GDF works with owners and operators of power, water, building controls, manufacturing, logistics, transportation, healthcare facilities, and related systems. Life safety, environmental protection, and stable operation take priority over evidence collection or security testing. Passive-first methods establish the environment. Active work proceeds only after operator-designated authority approves the method, targets, window, communications, stop conditions, and recovery plan.
Inventory assets by purpose and consequence
An asset record should include process role, safety relevance, normal peers, zone, owner, backup, restoration, vendor support, and replacement constraints alongside vendor, model, firmware, address, and protocol. Unknown communication and unmanaged remote access become visible when network observations are reconciled with engineering records.
Architecture validation under documented process-risk controls
ICS security architecture and network segmentation validation draw from configuration, routes, passive traffic, identity, remote-access records, and carefully controlled tests. Active scanning on an operational network retains residual risk. Where practical, active work is performed in a lab, replica, or planned outage. Production testing requires operator approval and device-specific review. Vulnerabilities and adversarial paths are ranked by operational consequence and feasibility, not office-IT severity alone.
- Passive-first asset discovery and inventory reconciliation
- Industrial DMZ, zone, conduit, jump-host, and vendor-path validation
- Backup, restore, spares, and recovery testing
- OT incident readiness planning and 24/7 response
- Technical evidence support for applicable electric-sector NERC CIP requirements, without legal certification
Operators retain operating authority
GDF recommends and executes technical work within approved boundaries. Facility and process owners control operating changes, safety decisions, maintenance windows, and acceptable risk. Legal and compliance teams determine regulatory obligations.