Skip to content
info@rootsektor.de
24/7 emergency: +49 2932 465265-0 Request a pentest quote Report an emergency
Emergency

Contact

Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.de

Mon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline

Request a pentest quote Report an emergency

Industries

Critical Infrastructure Penetration Testing for Energy and Water

Security of supply starts with cybersecurity

Municipal utilities, grid operators, and water and wastewater utilities are targeted by criminal and state-sponsored attackers, regardless of whether they are classified as KRITIS operators (critical infrastructure under German law). Critical infrastructure penetration testing from Rootsektor shows whether attackers could make their way from office IT into your control systems – with rules of engagement that put the safe operation of your facilities first.

  • Fixed price after scoping
  • Free retest
  • Quote within 24 hours
Request a pentest quote Schedule a consultation

Challenges

IT and OT security in the energy and water sectors

  • Challenge 1

    IT and OT are converging

    Control systems, telecontrol technology, metering operations, billing, and remote maintenance are interconnected today. Every connection between office IT and control systems is a potential attack path – especially where segmentation and remote access have evolved over the years.

  • Challenge 2

    Long-lived assets, tight maintenance windows

    Controllers, telecontrol components, and control system servers often run for many years. Not every component can be patched promptly or scanned actively, and careless testing can disrupt processes. That is why OT security requires experience and a coordinated approach.

  • Challenge 3

    Growing pressure to provide evidence

    Operators of critical facilities must regularly demonstrate that their safeguards reflect the state of the art; for energy grids and energy facilities, the IT security catalogs of the Federal Network Agency (BNetzA) specify the requirements. With NIS2, numerous utilities below the KRITIS thresholds are now covered as well, for example in the water sector, district heating, or energy retail.

Planning an audit, NIS2 implementation, or new control systems?

We tailor the scope to your facilities, your operational risks, and your compliance obligations. For your penetration test, you receive a fixed-price quote within 24 hours of scoping (on business days).

Schedule a consultation

Benefits

Benefits of penetration testing for energy utilities and critical infrastructure

A pentest reveals not just individual vulnerabilities but entire attack paths – and with them, where a measure contributes most to security of supply.

  • Identify attack paths to your control systems

    We show whether an attacker could advance toward your control system from the office network, via remote maintenance access, or with compromised accounts.

  • Verify segmentation

    We check whether zones and conduits according to IEC 62443 deliver in practice what your network structure plan and firewall design promise.

  • Secure operations

    Identify and fix vulnerabilities that pave the way for ransomware or sabotage before they jeopardize grid or plant operations.

  • Evidence for audits and supervisors

    The report and test certificate document scope, methodology, findings, and remediation – as a building block for KRITIS evidence, ISO 27001 certifications, and the effectiveness assessment under NIS2.

Services

Our services for energy, water, and critical infrastructure

  • OT, ICS/SCADA & IoT

    Control systems, telecontrol and substation technology, engineering workstations, and protocols such as IEC 60870-5-104, IEC 61850, or Modbus/TCP – using passive methods where active tests would be too risky.

  • Network & Infrastructure

    Office IT, DMZ, and firewalls between IT and OT, as well as VPN and remote maintenance access for vendors and service providers.

  • Active Directory Assessment

    Active Directory often connects office IT and operational systems. We uncover privilege chains that attackers could use to obtain administrator rights in the domain.

  • Red Teaming & APT Simulation

    A realistic, multi-stage attack shows whether an adversary can reach critical systems – and whether your attack detection systems notice.

  • Social Engineering & Physical Testing

    Control room, substation, pumping station – we test access controls, visitor processes, and how your employees respond to targeted deception.

  • Web Applications

    Customer service portals, online meter reading submission, rate calculators, and backends for EV charging infrastructure – wherever contract, consumption, and payment data is stored.

Regulations & standards

KRITIS, NIS2, and the IT security catalog: what pentests demonstrate

A penetration test replaces neither the KRITIS audit nor a certification. But it provides solid technical evidence of how effective your measures are.

  • Legal obligations

    KRITIS & NIS2 (BSIG)

    Operators of critical facilities must take precautions in line with the state of the art and regularly demonstrate this to the BSI (Germany’s Federal Office for Information Security) through audits, inspections, or certifications; special rules under the German Energy Industry Act (EnWG) apply to energy supply networks and energy facilities. This used to be set out in § 8a of the BSI Act (BSIG) – with the NIS2 implementation, the act was restructured. In addition, important and essential entities must assess the effectiveness of their risk management measures (Art. 21 of the NIS2 Directive (EU) 2022/2555).

    • Technical evidence for the KRITIS audit
    • Testing of attack detection systems
    • Security of the supply chain and remote maintenance

  • Energy grids & facilities

    BNetzA IT security catalog

    For operators of energy supply networks and critical energy facilities, the IT security catalogs of the Federal Network Agency specify the requirements of the German Energy Industry Act. At their core is an ISMS according to ISO/IEC 27001, taking ISO/IEC 27019 into account, certified by an accredited body.

    • Evidence of technical vulnerability management
    • Review of network structure plan and segmentation

  • OT standards

    IEC 62443 & B3S

    The IEC 62443 series describes the security of industrial automation systems – from zones and conduits (part 3-2) and security levels (part 3-3) to requirements for service providers (part 2-4). In the water sector, the industry-specific security standard B3S Water/Wastewater defines the state of the art.

    • Testing of defined zones and conduits
    • Assessment in the context of your security levels

How we test in critical environments

In OT, availability takes priority. That is why, before the first data packet is sent, we define what will be tested, how – and what explicitly won’t be. Our methodology applies across all industries, supplemented by particularly strict rules of engagement in critical environments.

Scoping with IT and control engineering

Together with IT, grid or operations management, and the service providers involved, we define goals, zones, critical systems, and exclusions.

Fixed-price quote

Within 24 hours of scoping (on business days), you receive a fixed-price quote with no hidden costs.

Rules of engagement & safeguards

Test windows, contact persons in operations, abort criteria, and passive and active methods are agreed in writing. Where possible, we use test or lab systems.

Testing from the outside in

From the internet through the office network and remote maintenance up to the agreed boundaries of your control systems. Active tests on controllers only take place after explicit approval.

Report for engineering, management, and audit

An executive summary, CVSS ratings supplemented by the impact on grid and plant operations, and remediation recommendations prioritized by risk and feasibility.

Retest & test certificate

After remediation, we retest free of charge. You can present the test certificate to auditors, partners, and insurers.

FAQ

Frequently asked questions about critical infrastructure penetration testing

Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.

Will a penetration test put our grid or plant operations at risk?

Careful planning can keep the risk very low – and that is where we put our focus. For each zone, we record in writing whether we test actively, only monitor passively, or don’t intervene at all. During testing, a contact person from grid or operations management is available who can stop the test at any time. We preferably test systems without redundancy in the lab, on spare components, or indirectly via the transitions leading to them.

Do you also test PLCs, telecontrol devices, and control systems directly?

Yes – after careful planning and only with explicit approval, preferably on lab or test systems or during agreed maintenance windows. For example, we look at whether telecontrol protocols such as IEC 60870-5-104 are reachable without protection, or whether engineering software can connect to controllers without effective authentication. Often, analyzing transitions and remote access alone shows where action is needed most.

Does the pentest replace the KRITIS audit?

No. The KRITIS audit is carried out by a qualified auditing body, and certification under the IT security catalog by an accredited certification body. Our report provides technical evidence that can feed into the audit and the certification.

Does NIS2 apply to us as a municipal utility?

That depends on sector and size. Energy as well as drinking water and wastewater are among the sectors of high criticality; as a rule, companies with 50 or more employees or with more than €10 million in both annual turnover and annual balance sheet total are covered. Operators of critical facilities count as essential entities regardless of size. You should have the binding classification reviewed by legal counsel.

Do you also test our service providers’ remote maintenance access?

Yes – it is among the most important attack vectors in OT environments. We test VPN and jump host access, authentication, assignment of privileges, and logging, provided they fall within the agreed scope and the service provider has consented.

Can you test our attack detection systems?

Yes. In a red teaming engagement or in targeted scenarios, we simulate attack techniques based on MITRE ATT&CK and MITRE ATT&CK for ICS. This shows you which activities your attack detection notices – and where blind spots remain.

What happens if a security incident occurs despite all precautions?

Then our Incident Response & Forensics team supports you remotely and on-site – with containment, forensic investigation, and restoring operations. For the legal reporting obligations, we provide the technical facts and keep track of the deadlines together with you, such as the early warning of significant security incidents within 24 hours under NIS2. Outside business hours, you can reach us via our 24/7 emergency hotline at +49 2932 465265-0.

Talk to us about your facilities

Briefly describe your environment and your goals – from web applications to control systems. We’ll propose a scope that takes both your compliance obligations and your operations into account.

Fields marked with * are required.

For questions or a callback

We will get in touch and, if you wish, sign the non-disclosure agreement before our first conversation – including on the basis of your own template.

We use your information solely to process your request. For more information, see our privacy policy. Please do not send passwords or login credentials through this form.