GridShield Platform

Every OT asset. Every CIP standard. One evidence chain.

A Command Center, site Nodes and optional endpoint Agents that collect read-only evidence over OT and network protocols, hash-chain every record, and keep your RSAW worksheets current — entirely inside your network.

Read-only collection
Air-gapped install from a bootable ISO
SHA-256 hash-chained evidence
14 FERC-approved CIP standards

Request a Demo See the Architecture

Inside the Command Center

The real product, not a mock-up

Captured from a running GridShield Command Center. IP addresses are blurred.

Evidence Vault: millions of hash-chained evidence records with chain verification — Evidence Vault — every record hash-chained, verified and exportable.

Site asset inventory with BES Cyber System impact ratings and CIP roles — Asset inventory with BCS impact and CIP roles.

Supported devices catalog showing what GridShield collects per vendor — What GridShield collects, per vendor — stated honestly.

Asset detail for an SMA Sunny Tripower 60 inverter collected over Modbus: model, firmware and serial number — No agent needed: an SMA Sunny Tripower 60 inverter identified over Modbus, with model, firmware and serial collected by a GridShield Node. Demo site: names and addresses are fictional and the inverter is simulated.

Asset detail for an SEL-751 feeder protection relay: firmware ID, model and serial number read from the relay — An SEL-751 protection relay: its firmware ID and serial read from the relay itself. Demo site: the relay is simulated.

Asset detail for a FortiGate 100F firewall collected over SSH: FortiOS version, model and serial number — A FortiGate 100F read over SSH: FortiOS version, model and serial. Demo site: the firewall is simulated.

Asset detail for an SEL-3530 RTAC collected over DNP3: model, firmware and serial number — An SEL-3530 RTAC identified over DNP3, with model, firmware and serial. Demo site: the RTAC is simulated.

Architecture

Three tiers, all inside your network

Each tier has one job. Nodes keep collecting through link outages and sync when the connection returns.

Every device is collected read-only, by push, or passively. Nodes talk to the Command Center over mutually authenticated TLS.

Tier 1

Command Center

The central application: asset inventory, Evidence Vault, RSAW worksheets, alerts, change and work-order workflows. Runs on-premises; nothing leaves your network.

Asset inventoryEvidence VaultRSAW worksheetsPrivate CA

Tier 2

Node

A site collector placed next to the assets it watches. It polls devices read-only, receives syslog, SNMP traps and NetFlow, and streams evidence to the Command Center over mutually authenticated TLS — caching locally if the link drops.

mTLS gRPC streamLocal cacheSPAN capture (Linux)

Tier 3

Agent (optional)

A lightweight endpoint agent for Windows and Linux hosts that need deeper evidence, such as file-integrity monitoring. Reports to its Node.

Windows serviceLinuxFile integrity

Collection

How GridShield collects evidence

Native OT protocols, standard network and IT management interfaces, and passive monitoring — all read-only.

OT protocols

Modbus TCP (read-only FC3/FC4)
DNP3 (read-only polling)
BACnet/IP
SEL relays
IEC 61850 GOOSE (passive)
OSIsoft PI

Network & IT

SSH
WinRM over HTTPS
SNMP v2c / v3
NETCONF
Firewall REST APIs
Syslog · SNMP traps · NetFlow

Passive monitoring

SPAN / mirror-port capture
Write-command detection
New-device detection
GOOSE replay detection

Security design

Built for the constraints of OT

Safety and isolation come first — in how GridShield collects, how it updates and how it protects evidence.

Read-only by design

Collectors use read functions only. Modbus write codes 5, 6, 15 and 16 and DNP3 select/operate are blocked, and no agent ever issues a control command.

Built for air-gapped sites

Installs from a bootable ISO as a hardened Linux appliance and runs entirely on-premises. Updates arrive as offline packages.

Signed updates, private CA

Updates install only after their GridSafe Ed25519 signature verifies. A built-in certificate authority issues the mTLS certificates every Node and Agent uses.

Tamper-evident evidence

Every record is SHA-256 hash-chained per asset, so any alteration is detectable. The Evidence Vault verifies the chain and exports it for auditors.

High-voltage substation insulators and switchgear

Deployment

From install to evidence in four steps

1
Install
Deploy the Command Center from the ISO inside your environment.
2
Enroll Nodes
Place a Node at each site; it enrolls with the built-in CA and opens an mTLS stream.
3
Connect assets
Add devices and credentials; collection starts on a configurable schedule (default every 5 minutes).
4
Evidence & RSAWs
Evidence lands in the vault, hash-chained, and RSAW worksheets fill in for review.

Compliance

All 14 FERC-approved NERC CIP standards

RSAW worksheets are populated from collected evidence for review by your compliance team. Reference mappings to NIST CSF and IEC 62443 are included.

CIP-002-5.1aBES Cyber System categorization

CIP-003-9Security management controls

CIP-004-7Personnel & training

CIP-005-7Electronic security perimeters

CIP-006-6Physical security

CIP-007-6Systems security management

CIP-008-6Incident reporting & response planning

CIP-009-6Recovery plans

CIP-010-4Configuration change management & vulnerability assessments

CIP-011-3Information protection

CIP-012-2Communications between control centers

CIP-013-2Supply chain risk management

CIP-014-3Physical security (transmission)

CIP-015-1Internal network security monitoring (effective October 1, 2028, U.S.)

Integrations

Fits the tools you already run

Your SIEM

Forward events by syslog in RFC 3164/5424, CEF or LEEF format.

ServiceNow

Raise ServiceNow incidents automatically from GridShield alerts.

Active Directory

CIPStart

Share asset and evidence context with CIPStart, GridSafe's CIP program workspace.

FAQ

Frequently asked questions

Does GridShield write to or control any device?

No. Collection is read-only: Modbus uses read functions only (FC3/FC4) with write codes blocked, DNP3 polling uses READ only with select/operate blocked, and no Node or Agent issues control commands.

Can it run without internet access?

Yes. GridShield installs from a bootable ISO as a hardened Linux appliance and runs fully on-premises. Software updates are delivered as offline packages that install only after their GridSafe Ed25519 signature verifies.

How is evidence protected from tampering?

Each evidence record is hashed with SHA-256 and linked to the previous record for that asset. Altering any record breaks the chain, and the Evidence Vault shows whether the chain verifies.

How often is evidence collected?

Scheduled collection runs every 5 minutes by default and is configurable per task. Syslog, SNMP traps and NetFlow are received in real time, and SPAN capture is continuous on Linux Nodes.

Which devices are supported?

The product ships a catalog of 42 device types — 10 with full support, 27 partial and 5 planned — and states exactly what it collects from each. Ask us for the current list for your fleet.

Does it work with our SIEM and ticketing?

Yes. GridShield forwards events by syslog (RFC 3164/5424, CEF, LEEF) and can raise ServiceNow incidents. Users can sign in with Active Directory / LDAP.

What hardware does the Command Center need?

At least 4 vCPU and 8 GB RAM. Disk depends on how many assets you monitor and how long you keep evidence: measured, it is about 100 GB for 50 assets and 550 GB for 500 assets per year of retained evidence. We size every deployment with you.