Industries
Your crews keep the lights on. Who keeps the company running?
Electric, gas, and nuclear utilities are some of the best-practiced responders in any industry. Storm response is in your muscle memory. The harder questions sit above it: who decides when the event isn’t a storm, how the executive team engages, and whether the rest of the company can keep running.
We help utilities build crisis management, business continuity, and IT disaster recovery programs that connect field response to executive decisions, hold up to the board and the regulators who check them, and stay simple enough to use at 2 a.m.
✅ Practitioner-led, not advisory
✅ One crisis structure from the division to the executive team
✅ Tested in real exercises, not just on paper
What we hear from utility leaders
The people who run resilience programs at utilities tell us the same things we hear across critical infrastructure:
“We have two crisis teams. The responsibilities overlap. The severity levels are confusing.”
“Our IR plan is solid. Our crisis plan is solid. Nobody has ever tested the handoff between them.”
“We wouldn’t be in a good spot should we have to recover. We don’t know what’s tied to what.”
“The board asked when the executive team last practiced a crisis. I didn’t have a good answer.”
“Great job reporting the risk. Now do something about it.”
“I don’t have enough time and hands.”
Sound familiar? You don’t need another consultant to tell you what you already know. You need practitioners who will simplify the program, build what’s missing, and help you run it.
The utility reality
Utilities are critical infrastructure. Homes, hospitals, and businesses depend on the steady flow of power and gas, and every disruption is public within minutes.
The threats are no longer just weather. Generation, transmission, and distribution assets face physical attacks. Control centers and corporate systems face cyberattacks. Headquarters and field sites face workplace violence. Each of those can turn into an enterprise crisis that storm plans were never written for.
The requirements stack up:
- NERC’s Critical Infrastructure Protection (CIP) standards require cyber security incident response plans (CIP-008) and recovery plans for bulk electric system cyber systems (CIP-009), each tested at least once every 15 calendar months for high and medium impact systems.
- Boards and audit committees expect evidence that the enterprise, not just operations, can manage a crisis and recover.
- Federal, state, county, and local emergency management partners expect a utility that speaks their language and shows up ready on the worst day.
The answer isn’t a separate binder for every requirement and every hazard. It’s one program, with one crisis structure, one set of continuity and recovery plans, and one testing calendar, that connects your incident command teams to your executives.
How we help utilities
- Resiliency Diagnosis®. A standards-based evaluation of your crisis management, continuity, and recovery capabilities, with a maturity score you can track year over year and a roadmap your audit committee can follow.
- Operational resilience. One program across business continuity, crisis management, and IT disaster recovery, organized around the services your customers depend on, with impact tolerances your executives set.
- Crisis management. One enterprise crisis structure with clear severity levels, built on Incident Command System (ICS) language your storm and field teams already use.
- Business continuity and Business Continuity as a Service. BIAs, plans, and governance for the corporate functions behind operations, built with you or run for you.
- IT disaster recovery. Recovery requirements, plans, and testing that match what control centers, customer operations, and corporate functions actually need.
- Cyber incident response planning. A cyber response that connects your technical incident team to executive decisions, communications, and regulators.
- Executive and board exercises. Active shooter, physical attack, cyber, and severe weather scenarios that put the decisions only your executives can make in front of them.
- Cyber crisis exercises. From a technical tabletop for your incident team to a multi-day enterprise simulation.
- Crisis communications. Communication plans for customers, regulators, emergency management partners, employees, and the media.
- Global Security Operations Center (GSOC). Strategy and procedures for monitoring threats to your people and assets and escalating them fast.
33
interviews, including every member of the executive team, in one utility’s Resiliency Diagnosis®
~500
pages of program documentation reviewed
Audit Committee
briefed in writing, leading to a multi-year investment in the program
10 weeks
to design a C-level active shooter exercise for the entire executive team
Electric, Gas & Nuclear
Transforming a Major Utility’s Crisis Management and Continuity Strategy
A Resiliency Diagnosis® that took a multibillion-dollar utility to its CEO and Audit Committee, and a multi-year program build that followed.
Read the case study →
Electric, Gas & Nuclear
A C-Level Active Shooter Exercise for a Major Utility Company
A half-day exercise at headquarters that brought the crisis management team, crisis communications, and the entire executive team into one active shooter response.
Read the case study →
Programs aligned to
ISO 22301 · ISO 22361 · ISO/IEC 27031 · NERC CIP · NIMS and ICS
Our utility work
Our power and utilities work spans electric generation, transmission, and distribution, natural gas, nuclear, wind, and solar, along with control centers, information and operational technology, storm response, and public-private partnerships at the federal, state, county, and local levels. All of our case studies are anonymized.
Electric, natural gas, and nuclear
- A Resiliency Diagnosis® and program transformation for a major U.S. electric, natural gas, and nuclear energy company facing growing threats to its generation, transmission, and distribution capabilities. Thirty-three interviews, a briefing to the CEO and executive staff, and a written summary to the Audit Committee led to a multi-year investment, with Bryghtpath retained for the build. Read the case study.
- A C-level active shooter exercise for a major U.S. electric, natural gas, and nuclear energy company, testing the crisis management framework and bringing the executive team into the response. Read the case study.
More of our utility work
- Divisional incident management plans for a regional U.S. electric utility, built on the Incident Command System (ICS) so every division manages incidents with the same approach, strategy, and language. We trained the teams on the new plans and facilitated multiple tabletop exercises to build confidence and muscle memory.
- An enterprise crisis and emergency management strategy for a regional U.S. electric utility, giving it a structured way to manage disruptions, natural disasters and severe weather, and cyber and physical security incidents.
- Recurring maturity reviews of a major U.S. energy company’s crisis management, business continuity, and disaster recovery program, using a custom maturity model built on ISO 22301 so leaders could compare progress year over year.
Frequently asked questions
We already run storm response well. Why do we need more?
Because storms are the crisis you practice. A cyberattack, a physical attack on a substation, or an active shooter at headquarters asks different people to make different decisions. We build on the incident command structure you already have and connect it to an enterprise crisis structure and your executives.
Do you help with NERC CIP?
We don’t perform CIP compliance audits. We help you build and exercise the cyber incident response and recovery plans the CIP standards expect, and we connect them to your enterprise crisis management and business continuity programs so a cyber incident doesn’t stay in the control center.
Can you exercise our executive team?
Yes. We design executive exercises around the decisions only your executives can make, from an active shooter at headquarters to a cyber incident that reaches operations, and finish with a short report they can act on.
How do we show the board and audit committee progress?
With a maturity model built on ISO 22301 and scored the same way every year. Your executives and audit committee see where the program stands, what improved, and what comes next.
Where do we start?
With a Resiliency Diagnosis®. It shows what you have, what overlaps, and what to fix first, then gives you a prioritized roadmap.
Do you work with gas, nuclear, and renewable operators, or only electric utilities?
All of them. Our work covers electric generation, transmission, and distribution, natural gas, nuclear, wind, and solar.
We can help.
Let Bryghtpath put its utility experience to work for your organization
From your next Resiliency Diagnosis® to your next executive exercise, we’ll help you build a program that holds up when it matters.