NXT GRID — CEA Cyber Compliance Platform

Risk & Vulnerabilities

Cyber risk register, threat catalogue, vulnerability management with SLA timers, mitigation plans, supply-chain and personnel risk (Module 8.5–8.6).

22 of 22

ID	Asset / System	Threat	Category	Likelihood	Impact	Inherent	Residual	Owner	Due	Status
RSK-001	Site Monitoring Workstation	Denial of service against SCADA gateway	Remote Access	Low	Critical	Medium	High	Site OT Team	23 Sept 2026	Mitigation In Progress
RSK-002	Turbine Governor SCADA	Denial of service against SCADA gateway	Personnel	Medium	Critical	High	Low	Information Security Division	06 Oct 2026	Closed
RSK-003	Corporate ERP	Malicious firmware update via compromised vendor channel	New Critical System	High	Low	Medium	High	Vendor Management	01 Sept 2026	Mitigation In Progress
RSK-004	Site Office IT	Man-in-the-middle on unencrypted communication path	New Critical System	Medium	High	Medium	High	CISO Office	16 Sept 2026	Accepted
RSK-005	Hydro Governor Control System	Supply-chain compromise of third-party component	New Critical System	High	Medium	Medium	High	IT Team	08 Sept 2026	Accepted
RSK-006	Security Operations Center Platform	Man-in-the-middle on unencrypted communication path	Remote Operation	Low	Low	Low	Medium	Information Security Division	10 Dec 2026	Accepted
RSK-007	Site Network Gateway	Loss of monitoring visibility due to sensor outage	Remote Access	Critical	Critical	Critical	Critical	IT Team	08 Sept 2026	Open
RSK-008	Turbine Governor SCADA	Unauthorized remote access to control network	Remote Access	Critical	Low	Medium	High	Site OT Team	16 Sept 2026	Accepted
RSK-009	Site Business Systems	Man-in-the-middle on unencrypted communication path	Supply Chain	Medium	High	Medium	Low	Information Security Division	10 Dec 2026	Closed
RSK-010	Security Operations Center Platform	Supply-chain compromise of third-party component	General	High	Low	Medium	High	CISO Office	01 Sept 2026	Open
RSK-011	Site Business Systems	Denial of service against SCADA gateway	Personnel	High	High	High	Low	IT Team	26 Oct 2026	Closed
RSK-012	Site Network Gateway	Unauthorized remote access to control network	IT-OT Interconnection	Low	Low	Low	Low	Vendor Management	06 Oct 2026	Closed
RSK-013	Inverter Control Network	Legacy protocol exploitation (no authentication)	General	Low	Critical	Medium	High	Site OT Team	23 Sept 2026	Mitigation In Progress
RSK-014	Security Operations Center Platform	Supply-chain compromise of third-party component	General	High	Medium	Medium	High	Vendor Management	10 Dec 2026	Mitigation In Progress
RSK-015	Captive DCS	Ransomware propagation from IT to OT	Remote Access	Critical	Low	Medium	High	Information Security Division	23 Sept 2026	Mitigation In Progress
RSK-016	Site ERP Gateway	Loss of monitoring visibility due to sensor outage	Cross-border Data	High	Critical	High	Critical	CISO Office	01 Sept 2026	Mitigation In Progress
RSK-017	DCS — Unit 1-5 Control	Legacy protocol exploitation (no authentication)	Remote Operation	Medium	Critical	High	Critical	CISO Office	08 Sept 2026	Open
RSK-018	Site LAN & File Server	Physical tampering with field device	Remote Operation	Medium	Critical	High	Critical	IT Team	16 Sept 2026	Open
RSK-019	Coal Handling PLC Network	Ransomware propagation from IT to OT	Remote Operation	Medium	Medium	Medium	High	CISO Office	26 Oct 2026	Mitigation In Progress
RSK-020	Site LAN & File Server	Loss of monitoring visibility due to sensor outage	Remote Access	Critical	High	High	Low	IT Team	08 Sept 2026	Closed
RSK-021	Substation RTU Network	Man-in-the-middle on unencrypted communication path	General	Critical	Low	Medium	High	Site OT Team	26 Oct 2026	Open
RSK-022	Identity & Access Management	Denial of service against SCADA gateway	IT-OT Interconnection	Critical	Medium	High	Critical	CISO Office	06 Oct 2026	Mitigation In Progress