Building a new power plant or a wind farm is one thing. Ensuring the entire system – from automation and IT to documentation – is truly cyber-resilient is a far bigger challenge. According to experts, the weakest points are often found at the intersections of different technical disciplines and in the way sensitive documents flow between investors and contractors.
During the CYBERSEC EXPO & FORUM 2026 in Katowice, Mateusz Raszkiewicz, a telecommunications and cybersecurity specialist at Victor Energy, a company executing projects for the energy sector, pointed out that access to technology is no longer the main barrier. The real difficulty lies in creating a coherent security framework that covers automation, telecommunications, IT, procedures, and technical documentation alike.
– Problems often appear at the intersection of two industries. A specific range may be secured, but risks can emerge precisely at the border – said Raszkiewicz. He stressed that even if each element of an energy project formally meets security requirements, the whole system may remain vulnerable without comprehensive end-to-end testing and clear division of responsibilities.
Problems at the intersection of industries
Modern energy infrastructure increasingly resembles a complex system of interconnected vessels. In a single investment, automation meets telecommunications, IT meets control systems, and all of it relies on detailed technical documentation. Each of these layers can be secured separately, but the safety of the entire environment depends on how they work together.
– It is possible to imagine a situation where the IT zone is secured and the automation zone is also secured, but one cannot say the whole system is safe without testing the entire environment – explained Raszkiewicz. According to him, such holistic testing should become the standard for energy projects, moving away from point checks of individual devices or connections.
Nis2 extends its reach
The energy sector is also increasingly affected by new regulatory requirements, including the NIS2 directive being implemented in Poland. While construction and contracting companies may not always be directly covered by the law, they are already feeling its impact through the supply chain.
– Companies building infrastructure are not always directly covered by NIS2, but they are directly affected because they are part of the supply chain – noted Raszkiewicz. He added that any firm involved in the energy sector should behave as if it were covered by the regulation, as the weakest link in the chain can determine the overall resilience of the system.
Documentation as the weakest link
From the contractor’s perspective, one of the most critical areas requiring improvement is the flow of documentation between investor and contractor. Technical papers, though less glamorous than new software or hardware, often contain highly sensitive information that can open multiple gateways for future cyberattacks.
– Documentation carries very important information that can open many gateways for future cyberattacks – warned Raszkiewicz. He urged companies to audit not only whether documents are protected but also how they actually circulate during the investment process. The weakest point in a system is often the element treated as an add-on, and in many projects that is the documentation management.
Źródło: WNP.PL, Fot. WNP.PL
