Madera runs on water it must move precisely, and the systems that move it were built for reliability, not for attackers. CyberFortify runs manual OT/ICS, IoT, network and cloud penetration tests here, aligned to NIST CSF, NIST SP 800-82, the EPA/AWIA resilience context and IEC 62443. Testing runs to agreed windows with clear abort conditions and never targets a live pump, well or canal gate. Delivered remotely from our Gulf base on a daily overlap window, with on-site work where a tester genuinely needs to be on the wire. Fixed price, audit-ready reporting, free retest.
// 01 Why Madera operators need penetration testing
A gate opens on a canal, a pump lifts groundwater into a lateral, a well starts on a schedule set hundreds of feet away - none of it with a person standing there. Madera's irrigation districts and water agencies run on remote telemetry: RTUs and PLCs in the field, cellular and radio links back to a control room, and an HMI where one operator watches flow and level across the whole system. That automation is why a small staff can manage a district spanning farms and townships.
It is also an attack surface that grew one device at a time. Many field sites were commissioned when the only threat model was weather and hardware failure, so a remote RTU may still answer on a public IP, a serial-to-IP gateway may pass control commands in clear text, and an old HMI may share a flat network with the billing PC. Add precision-agriculture IoT - moisture sensors, variable-rate controllers, connected pumps reporting to a vendor cloud - and the water-control environment now touches the internet in places nobody drew on the original diagram.
Scanning cannot judge that risk. A scanner flags old firmware; it cannot tell you that a default credential on a cellular gateway reaches the PLC behind it, that a well controller trusts any command on its radio channel, or that an ag-IoT vendor API leaks one grower's field data to another. Those are the failures that stop water moving or corrupt the telemetry operators rely on - and confirming them takes a tester who reads the protocol and respects the process it controls.
// 02 Compliance and regulatory drivers in Madera
Water and agriculture operators answer to industrial-control security guidance, a federal resilience mandate for community water systems, and consumer-privacy law over the account data they hold. These are the requirements we most often map evidence against.
NIST SP 800-82
The reference guide for securing industrial control and SCADA systems. We structure OT findings around its controls - inventory, segmentation, remote-access and monitoring - so results slot straight into an ICS security programme.
EPA / America's Water Infrastructure Act
AWIA requires community water systems to assess risk and resilience and maintain an emergency response plan. Independent OT testing is how the cyber side of that assessment is evidenced rather than assumed.
IEC 62443
The standard for industrial automation security frames zones, conduits and segmentation between business IT and the water-control environment. We test whether those boundaries hold or are boundaries only on paper.
NIST CSF
Many districts and agencies anchor the wider security programme to the Cybersecurity Framework. Its Identify, Protect and Detect functions rest on independent testing to show the controls actually work.
CCPA / CPRA
Ratepayer accounts, customer billing and any resident portal fall under California's consumer-privacy regime, which adds rights and risk-assessment duties across the business-IT side that sits beside the OT network.
// 03 Penetration testing services for Madera
Madera engagements lead with OT and control-system testing, because that is where a failure stops water or corrupts telemetry. IoT and cloud follow, since precision-ag sensors and vendor platforms now reach into the same environment; network and segmentation testing proves the seam between office IT and water control.
OT / ICS pen testing
SCADA servers, HMIs, RTUs, PLCs and radio or serial-to-IP gateways - remote-access exposure, default credentials and control-protocol weaknesses, tested without touching live control.
IoT pen testing
Precision-ag sensors, gateways and connected pump and well controllers - firmware, provisioning, cellular and radio channels, and the data they report.
Network pen testing
External, internal and Active Directory testing, plus the segmentation checks that decide whether the corporate network can reach the water-control zone.
API pen testing
Ag-IoT vendor and telemetry cloud APIs - broken object-level authorisation, tenant isolation and whether one operation's field or sensor data reaches another's.
Cloud pen testing
Identity, storage and service-account scope across the platforms hosting SCADA historians, telemetry ingestion and ag-IoT dashboards.
Red teaming
Goal-based simulation that asks whether an intrusion into IT is detected before it can pivot toward the water-control environment.
// 04 How we deliver to Madera
We will not pretend otherwise: CyberFortify is a Gulf-based firm on UTC+3, and Madera sits ten to eleven hours behind us, with no California office and no local staff. What we have is a pattern built around that gap: our late afternoon and evening is your morning, and we hold that window open daily for stand-ups, live triage and read-outs - which matters when testing has to be choreographed around irrigation schedules. Testing continues while Madera is offline, so results are waiting when the day shift starts.
What runs remotely
External exposure of RTU and cellular telemetry, HMI and SCADA server review, ag-IoT cloud and API testing, and business-IT assessment from our secure environment - the majority of scope, all inside agreed windows with abort conditions defined up front.
What we do on-site
Internal control-network, wireless, radio and segmentation testing where a tester genuinely needs to be on the wire or near a field site, plus workshops for operators and district boards. We travel when it adds value and say so when it does not.
Every engagement opens with a free 30-minute scoping call and a fixed-price quote within the hour. No live pump, well or canal gate is ever a target; we prove control-path risk through passive analysis, safe protocol interaction and mirrored lab work, and a free retest proves the fixes.
// 05 Who we secure in Madera
Madera's risk profile is shaped by water it must deliver on schedule, groundwater it must manage under state law, and a farm economy going digital sensor by sensor.
// 06 Our methodology
Madera engagements follow the same audit-defensible process we run everywhere, tuned to the safety constraints of live water control. Testing is grounded in PTES and NIST SP 800-115, with OT structured around NIST SP 800-82 and IEC 62443, exploitation mapped to MITRE ATT&CK for ICS tactics, and application and API work driven by OWASP. As a CREST Accreditation Pathway firm we lead with manual testing - automation supports the tester, never replaces one, and intrusive tooling is kept well clear of production control devices.
Scoping & rules of engagement
Targets, control zones, test windows, off-limits devices, abort conditions and escalation paths agreed in writing before anything starts.
Fixed quote in 1hRecon & OT threat modelling
Attack surface mapped from business IT toward the water-control zone - what is reachable, over which link, with which credential, and what a command could actually move.
ATT&CK for ICSControlled, safe exploitation
Weaknesses proven at the IT, DMZ, HMI and telemetry layers through passive analysis and safe interaction; control-device impact demonstrated in a mirrored lab, never in production.
No live control targetReporting & free retest
Executive summary, CVSS-scored detail and mapping to NIST 800-82, IEC 62443, AWIA and NIST CSF - plus a free retest once fixes ship.
Audit-ready// 07 Why CyberFortify for Madera
A scan-and-report vendor
An IT scanner pointed at an OT network, blind to control protocols and process safety, as likely to knock a fragile RTU offline as to find the flaw that mattered.
CyberFortify
A Gulf-based, CREST-pathway team candid about the time difference and disciplined about live water control. Manual testing of the seam between office IT and the water-control zone, findings mapped to NIST 800-82, IEC 62443 and your resilience assessment, fixed pricing and a free retest.
Madera engagements most often pair an OT/ICS assessment with network segmentation testing, because a control system's real exposure usually starts on the corporate network that should have been kept apart from it. Where precision-ag platforms are in scope, we add IoT and API testing to follow the sensor data from field to cloud.
// 08 Frequently asked questions
Can you test our SCADA and telemetry without disrupting live water delivery in Madera?
Yes, and that constraint shapes the whole engagement. We agree test windows around your operational load, define clear abort conditions in writing, and never make a live canal, pump, well or groundwater-control device the target of an intrusive action. Active testing concentrates on the business-IT and DMZ layers, the HMI and SCADA server environment, exposed RTU and cellular telemetry interfaces, and radio or serial-to-IP gateways - proven through passive analysis, safe protocol interaction and controlled lab work where a device can be mirrored rather than touched in production.
What SCADA and field-device weaknesses do you look for on an irrigation-district network?
We look for the exposures that keep recurring on water OT. Remote RTU, PLC and cellular telemetry links reachable from the internet or a flat corporate network; default or shared credentials still live on field devices and HMIs; unauthenticated or clear-text control protocols behind radio and serial-to-IP gateways; SCADA servers and engineering workstations missing hardening and patches; and weak or absent segmentation between the office network and the water-control environment. We map each to how an attacker would reach a pump, a well or a canal gate, and how to stop them.
Which frameworks and regulations drive penetration testing for Madera water and agriculture operators?
NIST SP 800-82 is the reference for securing industrial control and SCADA systems, and we structure OT findings around it. The EPA and America's Water Infrastructure Act set the risk-and-resilience assessment context for community water systems, where independent testing evidences the technical side. IEC 62443 frames zones, conduits and segmentation for the control network, and many operators anchor the wider programme to NIST CSF. CCPA/CPRA covers the consumer and customer-account data on the business-IT side, including any billing or resident portal.
With your team in the Gulf, how does the time gap work for a Madera engagement?
We will be plain: CyberFortify is a Gulf-based firm on UTC+3, ten to eleven hours ahead of Madera, with no California office and no local staff. We hold a deliberate daily overlap window - our late afternoon and evening is your morning - for stand-ups, live triage and read-outs, which matters when we are coordinating around water-control schedules. Testing continues while your operators are offline, so confirmed findings are usually waiting when the day shift begins.
How fast can we get a quote for a Madera water or ag-IoT engagement?
Book a free 30-minute scoping call and we return a fixed-price quote, usually within the hour and always within one business day. The report is written to hand straight to an auditor or your board, mapped to NIST 800-82, IEC 62443 and NIST CSF, and a remediation retest is included once your fixes ship.