CYBORAMA LLC · SERVICES
Fixed-price security work for small operators.
Cyborama produces finished security documents and reviews for small water and wastewater systems, electric co-ops, municipal utilities, small manufacturers, and businesses with no security staff. Every service has a set scope, a list of what you receive, and a price you know before we start.
Email jeffgray@cyborama.com See services
OT and utility security services
OT Remote Access Risk Review
A bounded review of every way vendors and staff reach your control system from outside the plant, with a short list of the fixes that matter most.
- Who it's for
- Small water and wastewater systems, co-ops, municipal utilities, and small manufacturers that let integrators or vendors connect remotely.
- What you get
- A map of remote access paths: VPN accounts, remote-desktop tools, integrator laptops, cellular modems, vendor portals, and shared logins.
- A vendor access check: Who has accounts, how access is approved and removed, and whether multi-factor login and session logging are in place.
- A findings report of 6 to 10 pages, with each path rated high, medium, or low in plain language.
- A top-5 fixes list with rough cost ranges and owners, written to drop into the cybersecurity section of your Emergency Response Plan.
- A one-hour readout for the general manager, operator, or board.
- An organization license to the OT Remote Access Playbook, Professional Edition ($249 value).
- Timeline
- About 2 weeks from kickoff to readout, with 1 day on site.
$3,500 fixed · second on-site day $1,000
Vendor Remote Access Policy and Procedure
The written rules for how outside vendors and integrators get in, what they can touch, and how access is shut off.
- Who it's for
- Utilities and plants that rely on outside integrators and have no written remote access rule.
- What you get
- A vendor remote access policy, 3 to 5 pages, adopted in your name.
- A step-by-step procedure for requesting, approving, supervising, and ending a vendor session.
- A one-page access request form and a vendor account tracker in Excel.
- One round of revisions after your review.
- Timeline
- About 1 week after a one-hour intake call.
$950 fixed
Risk and Resilience Assessment Support (small water systems)
Help preparing the cybersecurity portions of an America's Water Infrastructure Act Risk and Resilience Assessment and Emergency Response Plan.
- Who it's for
- Community water systems serving more than 3,300 people that are due to review or recertify their assessment and plan.
- What you get
- A review of your current assessment and plan against the cybersecurity items they should address.
- Drafted cybersecurity sections and a list of gaps for your team or engineer to close.
- Working notes your staff can reuse at the next five-year review.
- Timeline
- Set in the quote, based on system size and what already exists.
Quoted per system
Small business security services
Security Policy Pack
A core set of short, plain policies a small team will actually follow.
- Who it's for
- Small businesses and utilities with no security staff that need written policies for a customer, an insurer, a board, or an auditor.
- What you get
- Five policies fitted to your organization: Acceptable use, access control, incident response, backup and recovery, and vendor access.
- Each policy 2 to 4 pages, in Word, ready for adoption.
- A one-page summary sheet for staff.
- One round of revisions after your review.
- Timeline
- About 2 weeks after a one-hour intake call.
From $1,250
Incident Response Plan and Tabletop Exercise
A written plan for the first hours of a security incident, then a practice run with your team.
- Who it's for
- Organizations whose insurer, customer, or board has asked for an incident response plan, and teams that want to know who calls whom before it happens.
- What you get
- An incident response plan with roles, a call tree, decision points, and first-hour checklists.
- A 2-hour tabletop exercise built around a realistic scenario for your operation, run remotely or in person.
- A short after-action report with the gaps found and plan updates made.
- Timeline
- About 3 weeks, with the tabletop scheduled at your convenience.
From $2,250
Cyber Insurance Readiness Review
A check of your controls against what insurers commonly ask before they write or renew a policy.
- Who it's for
- Small businesses and utilities facing a cyber insurance application or renewal, or a premium increase they don't understand.
- What you get
- A review of your application or renewal form and your current controls, by interview and documents.
- A readiness report listing each common insurer requirement as met, partly met, or missing.
- A prioritized fix list, with the items most likely to affect coverage first.
- Timeline
- About 1 week.
From $950
Security Questionnaire Response
Accurate, consistent answers to a customer's or insurer's security questionnaire.
- Who it's for
- Small vendors and suppliers that received a security questionnaire from a customer, prospect, or insurer and have no one to answer it.
- What you get
- A completed questionnaire, drafted from an interview with your team and your existing documents.
- A list of any questions you can't honestly answer "yes" to yet, with what it would take.
- A reusable answer file for the next questionnaire.
- Timeline
- Usually 3 to 5 business days.
From $350
Related products
OT Remote Access Playbook · Professional Edition
Plant-ready playbook for OT remote access: Jump-host architecture, MFA, vendor access, policy templates, and Excel tools.
$249 · one-time
Buy Remote Access PlaybookBook: Also available as a Kindle eBook for $12.99, without the Excel tools.
OTFeed
US-only digest that matches public ICS advisories to the devices a customer actually runs.
30-day free trial, then paid plans
Open OTFeedWhy Cyborama
- Local: Based in Birmingham, Alabama, and able to be on site at plants across the state.
- Veteran-owned: Cyborama LLC is a veteran-owned business.
- OT judgment: The work is shaped for control systems and small operations, not copied from an enterprise office template.
- Credentialed: Jeff Gray, the principal, holds the CISM.
- Published: Jeff is the author of the OT Remote Access Playbook and writes about industrial control systems at controlsystemssecurity.com.
- Vendor-neutral: Cyborama sells no hardware or remote access products, so the advice is not a sales pitch.
What Cyborama does not do
No penetration testing or vulnerability scanning; when testing is needed, we recommend a qualified firm. No changes to your systems; your staff or integrator makes the fixes. No engineering stamps, legal opinions, or compliance certifications.
Start a project
Email a short note with your organization, the service you're interested in, and any deadline you're working against. You'll get a reply with a written scope and a fixed price before any work starts.
Invoice on delivery, net 30, or against your purchase order. Findings are confidential and go only to your named contact.