Designing a More Trusted Cyber Security Service
A Service Design Assessment for Operational Technology
Suncor engaged J5 to explore how its Cyber Security team could build stronger relationships with Operational Technology personnel across geographically dispersed sites. We mapped the current experience, identified barriers to trust and engagement, and designed a more collaborative future-state service.
Cyber security depends on more than standards and technology. It requires people across the organization to understand their responsibilities, engage early and work together. By approaching cyber security as a service, Suncor could better support site teams while strengthening the behaviours and relationships needed to manage risk across the organization.
INDUSTRY
Energy and Utilities
CLIENT
Suncor Energy
WHY IT MATTERS
Cyber security is strongest when the people responsible for protecting an organization trust one another and work as partners. This engagement gave Suncor a clearer understanding of how Operational Technology personnel experienced Cyber Security and where uncertainty, competing priorities and organizational boundaries created friction.
By identifying opportunities to improve standards, projects, consultation, site visits and the Community of Practice, the work established a practical foundation for earlier engagement, greater accountability and more consistent collaboration across sites.
PROCESS HIGHLIGHTS
We mapped the current and desired experience across five meaningful moments in the relationship between Cyber Security and Operational Technology teams.
We assessed the Community of Practice against 15 service principles, identified opportunities to improve its maturity, and prototyped a more participatory approach with Operational Technology personnel.
Impact
-
User Level
Created a shared understanding of what Operational Technology personnel need from Cyber Security across standards, projects, consultation, community events and site visits.
Identified ways to make cyber security support easier to understand, more relevant to site realities and available earlier in the work.
-
Employee Level
Prototyped a more engaging Community of Practice in which Operational Technology personnel shared their experiences, exchanged practical knowledge and participated directly in conversations.
The prototype generated stronger engagement and established a more open, conversational relationship between site personnel and the Cyber Security team.
-
Organizational Level
Established a clear path for building trust, strengthening accountability and improving collaboration between Cyber Security, Operational Technology, Engineering, IT and site teams.
Created the foundation for a more scalable cyber security service that supports consistent practices and strengthens Suncor’s ability to manage cyber risk across its operations.