Cybersecurity risk assessments built for critical infrastructure
Sigma Threat Ops helps small water utilities understand where cybersecurity risk could disrupt operations, prioritize the improvements that matter most, and give executives a defensible path forward.
Independent Cybersecurity Assessments
A useful assessment must explain what could affect operations, why it matters, and what leadership should do next. Sigma evaluates the operating environment as a whole: technology, people, vendors, governance, and the dependencies that keep essential services running.
01
Interviews, documentation, technical evidence, and on-site observations are reconciled into a defensible view of risk. Findings reflect actual operating conditions rather than a checklist score.
Collect and reconcile evidence from leadership, operators, technology providers, records, and the site itself.
Evaluate how cyber conditions could affect service delivery, recovery, safety, finances, and public trust.
Distinguish structural risk drivers from lower-impact technical issues and sequence improvements realistically.
Give executives and boards clear findings, practical recommendations, and a roadmap they can govern.
What leadership gains
Additional Services
When a priority needs to become an operating capability, Sigma provides targeted support that keeps recommendations practical, provider-neutral, and tied to the risk they are meant to reduce.
Develop an IRP that reflects decision authority, vendor roles, operational continuity, communications, and realistic recovery priorities.
Discuss this serviceTest how leaders, operators, IT providers, and OT vendors would coordinate through a disruptive cyber incident before it occurs.
Discuss this serviceDeliver role-relevant education that helps boards, leaders, and staff understand their decisions and responsibilities without unnecessary technical detail.
Discuss this serviceHelp leadership define scope, evaluate proposals, coordinate providers, and verify that an investment addresses the intended risk.
Discuss this serviceFor Engineering Firms & Trusted Advisors
Sigma gives engineering firms, associations, consultants, and technology providers an independent cybersecurity assessment capability they can bring to clients without competing with their core services.
Explore a PartnershipVendor-neutral conclusions protect the credibility of the client relationship.
Clear service boundaries strengthen the partner’s offering without displacing engineering, IT, or controls work.
Technical conditions become decisions that leadership and governing boards can understand and support.
Experience built around consequential systems
Lance Taylor founded Sigma Threat Ops to give organizations without internal cybersecurity leadership access to experienced, independent judgment.
His background spans 22 years in U.S. Air Force intelligence and cybersecurity, national-level intelligence and cyber missions, cybersecurity curriculum development that included cyber warfare and industrial control systems, current private-sector cyber defense leadership, and cybersecurity assessments for municipal water infrastructure.
The value of that experience is practical: disciplined evidence review, an understanding of consequential operations, and the ability to translate technical risk into decisions executives can govern.
Cybersecurity guidance should help leadership decide what matters, what to do next, and why the investment is justified.
Working principleStart a Conversation
Whether you need an independent assessment or a complementary capability for your clients, start with a focused conversation about the operating environment, the decision in front of you, and what useful support would look like.
Clarify your current concerns, timing, stakeholders, and the operational questions the assessment must answer.
Compare service boundaries and determine whether an independent assessment capability would add value for your clients.
Prefer email? lance@sigmathreat.com
