Day three of an ice storm: lines down, cell service failing, and generators are running low.  Roads are blocked and vehicles need to be charged. Engineering rebuilds. IT searches for visibility. Both are right—yet not aligned. This session explores where they struggled, where they succeeded, and why business continuity requires teamwork.

Learning Objectives:

• Unexpected storm impacts and identification of emerging threats
• Long term vs short term outage issues
• Preparation steps to enhance response & recovery
• Business technology dependency on field operations
• Business continuity dependencies between engineering and technology security

Contracts aren’t exactly the Indy 500 of cybersecurity, but without solid third party management and contract review, your cooperative can lose thousands of dollars due to missing information and unfair agreements.

All third-party contracts are favorable to the company whose name is on the paper, but that doesn’t mean that you can’t modify and adjust before signing the agreement. Join this engaging discussion as we look at real contracts, real terms, and talk through real losses to the tune of $100k, which could have been avoided.

Elicit the excitement for security in your marketing teams, human resources, mapping gurus and so many others with the real case studies of contracts gone wrong with business partner contracts that didn’t hold up their end of the deal.

Learning Objectives: 

1. Identify 5 critical technology security protections that every contract needs
2. Identify key terms missing from-third party contracts
3. Apply key contract requirements to bidding and RFP processes

Cooperatives face risks ranging from severe weather and equipment failures to cyber incidents, payroll interruptions, and third-party outages affecting financial and operational systems. This session helps accounting and finance professionals identify critical business threats and conduct a practical business impact analysis that reflects real financial and operational consequences.

Real-life case studies will be used to examine the dependencies and differences between the Emergency Response Plan field operations and Business Continuity Plan functions—such as payroll, billing, purchasing, and cash flow—and learn when to activate incident response, disaster recovery, or long-term business continuity plans. The session also explains why cyber insurance alone is not a solution and how to plan operational and financial resilience in advance.

Attendees will leave with a clear, risk-informed, and actionable approach to protect revenue, support field operations, maintain compliance, and keep the cooperative serving its members during disruptions.

Segregated into silos, Information Technology (IT) and operational technology in critical utilities are now challenged by cybersecurity as it applies to the maturing devices being utilized in the OT space. SCADA segregation, engineering bringing in first- and second-generation Automated Metering Infrastructure (AMI), microgrids, Distributed Energy Resource Management Systems (DERS), and more bring with them new risks.

Dive into the work being done through higher education through the ReCIPE Coalition as universities develop communication, building, and cross-functional teamwork training, and bridge the gap for electrical cooperative engineering, operations, information technology, and security teams.

An organization’s people are the fundamental strength. Security knowledge, awareness of security threats around them and tools available to employees is imperative as we work together to protect the organization and respond in times of disasters.

Our team brings recent security events, natural disasters, and third-party business partner outages into the training room for all employees to learn how they impact your organization and the steps we are taking to develop and protect them and the business. Cybersecurity, physical security, and technology tools are all part of the conversation with our marketing, human resources, operations, field, accounting, and other teams that each play an important role for the business and in the security of the business.

Responsibility for meeting business goals in a secure environment for employees, customers, and members is held by the Board of Directors. Risks with financial, legal, reputational, and compliance impact on the business reside in the technology and security decisions made every day.

This annual training with the Board reviews industry specific trends, challenges, regulatory changes, and the management’s leadership in mitigating and reducing these risks.

Tags

Board of Directors, Education, Training, Finance, Healthcare, Energy, Gas, Water, Broadband, Community Banks, Credit Unions, Cooperatives, Critical Utilities, Information Security, Technology

A light, entertaining dive into the relationships being built outside the IT department and the risk to your institution. We threw marketing under the bus only to see that IT might have given the bus the green light to go. Engaging, relatable stories of real third-party risks will pull in attendees and have them asking for more!

Business goals are driven by sales, marketing, and supporting technology. However, often in IT there are so many tasks: upgrade, patch, monitor and secure what is INSIDE the organization, that we are missing the #1 threat to security, according to the ABA Banking Journal (Feb 2024), third-party business partners.

Key areas discussed will be in a risk/impact style.

We address the following areas with real-life stories, examples, and the tools and processes used to recover and prevent future impacts on the organization.

• What risk does a third party pose to the organization & what is the impact?
• Examples of real-world website injections (phish kits, Chinese porn)
• Examples of third-party email compromises with Trojans sent to employees for free sweatshirts
• Unsecured cloud repositories are used to transfer large files from the business to the marketing company used by the business (oh, we had to provide a full customer list to them?)
• How to start remediating these risks with real steps that have been done for banks, education, utilities, and healthcare
• Awareness is step #1, education & training, talking to your marketing team
• Using free & paid tools to scan & check websites, emails
• Review of contracts and relationships
• What tools does marketing need? Secure file transport repositories – what do you already have available – M365 tools, ShareFile, Vault, Drive

Tags: Training and awareness, critical infrastructure, cybersecurity, Information Security, Marketing, Information Technology, financial services, banking, education, healthcare, electric, gas, broadband, water, and critical utilities

Whether you’re sorting M&Ms and concerned about contamination, or outsourcing important business services, knowing your third-party business partner is imperative. Due diligence up front can reduce scope creep, goals that aren’t met and security contamination of the business.

New business partners:

1. Do a risk assessment before signing a contract.
2. Provide clean tools for them to use.
3. Ask about their security hygiene practices.
4. Contract reviews for technology and security requirements prevent a lot of headaches later.

Providing an initial supply chain questionnaire with these and other questions helps assess the business.

1. Are you owned or operated by a parent company with a different name?
2. Do you provide services directly or through subcontractors?
3. Where is your headquarters located? Do you operate in countries other than the US?
4. If yes, where?
5. Do you currently have a documented Information Security Program, Cybersecurity?
6. Program and/or security policy?
7. Do you have an employee acceptable use agreement?
8. Do you have cyber security insurance? If yes, does it cover contracted work?

Current Business Partners

1. Identify who we are worried about – risk rate ‘em!
2. Ask them some questions and see what their hygiene looks like

Look for business-critical and high-risk vendors.

Start with contracts over 10 years old.

Every day, cybersecurity professionals make decisions that impact their entire organization—but assessing and classifying business risk isn’t always straightforward. This interactive session will put your risk evaluation skills to the test through real-world cooperative incidents and hands-on exercises.

Attendees will:

• Review and discuss key cybersecurity risks that affect cooperatives.
• Engage in live risk assessments using an interactive game.
• Analyze scenarios like OT device configurations, insider threats, and third-party relationships.
• Learn practical risk assessment techniques to clarify impact and improve decision-making.

Bring a mobile device and join this engaging discussion on how to measure, communicate, and mitigate cybersecurity risks effectively.

Electric cooperatives face a unique mix of risks—from severe weather and equipment failures to cyber incidents and technology outages. This session focuses on how to build a practical, actionable Business Continuity Plan that helps electric co-ops maintain critical operations when normal systems, people, or facilities are disrupted.

This session walks through identifying critical functions, understanding system interdependencies, and defining recovery priorities across operational and corporate systems. Attendees will learn how business continuity fits alongside incident response, disaster recovery, and emergency operations—and why it has become a key cybersecurity objective.

By the end of the session, participants will understand how to move beyond ad-hoc response and “figure it out later” thinking to a documented, tested plan that supports reliable power delivery, protects member services, and keeps the co-op operating when conditions are at their worst.