For power line repair operations, inspect four things first: what software and devices crews carry and connect, who can reach them remotely, how field systems connect back to operations, and how updates arrive. Build an inventory before you buy controls. NIST SP 800-82 and ISA/IEC 62443 give the vocabulary.
Why is line repair a software question at all?
A repair crew is a small mobile operation. It may use rugged tablets, work-management apps, mapping and switching-order tools, vehicle telematics, test and measurement equipment, radios and, increasingly, drones for inspection. Each runs software, and much of that software was written by somebody else.
This post does not describe any particular incident. We found no published case we could verify for this topic, and we will not invent one. It describes where a defender can look, using standards you can read yourself.
What do the standards say?
NIST's Guide to Operational Technology Security, SP 800-82 Rev. 3, published in September 2023, covers OT, meaning programmable systems and devices that monitor or control physical processes. It explains typical topologies, common threats and vulnerabilities, and recommended countermeasures, with attention to performance, reliability and safety requirements. NIST's page also notes that a draft of Revision 4 is open for public comment until 30 November 2026, so check for the current edition.
ISA/IEC 62443 is a series for industrial automation and control system security. It separates roles: asset owners, integrators, automation product suppliers and service suppliers. Part 2-1 sets security program requirements for asset owners, 2-3 covers patch management in the control environment, 2-4 covers service providers, and 4-1 covers secure product development for suppliers. For a utility, the role split is useful: it tells you which questions go to the vendor and which stay with you.
What do you inspect first?
1. The inventory. List every device and application a crew uses in the field, with owner, version and how it gets updates. Include contractor equipment. You cannot patch or retire what you have not listed.
2. Remote access. Who can connect to field devices or to the systems behind them, from where, with which credentials? Vendor and contractor access deserves its own line. Shared accounts and permanent remote paths are the usual findings.
3. The boundary. Where does the crew's laptop or tablet touch the network that runs operations? A device that moves between a depot, a truck and a control network is a bridge. Decide what it may carry across, and what scanning happens at the door.
4. The update path. How does new software and firmware reach field devices? From the vendor directly, through a depot machine, or by a technician with a USB stick? Each route needs a check that the file is the one the vendor published. 62443's guidance on patch management is the place to anchor this.
5. Safe failure. If a device cannot be trusted, what is the manual fallback? NIST stresses safety and reliability for OT. A security action that leaves a crew without switching information is not acceptable, so plan the fallback with operations, not around them.
Where does the software supply chain come in?
Ask vendors for a software bill of materials for field equipment and tools, and for how they handle vulnerability reports. Many vendors will not have a polished answer yet. Asking is how that changes. For the software you build or script in-house, such as internal apps and drone-flight tooling, scan the dependencies the way you would for any code.
What to do
- Build a field inventory covering devices, software, versions, owners and update routes.
- Map every remote access path, and remove shared or permanent ones.
- Draw the boundary between field devices and operations networks, and decide what may cross.
- Verify that updates are authentic before they reach a device.
- Write the manual fallback with the operations team, and rehearse it.
- Read NIST SP 800-82 Rev. 3 and the 62443 role split, and send vendors your questions.
Quick check
Is IEC 62443 only for factories?
No. The series covers industrial automation and control systems broadly, and gives separate requirements to asset owners, integrators, product suppliers and service providers.
What is the cheapest first step?
An honest inventory of what crews carry and connect. Every other control depends on it.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- ISA, ISA/IEC 62443 series of standards
Last reviewed: 18 October 2026.
