MD 0 ft · Surface

Oil and gas cybersecurity for independent operators: enterprise-grade, priced for independents

Stay compliant.
Stay producing.
Stop attackers first.

The same class of security the majors run, without the majors' price tag. Fortis CyberSec secures field networks and business systems for independent operators in Texas, California, and every major U.S. basin. We assess where you stand, get you ready for the regulators, insurers, and lenders who are now asking, build zero trust access to your field and office, and keep watch around the clock through our vendor partners.

Take the free readiness check See what applies to you

12 questions · about 6 minutes · scored report on screen

MD 1,200 ft · Benefits

What you get

What changes when we're on your team

Every engagement ends in something you can hand to a regulator, an insurer, a lender, or your board.

An audit-ready evidence binder

Policies, asset inventory, network diagrams, access reviews, and test records, organized against NIST CSF 2.0 so the next questionnaire takes an afternoon instead of a month.

Easier cyber-insurance renewals

We close the gaps underwriters check first: MFA, offline backups, endpoint protection, and a tested incident plan. You answer the renewal application with evidence, not hope.

Ready for the notification clock

Depending on your location, breach laws can give you as little as 30 days, and in some cases up to 60, to notify the people affected, and some expect the regulator to hear from you even sooner. Your incident plan, contact tree, and owner-data map are ready before day one.

Production stays online

PLCs off the open internet, vendor remote access on MFA and on demand, and a practiced manual-operations fallback. The field keeps producing if the network does not.

A solution tailored to you

Because we are authorized with multiple security vendors, we recommend what fits your operation, budget, and field equipment, not whatever one vendor needs to sell this quarter.

One accountable advisor

An operator who has signed AFEs answers for the result, with certified security specialists behind him. No handoff to a junior team, and one number to call.

Clean diligence for deals and loans

Buyers, lenders, and midstream partners increasingly send cyber questionnaires. A documented program keeps it from becoming a price chip or a closing delay.

Enterprise-grade, independent-sized

The zero trust, endpoint, and 24/7 monitoring platforms large energy companies rely on, packaged and priced for a 20- to 200-person operator. No enterprise minimums, no in-house security team required.

A legal shield in Texas

Texas businesses under 250 employees with a documented cybersecurity program matched to their size are protected from punitive damages in breach lawsuits. We build the program and the documentation that proves it.

No lock-in, one point of contact

You own your assessment report and can take it anywhere. If you want us to carry it out, you get competing options with the pros and cons of each, every vendor relationship and our compensation disclosed in writing at signing, and one person to call.

MD 2,600 ft · Compliance

Compliance

Every basin state has a clock. Know yours.

Small operators used to sit below the regulatory waterline on cybersecurity. That is changing through state breach laws, a new Texas safe harbor, California privacy rules, federal reporting rules, regulator notices, and requirements your counterparties pass down to you. Breach laws follow the person, not the company: an owner who lives in Colorado or California brings that state's law with them, wherever your wells are.

As of October 19, 2026 · Last change: October 19, 2026

Requirement	Who it reaches	What it asks of you	How we get you there
Texas Identity Theft Enforcement and Protection Act State law · in force	Any business holding Texans' sensitive personal data, including royalty and working-interest owner SSNs and bank details	Reasonable security. Notify the Attorney General within 30 days of determining a breach that affects 250 or more Texans, and individuals within 60 days.	Owner-data map, access controls, breach playbook with notification templates
Texas cybersecurity safe harbor (SB 2610, effective Sept 1, 2025) State law · opportunity	Texas businesses with fewer than 250 employees that hold sensitive personal information	No punitive damages in a breach lawsuit if a qualifying program was in place: documented basics under 20 employees, CIS Controls IG1 for 20–99, a recognized framework such as NIST CSF for 100–249.	Size-matched program build and the documentation to prove it
California breach notification law (SB 446, effective Jan 1, 2026) State law · in force	Any business holding personal data on California residents, wherever the business is located, including owners and employees who live in California	Notify affected California residents within 30 calendar days of discovering a breach. If 500 or more are affected, notify the Attorney General within 15 days after that.	Residency mapping of owner and employee records, breach playbook with both state clocks
California Consumer Privacy Act and CPPA regulations (effective Jan 1, 2026) State law · phased	Businesses doing business in California above the revenue threshold (about $26.6 million, inflation-adjusted) or data-volume thresholds. Covers employee and business-contact data, not only consumers.	Reasonable security. Risk assessments for sensitive processing, first submissions due April 1, 2028. Independent cybersecurity audits for larger data holders, certifications due 2028 to 2030 by revenue.	Applicability review, risk assessment, audit readiness
Railroad Commission of Texas notice to operators (Apr 10, 2026) Regulator notice	RRC-regulated operators	Isolate PLCs from direct internet access, review logs, and watch for suspicious traffic on common industrial control ports.	External exposure scan, firewall and gateway review, monitoring setup
CISA oil and gas ICS advisory Federal advisory	Oil and natural gas companies running SCADA and ICS	Take OT off the internet, replace default passwords, secure remote access, segment OT from IT, and practice manual operations.	OT/SCADA exposure review and a practiced manual-ops fallback
CIRCIA incident reporting Federal rule · final rule pending	Covered entities across critical infrastructure sectors, including energy. Size thresholds are set in the final rule.	Report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours.	Applicability check, incident triage and reporting runbook
TSA pipeline security directives Federal · designated operators	Designated pipeline owners and operators, and connected parties through interconnect and service agreements	Network segmentation, access control, continuous monitoring, and a cybersecurity incident response plan.	Gap review against your midstream counterparties' requirements
CMMC Federal contracts	Suppliers to the Defense Department that handle federal contract information	Documented controls and assessments before contract award.	Scoping, gap assessment, and a plan of action
Insurer, lender, and buyer requirements Contractual · already here	Anyone renewing cyber coverage, borrowing, or selling assets	MFA, offline backups, endpoint protection, a tested incident plan, and completed security questionnaires.	Control remediation and the evidence binder

Breach-notice clocks across the basins

State	Major basins	Notify affected residents	Notify the state
Texas	Permian, Eagle Ford, Haynesville, Anadarko, Barnett	Within 60 days	Attorney General within 30 days if 250+ Texans
California	San Joaquin, Los Angeles, Sacramento Valley	Within 30 days	Attorney General within 15 days after if 500+
Colorado	DJ Basin, Piceance, San Juan	Within 30 days	Attorney General within 30 days if 500+
Wyoming	Powder River, Green River, Wind River	Without unreasonable delay	No state notice required
New Mexico	Permian (Delaware), San Juan	Within 45 days	Attorney General within 45 days if 1,000+
Oklahoma	Anadarko, Arkoma, SCOOP/STACK	Without unreasonable delay	Attorney General within 60 days after if 500+
North Dakota	Williston (Bakken)	Without unreasonable delay	Attorney General if 250+
Montana	Williston, Powder River	Without unreasonable delay	Attorney General at the same time
Louisiana	Haynesville, Gulf Coast	Within 60 days	Attorney General within 10 days after
Utah	Uinta, Paradox	Without unreasonable delay	Attorney General if 500+
Pennsylvania	Appalachian (Marcellus, Utica)	Without unreasonable delay	Attorney General at the same time if 500+; 12 months of credit monitoring when SSNs or account numbers are exposed
Ohio	Appalachian (Utica)	Within 45 days	No state notice required; affirmative defense for companies with a recognized cybersecurity program

Summaries are for orientation, not legal advice, and most states excuse notice when misuse is not reasonably likely. Deadlines run from discovery or determination of the breach. Most small operators fall below California's cybersecurity audit thresholds but may still be covered by the CCPA and by breach laws in every state where their owners and employees live. We confirm applicability with you and your counsel in the Security Assessment Report.

This list is not comprehensive. It covers common requirements for operators in the major producing states. Other federal, state, local, and contractual obligations may apply to your operation, and laws change. We review these tables daily and date every change.

MD 3,300 ft · Zero Trust

Vendor-neutral. Multi-authorized. Built for you.

The right platform for your operation, not a vendor's quota.

Fortis CyberSec is an authorized partner of multiple leading security vendors. That lets us match the solution to your size, budget, field equipment, and insurer requirements, instead of fitting you to the one product a reseller happens to carry. The architecture we build on is zero trust: each verified person reaches one approved application at a time, and nothing else is reachable.

Authorized partner

Authorized with multiple leading security platforms. Full list available on request.

How we choose your platform

Your size and budget. Licensing that makes sense for 20 users or 200, without enterprise minimums.
Your field equipment. Compatibility with the SCADA, PLCs, and remote sites you already run.
Your systems. What works with your email, accounting, and land software today.
Your insurer and counterparties. Controls that satisfy the questionnaires you actually receive.
Your support needs. Who answers at 2 a.m., and how fast someone can be on site.

No exposed attack surface

Applications and field systems sit behind outbound-only connections. No open inbound ports for attackers to scan, which is exactly what the Railroad Commission's PLC notice asks for.

No lateral movement

Users reach specific applications, never the whole network. Ransomware that lands on an office laptop cannot spread to the field.

Vendor access without a VPN

Automation vendors and contractors get browser-based, just-in-time, time-limited access to a single PLC or HMI, with every session recorded.

Every connection verified

Identity, device health, and context are checked on each session, not once at login. Access ends when the job does.

Data stays in bounds

Inline inspection stops owner records, bank details, and lease data from leaving through personal email, file-sharing sites, or web apps.

Evidence built in

Access policies and session logs feed straight into your compliance binder for regulators, insurers, and auditors.

Question	Firewall + VPN	Zero trust
What can a user reach?	The network, and everything on it	Only the applications their role allows
Is anything exposed to the internet?	VPN gateways and forwarded ports	No inbound ports; applications stay hidden
How do vendors reach a PLC?	Shared VPN account, often always on	Approved, time-limited, recorded session to one device
What happens after a stolen password?	Attacker moves freely inside	Device and context checks block it; blast radius is one app
What do you show an auditor?	Firewall rules, with little per-user record	Policy, identity, and session logs per user

Fortis CyberSec is an authorized partner of multiple security vendors and discloses partner relationships and compensation in every proposal. If a platform we do not represent is the better fit, the Plan of Action will say so.

MD 4,000 ft · Services

Services

Assess. Protect. Monitor.

We are security consultants. An analyst assesses where you stand, we design and deploy the defenses, and our vendor partners keep watch around the clock. Enterprise-grade platforms, scoped and priced for an independent.

ASSESS

Analyst-led assessment

A security analyst examines your networks, field systems, data, and obligations, then writes a plan you can act on with or without us.

Breach-law and privacy obligations in every state where your people live
External exposure scan and OT/SCADA review
Texas safe-harbor program gap check
Prioritized, costed plan of action

PROTECT

Zero trust & hardening

Replace open ports and always-on VPNs with zero trust access, and close the gaps insurers and regulators check first.

Zero trust access for field, office, and remote staff on the platform that fits you
Recorded, time-limited vendor sessions to PLCs and HMIs
MFA, offline backups, and endpoint detection and response
Incident and breach-notification playbook, tested

MONITOR

24/7 managed defense

Our vendor partners watch your systems day and night. Their platforms use AI-driven tools to detect and automatically contain attacks, with security analysts behind them.

24/7 managed detection and response through vetted partners
Automated containment of malware and ransomware by vendor platforms
Inline blocking of phishing, malicious sites, and data theft
Annual evidence refresh for insurers, lenders, and regulators

How our reports are made

Written by an analyst. Not generated by a script.

Every Security Assessment Report is researched, written, and signed by a security analyst who reviews your environment, interviews your people, and makes the judgment calls. An industry assessment platform helps us gather and organize the data, and our AI-assisted tools help the analyst assess risks and threats; neither writes the findings or makes the calls. The tools that remediate attacks in your environment, including AI-driven ones, run on our vendor partners' platforms.

Engagement	Duration	What you get
Cyber Readiness Check	6 minutes + 30-min call	Free. A scored online report and a review call with a senior advisor
Security Assessment Report & Plan of Action	2–3 weeks	A comprehensive report prepared and signed by a security analyst, and yours to keep: Texas, California, and federal compliance applicability, external exposure scan, owner and employee data map, OT/SCADA findings, and a prioritized, costed plan of action. No obligation to use our services.
Implementation	4–12 weeks	Zero trust, MFA, backups, endpoint protection, and OT remediation, installed by our vetted partners under our project management
Managed Security & Subscriptions	Ongoing	Security platform subscriptions from our authorized vendors, 24/7 monitoring and response, one point of contact
Compliance Advisory Retainer	12 months	Annual evidence refresh, regulatory updates, insurer renewals, quarterly board report

Pricing is quoted for your operation. Every engagement is scoped to your fields, systems, and obligations, so we quote a fixed fee after a short scoping call. You know the cost before you commit.

Contact us for pricing

MD 4,800 ft · Delivery

How we work

Your report. Your choice. One point of contact.

The Security Assessment Report is yours to keep and use however you choose. If you want help carrying it out, we bring the vendors, the installers, and the monitoring, and we stay accountable for the result.

Option 1

Take the plan and run it yourself

Hand the report to your IT provider or your own team. It lists every finding, the fix, the priority, and the estimated cost, written so any qualified provider can execute it. No lock-in and no follow-on commitment.

Option 2

Let us carry it out

We deploy the plan on the platforms that fit it, chosen from the multiple vendors we are authorized to deliver, with vetted managed-service partners who send certified technicians to install, monitor, and manage your systems.

Competing bids on each option, with the pros and cons of each
Partners vetted for OT experience, certification, and insurance
We manage the project and hold partners to the plan
Every vendor relationship and our compensation disclosed in writing at signing

MD 5,800 ft · Assessment

Free Cyber Readiness Check

Where do you stand today?

Twelve questions built for independent operators. You get a readiness score across compliance, field networks, detection and response, and data handling, plus the state and federal requirements your answers suggest may apply. A senior advisor follows up with a free 30-minute review.

1 · Questions2 · Your details3 · Your report

0 of 12

MD 7,000 ft · Questions

Frequently asked questions

Oil and gas cybersecurity, answered

What does an oil and gas cybersecurity assessment cover?

Our Security Assessment Report covers which state and federal requirements apply to you, an external scan of what attackers can see, a review of how staff and vendors reach your SCADA, PLCs, and HMIs, a map of owner and employee data by state of residence, your Texas safe-harbor tier, and a prioritized, costed plan of action. It is written and signed by a security analyst, at a fixed fee we quote after a short scoping call.

What does it cost?

We quote a fixed fee for each engagement after a short scoping call, because the work depends on your fields, systems, and obligations. You know the cost before you commit, and the free readiness check costs nothing. Contact us for pricing.

We don't have anyone who handles security. Where do we start?

That is where most independent operators start, and it is the reason we exist. You almost certainly have more in place than you think: someone set up your email, someone services your SCADA, and someone filled out your insurance application. We start by finding out what you already have, then show you what is covered, what is not, and the few things that matter most. You do not need to hire a security person first. You need to know where you stand.

We don't know much about security. Will we understand the results?

Yes. You do not need to learn security; you need plain answers. We ask questions anyone in your office can answer: Is your email Microsoft 365 or Google? Do people get a code on their phone when they log in? If the accounting computer died tonight, how would you get it back? How do your automation vendors reach the field? Who filled out your cyber-insurance application? The report then tells you, in plain English, what is fine, what is a problem, roughly what each fix costs, and what to do first. You decide what to act on.

Our IT company already handles security. Why would we need you?

Good, and we will work alongside them, not against them. Most IT providers look after laptops, email, and the office network well. The gaps we find are usually where their work meets the field: PLCs, SCADA, and how automation vendors connect remotely. We start by asking what your IT provider covers today, and we are glad to include them in the conversation.

We're a small operator. Are we really a target?

Most attacks are not aimed at a company; they are aimed at whatever is reachable. Fake invoices, hijacked email accounts, and internet-exposed field equipment hit small operators because they are less likely to be defended. The useful question is what you have connected to the internet and how payments go out. The free readiness check answers that in about six minutes.

We already have cyber insurance. Isn't that enough?

Insurance pays for some losses after an incident; it does not prevent one, and a claim can be challenged if the controls you attested to on the application were not actually in place. We help you confirm that what you told your carrier is true, and we give you the evidence to show it at renewal or after a claim.

We had an assessment recently. Would this duplicate it?

Not if we can help it. Share what was covered and what has been fixed since, and we will build on it rather than repeat it. Many assessments cover the office network but not field equipment, vendor remote access, or owner data by state. We focus on what is missing.

Can we do this ourselves?

Some operators can, and the free readiness check is a good place to start. The questions to ask are who on your team would lead it, whether they have the time this quarter, and whether your insurer, lender, or partners will accept a self-assessment. If you do it yourself, our report can serve as an independent starting point for your team.

What are PLCs and HMIs, and why do they need protecting?

A PLC (programmable logic controller) is the rugged computer at the wellsite that runs pumps, valves, and shut-ins. An HMI (human-machine interface) is the screen operators use to watch and control them. An attacker who reaches a PLC can change setpoints or shut equipment down; one who reaches an HMI can show operators false readings. The Railroad Commission of Texas asked operators in April 2026 to take PLCs off the open internet.

What is the Texas cybersecurity safe harbor (SB 2610)?

Since September 1, 2025, Texas businesses with fewer than 250 employees that hold sensitive personal information can avoid punitive damages in a breach lawsuit if they maintained a qualifying cybersecurity program, scaled to their size. It does not cover actual damages, fines, or notification costs. We confirm your tier and what is missing.

How fast do we have to notify owners after a data breach?

It depends on where your owners and employees live, not where your wells are. Texas, California, and Colorado set 30-day deadlines for certain notices; New Mexico and Ohio allow 45 days; Louisiana 60; others require notice without unreasonable delay. See the state table above, and confirm with counsel.

Do you only sell one security product?

No. Fortis CyberSec is an authorized partner of multiple security vendors, so we recommend the platform that fits your size, budget, field equipment, and insurer requirements. We disclose our vendor relationships and compensation in writing, and you can carry out the plan with any provider.

Will this help with our cyber-insurance renewal?

Yes. Underwriters commonly ask for multi-factor authentication, offline backups, endpoint detection and response, and a tested incident plan. We close those gaps and give you an evidence binder so you can answer the application accurately.

Where do you work?

We serve independent operators in Texas, New Mexico, Oklahoma, Colorado, Wyoming, North Dakota, Montana, Utah, Louisiana, California, and Appalachia, - if there's production, we'll be there.

MD 7,600 ft · Founder

Security advice from someone who has signed the AFE and answered for the result.

Founders

Fortis CyberSec's team has spent more than 30 years across upstream E&P operations, institutional capital markets, and infrastructure project finance.

We have worked hands-on with the platforms independents run on, overseen project accounting on field and infrastructure developments, and hold authorized-partner status with multiple security vendors, including Zscaler. Fortis CyberSec pairs that operating judgment with certified security specialists and managed-service partners who install, monitor, and manage your defenses.

MD 9,400 ft · Contact

Contact us

Talk to a security advisor

Questions about the assessment, your insurance renewal, a breach-notice deadline, or partnering with us. A senior advisor replies within one business day.