Owner's supervision · IT/OT systems security
Independent supervision of control systems security
We verify the layer no acceptance protocol shows: configurations, access, network segmentation and procedures. Solely in the investor's interest, with no ties to contractors or equipment suppliers. For facilities under construction and for those already operating.
What the service is
What independent IT/OT security supervision is
Independent IT/OT security supervision is control of a facility's logical layer, carried out solely in the investor's interest by a party unconnected to any contractor or equipment supplier. We check how the systems were configured, who has access to them, and whether they can be restored after a failure.
Our role begins exactly where the installer's work ends: the device is mounted, powered and connected, and now somebody is configuring it. What password it will hold, whether it will be updated, who will be able to connect to it remotely and which network zone it will sit in determines the security of the entire facility.
And it is invisible once the works are finished. Nobody writes "we left the factory password" or "our service channel stays open" into an acceptance protocol. It has to be actively verified — and you need grounds for refusing to accept an installation until it is corrected.
The logical layer means, specifically:
Device and system configuration
The actual settings, not the claims in a presentation.
Accounts, passwords and privileges
Factory credentials, named accounts, a second authentication factor.
Network segmentation
Whether the separation is real or only drawn in the design.
Remote access channels
VPN gateways, contractor service channels, connections to vendor clouds.
Software currency
The state at acceptance and the plan for the facility's remaining life.
Backups and recoverability
Whether the facility can genuinely be restored from them.
Event logs and procedures
Whether you can see who did what, and know what to do after an incident.
The reference point
29 December 2025: what the CERT Polska report teaches
facilities — at least that many attacked in a single day
advanced techniques used by the attacker
VPN gateway without a second authentication factor
years of asset life against short vendor support
On 29 December 2025, control systems were disabled at no fewer than thirty Polish wind and solar farms and at a manufacturing company. The published CERT Polska (NASK) report shows that no advanced technique was used. A remote access gateway visible from the internet without a second authentication factor, plus factory passwords on the devices inside, was enough.
That same day a combined heat and power plant was attacked, penetrated more deeply than the farms — the intruder had been in its network since spring and had exfiltrated the central account database. Lasting damage was nevertheless not done, because modern endpoint protection stopped it. The difference between a site disabled and a site defended was not luck. It followed from decisions taken earlier, when the environment was being built and configured.
This is not a list of the energy sector's mistakes. It is a list of the mistakes of every deployment that nobody checked.
Three questions supervision answers
Our whole scope, for all its technical complexity, comes down to three questions asked consistently of every system in the facility.
Who can reach this system, and from where?
Most incidents begin with access that should not exist: a gateway visible from the internet, an open service channel, a former contractor's account, a device connection to a vendor cloud that nobody decided on.
If someone gets in at one point, can they reach everywhere?
The scale of damage is determined not by the entry itself but by what can be done afterwards. Genuine network segmentation and separation of privileges turn a serious incident into a minor one.
Would we notice, and could we recover?
Events will always happen. What matters is whether they are detected within an hour or after a year, and whether the facility can return to work from a restored configuration.
The principle the whole service rests on: we do not accept declarations, we accept evidence. Every confirmation from us rests on a verified configuration file, a completed test or a checked log entry, not on a contractor's assurance.
What we deliberately do not supervise
We start with the boundary of scope, because it is essential to understanding our role correctly and to avoiding overlap with the other participants in the investment process.
Outside our scope
The entire physical, construction and electrical layer: structures and halls, modules and turbines in their mechanical parts, yards, tracks and turnouts, cranes in their mechanical and electrical parts, structural and fibre cabling, cable routes, cabinets and distribution points, transformers, switchgear and switching apparatus, uninterruptible power, device installation, certification measurements, testing, technical inspection and trade acceptance.
We do not step into the remit of designers, electricians, installers, construction inspectors or technical inspection authorities. We assume that this work is performed correctly and is subject to its own appropriate trade supervision.
Our scope
The logical layer: device and system configuration, accounts and privileges, genuine network segmentation, remote access channels, integrations, software currency, backups and recoverability, event logging and incident procedures.
This is the layer that is invisible once the works are finished, and that no single trade acceptance protocol covers.
The facilities we work with
The method of verification is the same. What differs is the list of systems, the risk profile, and what exactly the investor loses when something stops working.
Wind and solar farms
An unmanned, remotely controlled site. Inverters, turbine controllers, telecontrol, SCADA, the substation, battery storage and vendor channels.
See the offer for this facilityHotel properties
A computer network with rooms. Property management system, locks, building automation, CCTV, payments, guest network and back office systems.
See the offer for this facilityIntermodal terminals
A storage yard run by a database. Terminal operating system, gate and OCR, weighbridges, cranes, the yard radio network, EDI and customs integrations.
See the offer for this facilityHow the supervision runs
Supervision is not a one-off audit just before commissioning. A check performed right at the end finds errors at the moment when fixing them costs the most.
Security requirements
We hand the requirements catalogue to contractors at the outset, as part of the specification and a condition of acceptance, together with the list of evidence they will have to produce. The burden of demonstrating compliance sits with them, and supervision is the proof of verification. This is the cheapest moment to set requirements: they cost nothing beyond a clause in a document.
Design and solution review
We verify the documentation and contractors' proposals: whether the designed segmentation is real, whether remote access has been thought through safely, whether event logging and endpoint protection were provided for, and how long the chosen equipment will have vendor support. An error caught on a drawing costs a correction in a document.
Ongoing configuration control
The key stage — this is where the facility's security is created and where most errors arise. As each system is commissioned we check its actual configuration, record every non-conformity in a register, assign it to a specific contractor and follow it through to closure. We work from configuration exports, not from presentations.
Verification testing
Before commissioning we test in practice what we previously verified on paper: vulnerability scanning, checking what is visible from the internet, a segmentation test, a controlled attempt to enter by the same route an attacker would choose, and a test restore of configurations from the available backups.
Final report, acceptance and retest
We deliver a report on the facility's security posture at commissioning, the list of findings with their status, and recommendations for the operating period. Once findings are closed we run a retest and confirm that they were actually removed, not merely reported as removed.
Establishing the facts
A complete list of devices, software versions, accounts, remote access channels and external connections, including the ones everybody has forgotten. This is usually the most surprising part of the whole exercise.
Condition assessment and risk list
Verification of the same areas as during construction, ending in a list of findings ordered by real consequence rather than formal classification. Separately we flag what can be improved with no interruption to operations.
Remediation plan for a working facility
Specific changes assigned to the contractor, integrator or service provider, split into those achievable remotely, those requiring a site visit and those requiring an outage. Outages are planned where operations are limited anyway.
Verification and periodic review
Confirming that the changes were actually made, and setting the rhythm of subsequent reviews, with particular attention to rotating access after every change of contractor or service provider.
What sets us apart from a classic audit
Any recommendation we make, we help implement, at no extra charge
An audit that ends in a document full of findings shifts the entire burden onto the investor, the contractor and the service company. In practice that means more meetings, more quotes for "additional works", and arguments about how a given recommendation should be read.
We go a step further. We sit down with the engineer from the contractor, integrator or maintenance provider at the specific device and work through the configuration with them: we show how to build genuine network segmentation, how to configure remote access with a second authentication factor and restricted connection sources, how to disable built-in accounts and services the manufacturer recommends blocking, how to set up credential rotation between sites, and how to organise backups that a facility can actually be restored from.
Where the boundary lies
We do not take over the contractor's or the service company's scope and we do not release them from responsibility for the system they delivered — helping with implementation does not change who is accountable for what. Nor do we provide ongoing operational support for the facility within this fee; if the investor wants that, it is a separate, voluntary service agreement.
Who carries out the supervision
The supervision is carried out by two specialists. That composition is not a matter of convenience but of the nature of the task: a facility's security emerges where two worlds meet — correctly built infrastructure and deliberate defence against attack. Those two competencies are rarely found in one person.
Systems, servers and network infrastructure
A long-standing court-appointed expert in IT and telecommunications, working with the police, prosecutors and the courts. Professionally engaged with systems, servers and networks — from design, through deployment, to supervising maintenance.
For the investor, expert-witness experience means two concrete things: the habit of establishing facts from evidence rather than assurances, and the ability to keep documentation that will hold up later — in a conversation with a contractor, before an insurer, before a financing institution, or in proceedings.
Cybersecurity
Designs and deploys security systems for some of the largest corporations in the world. Works with leading vendors' solutions, with competencies confirmed by numerous manufacturer and industry certifications. Also delivers cybersecurity training.
Brings the perspective usually missing on a construction site: looking at the emerging infrastructure the way an attacker would — searching for the shortest way in, rather than confirmation that everything was installed to the design.
What this pairing gives the investor
Full coverage of scope
One person is accountable for the correctness of systems, servers and networks, the other for the resilience of the whole against attack. Neither area is assessed as an afterthought.
Mutual verification of findings
Every significant observation passes through two pairs of eyes before it reaches the contractor. That limits both oversights and unfounded objections.
Parallel work at peak
In periods when many systems are commissioned at once, two people run several threads simultaneously, without stretching the acceptance schedule.
Complete independence
We do not perform deployments, we do not sell hardware and we are tied to no supplier. The only party whose interest we represent is the investor.
INFO-KAN was founded by Professor Jan Kania. The firm provides owner's supervision of IT/OT systems security, audits, security testing and cybersecurity training.
What the investor receives
The supervision ends in a set of documents that each serve a concrete purpose — at acceptance, in operation, and in dealings with institutions.
A catalogue of security requirements for contractors
Shifts the obligation to secure the systems onto the contractor and makes it a condition of acceptance, rather than a subject of dispute after the fact.
An inventory of the facility's logical layer
A complete picture of what is connected, in what version and with what access. The starting point for operations and for every later change.
A register of non-conformities with resolution history
An orderly record of what was wrong and who fixed it — and at the same time proof that supervision was exercised.
Support with implementing recommendations
Help with configuration on the contractor's or service company's side, at no additional fee. The finding is removed, not merely reported.
Verification test reports
Confirmation that the controls work in practice, not only in the documentation.
A final report with an acceptance recommendation
The basis for deciding whether to accept the works and settle with the contractors.
A retest once findings are closed
Confirmation that findings were actually removed, not simply ticked off.
Documentation handed over to operations
An orderly start for the team or company taking over the facility, instead of learning how it is built by trial and error during a failure.
Why this is an advantage, not a cost
Commissioning without technical debt
The facility starts with infrastructure that has been verified and documented, not with a list of things "to tidy up when there is a moment" — which means never, because from day one what counts is output.
Incomparably lower cost of correction
A configuration change during construction is a matter of a decision and a few hours of the contractor's time. The same change in a working facility means an outage window and negotiations with a contractor who has already closed their contract.
A stronger position towards contractors
Requirements set at the outset and verified during delivery substantially reduce the room for disputes at acceptance and for charges for "additional works".
An argument for insurers and lenders
Documented supervision is increasingly the subject of questions when placing policies, financing an investment and agreeing grid connections. In an inspection, what counts is not only which controls were applied but whether due diligence can be demonstrated.
A repeatable template for the next projects
The findings from the first facility become the portfolio standard. This is the only moment when the serial nature of construction works in favour of security rather than against it.
Engagement variants
We match the scope to the stage the facility is at and to the number of systems. The method of verification stays the same — what differs is the order and the window in which something can still be changed.
Full supervision, from design to commissioning
A facility at design stage or in early delivery
All five stages of Track A, support with implementing recommendations, retest and handover of documentation to operations
Supervision from systems commissioning
Construction well advanced, automation and systems only now arriving on site
Stages 3 to 5: ongoing configuration control, pre-commissioning verification testing, final report and retest
Review of an operating facility
The facility is already running and the state of the logical layer, and of who holds access, is not fully known
The four steps of Track B: inventory, condition assessment, a remediation plan matched to service windows, and verification of completion
Portfolio or network variant
Several or a dozen facilities under one investor, built to a similar template
Detailed examination of the first facility, a checklist for the remainder, and a common security standard across the portfolio
Requirements arriving from outside
NIS2 and the Polish cybersecurity act: what it means for an investor
The amendment to the national cybersecurity system act implementing the NIS2 directive entered into force on 3 April 2026. Electricity generation and transport are among the regulated sectors, and entities are divided into essential and important.
Establishing your own status and entry in the register
Entities meeting the criteria apply for entry within the deadline set by the transitional provisions. For entities that met them on the day the amendment entered into force, that deadline is 3 October 2026.
Documented risk management
Security measures must be implemented and described, not merely a working installation in place. What counts is being able to demonstrate what was checked and when.
Reporting serious incidents within deadlines
The procedure and the responsible people have to be established before anything happens. The deadlines are counted in hours, not days.
Responsibility for the supply chain
You are also accountable for the security of solutions delivered by contractors and integrators. In practice that means contractual clauses and verification at acceptance.
Obligations on management
Overseeing the implementation of security measures is a duty of the governing bodies, not something delegated wholesale to the IT function.
An honest word about the limits of our role
The status of a particular entity is not always obvious. The act lists specific kinds of activity, and the size criterion may or may not be met depending on the group structure and scale of operations. The final legal classification should be confirmed with legal counsel. We do not sell certainty we do not have.
From our perspective something else matters: the requirements reach the investor by a second route anyway — contractually. The grid operator, the corporate customer, the carrier, the financing bank and the insurer increasingly ask the same questions, regardless of statutory status. And if the facility is built with public or EU funding, the due diligence question arrives even earlier. Documentation prepared once answers all of them.
Frequently asked questions
IT/OT security supervision — straight answers.
An audit is a snapshot of one moment and usually ends in a document listing findings that the investor then has to enforce alone. Supervision is a process run in parallel with delivery: we set the requirements at the outset, check configurations as each system is commissioned, and implementing our recommendations is included in the fee. The difference is practical — the finding is actually removed, not merely recorded. That is why we speak of supervision rather than audit.
Most often the investor or the SPV, sometimes the general contractor wanting certainty about the scope delivered by low-voltage subcontractors. This is not a service for an IT department: the IT function usually handles the office environment and takes over the facility only at commissioning, so it rarely has any real ability to halt acceptance of a system ordered earlier, on terms agreed without its involvement.
Ideally at design stage or in early delivery, because the requirements then go into the specification and cost nothing beyond a clause in a document. The duration depends on the variant: full supervision accompanies the build from design to commissioning, supervision from the commissioning stage covers the last three stages, and a review of an operating facility is a closed task settled at a fixed fee. We also work with facilities that have been running for years.
It should not, and that is not its purpose. We work in parallel with delivery rather than after it, so findings appear while the contractor is still on site and can close them straight away. During peak periods, when many systems are commissioned at once, two people run several threads simultaneously. The greater schedule risk is the opposite: a check performed right at the end, finding errors when the deadlines are already tight.
Every significant observation passes through two pairs of eyes before it reaches the contractor, which limits both oversights and unfounded objections. We rely on evidence: a configuration file, a test result or a log entry, not an impression. If the contractor is right, we withdraw the finding and record it that way in the register. If a substantive disagreement remains, the investor receives a clear position from us together with a description of the risk, and decides with both versions in hand.
We agree it up front, before work begins: a fixed fee per stage or per facility, or a monthly engagement for the duration of delivery. In every variant, support with implementing recommendations is included in the agreed fee and is not invoiced separately. For facilities under construction we recommend tying our confirmations to the acceptance procedure and the payment schedule — supervision then has real effect.
Track A applies to a facility under construction and has five stages: requirements, design review, ongoing configuration control, verification testing, and the final report with a retest. Track B applies to an operating facility and has four steps, because the order changes: instead of setting requirements, we first establish the facts, since in practice nobody knows them in full. Only on that basis does a remediation plan emerge, matched to service windows.
Yes. We are based in Szczecin, but we supervise facilities across the country, and with geographically dispersed portfolios that is the rule rather than the exception. A substantial part of the work — reviewing documentation, analysing configuration exports, checking what is visible from the internet, remote testing — happens without travel. We come on site where it is essential: for a wireless survey under target conditions, for segmentation testing and for acceptance.
The full study
The study for your type of facility
We have prepared three detailed studies: for wind and solar farms, for hotel properties and for intermodal terminals. Each describes documented incidents in that sector, the full list of areas under control, how the supervision runs, and the engagement variants.
Owner's supervision of IT/OT systems security
PDF document. The study is available in Polish. We use your details solely to respond to this enquiry.
Your study is ready
Thank you. The link is active for 30 minutes. If any questions come up as you read, we will gladly answer them.
Download the PDFLet's start with the list of systems
We propose a working meeting with the people responsible for the project or for operations. We will go through the list of systems planned for the facility, or already working in it, and agree which of them should fall under supervision and what "verified" means for each. On that basis we will prepare a detailed scope and schedule.