipline teams (process safety, instrumentation, and automation). - **Dedicated Project Security Roles**: Projects must designate a permanent industrial cybersecurity lead/role from day one to maintain end-to-end accountability across procurement and vendor management. - **Form Cybersecurity Working Groups**: Asset owners, EPCs, and industrial vendors must establish joint cybersecurity committees early in the project lifecycle rather than meeting years into construction. - **Engage Independent Trusted Advisors**: Similar to Project Management Consultants (PMCs), engaging an independent industrial cybersecurity trusted contractor helps bridge gaps across complex supply chains and oversee lifecycle compliance.