This framework covers the cyber and physical security expectations that fall on Canadian oil, gas, and pipeline operators. It is built from CSA Z246.1 (Security management for petroleum and natural gas industry systems), the Canada Energy Regulator's Onshore Pipeline Regulations requirement for a documented security management program, IEC 62443 for industrial control systems, and, for designated operators of interprovincial pipelines and power lines, the Critical Cyber Systems Protection Act.
The framework combines four sources: CSA Z246.1 (Security management for petroleum and natural gas industry systems), the Canada Energy Regulator's Onshore Pipeline Regulations requirement for a documented security management program, IEC 62443 for industrial control systems, and the Critical Cyber Systems Protection Act for designated operators of interprovincial pipelines and power lines.
Alberta operators also answer to the Alberta Energy Regulator for facility and pipeline requirements. Use this alongside CCSPA rather than instead of it.
Official source: https://www.cer-rec.gc.ca/en/safety-environment/industry-performance/security/
ThreeShield's CISSP- and CISA-certified assessors run the Canadian Oil & Gas / Energy Cyber Security engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.
| Canadian Oil & Gas / Energy Cyber Security requirement | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Multi-factor authentication status | ✓ Continuously | — |
| Patch and vulnerability posture | ✓ Continuously | — |
| Encryption at rest and in transit | ✓ Continuously | — |
| Access and audit-log review | ✓ Continuously | — |
| Risk assessment and scoping | ⚑ Platform data | CISSP/CISA-led |
| Policies, procedures, and evidence package | — | Written by ThreeShield |
Likely, if you are a Canadian oil, gas, or pipeline operator. These are the cyber and physical security expectations that fall on that group, and Alberta operators also answer to the Alberta Energy Regulator. We confirm scope in the first call, at no charge.
A gap assessment against this framework usually takes a few weeks. Closing the gaps and standing up the evidence takes longer, and that is where most of the work sits, so the total depends on your starting point. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.
Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.
ThreeShield meets you at your current security maturity. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full compliance delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.
Book a Scoping CallDIY · Supported · Done-for-You