At 02:40 on a weeknight, the security team at a regional electricity distribution operator spots suspicious activity on a corporate server and isolates the corporate network as a precaution. The control room keeps its telemetry from the substations. It loses email, Microsoft Teams and the dispatch system, and fourteen field engineers are on shift across the region.
Alerting field engineers during a control room outage depends on work done beforehand: a channel that sits outside the systems the operator may have to switch off, instructions agreed before the night they're needed, and a way to see which engineers have confirmed them.
Alerting field engineers during a control room outage only works if it was planned. The channel can't depend on the corporate network, the first instructions should already be written and approved, and the control room has to see who has acknowledged them before it relies on anyone acting.
What Is Alerting Field Engineers During A Control Room Outage?
Alerting field engineers during a control room outage means getting an instruction to every engineer on shift when the control room's normal tools are unavailable. The cause might be a cyber incident, a failed dispatch system or a deliberate isolation of the corporate network. The job doesn't change: reach each engineer, and know they have the message.
Most utilities send work to engineers through a dispatch system, email, Teams and calls from the control room, and each can depend on the corporate network. When that network is cut, an engineer in a van at a substation has no way of knowing anything has changed. So they carry on with the planned job.
Why Does Isolating Corporate IT Affect A Control Room That Runs On OT?
Isolating corporate IT affects the control room because operational technology (OT) and the tools around it are rarely as separate as the network diagram suggests. Telemetry may keep running while the systems that turn it into work for people, such as dispatch, email, rosters and the phone directory, sit on the corporate side and go dark.
It's a common assumption that an IT incident leaves operations alone because supervisory control and data acquisition (SCADA) runs on its own network. The control engineer can still see every feeder. What they've lost is the means to tell anyone about it.
Version 4.0 of the National Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF) expects an incident response plan to be integrated with dependencies on supporting infrastructure, and back-up mechanisms that can be readily activated if primary systems fail. For alerting field engineers during a control room outage, the route to the field is that kind of dependency.
What Is Out-Of-Band Communication For Utilities?
Out-of-band communication for utilities is a way of reaching staff that doesn't run through the corporate network or the tools an incident may have taken down. For alerting field engineers during a control room outage, that usually means text messages and voice calls to mobiles from a separately hosted service, plus operational radio where the operator has it.
The NCSC's guidance on effective communications in a cyber incident, published in October 2024, says an organisation's usual communications channels may not be available during an incident, and suggests alternatives such as phone lines and messaging apps. It also recommends drafting pre-approved templates for internal updates in advance.
Regulation points the same way. The UK's Network and Information Systems Regulations 2018 cover electricity, oil and gas operators above set thresholds. The EU's NIS2 Directive treats energy as a sector of high criticality, and its Article 21 lists "secured emergency communication systems within the entity, where appropriate" among the minimum cybersecurity risk-management measures, which Member States were due to apply from 18 October 2024.
That summary is as at October 2026, and it's orientation, not legal advice. Operators in other regions should check what their own regulator expects.
Which Channels Still Work When The Corporate Network Is Isolated?
The channels that keep working when the corporate network is isolated are the ones hosted and delivered outside it: text messages, voice calls to mobiles and, in many control rooms, operational radio. Email, Microsoft Teams and any dispatch system that relies on corporate sign-in should be treated as unavailable until the security team says otherwise.
The table compares the usual ways of alerting field engineers during a control room outage: what each one depends on, what happens to it during an IT isolation, and whether it shows who has the message.
| Channel | What It Depends On | During An IT Isolation | Shows Who Has The Message? |
|---|---|---|---|
| Email and Microsoft Teams | Corporate accounts and sign-in | Unavailable, or not trusted if accounts may be compromised | Read receipts at best |
| Dispatch or work management system | The corporate network and its servers | Usually unavailable | Only while it is running |
| Calls from the control room | Desk phones or mobiles, and a contact list | Works from mobiles, one call at a time | Yes, one engineer at a time |
| Operational radio | The radio network and its coverage | Works unless it shares the corporate network | Only if the engineer replies |
| Separately hosted alerting platform | Mobile networks and an up-to-date contact list | Sends text and voice alerts as normal | Records delivery and acknowledgement |
Anything that signs in through the corporate network goes down with it. Whatever replaces it for alerting field engineers during a control room outage has to be set up, tested and holding current numbers before it's needed.
What Does Contacting Engineers During An OT Cyber Incident Look Like?
Contacting engineers during an OT cyber incident starts with one short instruction to everyone on shift, sent on a channel outside the corporate network. Then the control room checks who has acknowledged it and calls the ones who haven't. The control engineer owns the instruction. A second person should own the sending and the chasing.
Instructions Agreed In Advance
Nobody writes a clear instruction at 02:45 with a phone in each hand. The NCSC advises writing templates in advance, so a control room can draft and approve its field versions on a quiet afternoon. A field instruction needs five things:
- what has happened, in one sentence, with no guess at the cause
- what the engineer should do now: carry on, stop and make safe, or hold position
- what not to do, such as connecting a laptop to any network
- how to confirm they've received it
- when the next update will come, and how
The First Hour, Step By Step
Here's the opening scene again, with the preparation done.
- 02:40. The security team isolates the corporate network and tells the duty control engineer.
- 02:45. The control engineer picks the agreed "stop non-urgent work and wait for instructions" message. A colleague sends it to all fourteen engineers by text and voice call.
- 02:52. Eleven engineers have acknowledged. Three haven't.
- 02:55. The three are called directly, on their mobiles or by radio.
- 03:15. A conference call opens for engineers on live faults, and the next update goes out on time.
- Next morning. The record shows who was told what, and when, ready for the incident review.
How Does Crises Control Help Control Rooms Reach Field Engineers?
Crises Control helps control rooms reach field engineers through Ping, its Emergency Communication Software, which runs in the cloud, separate from the operator's own network. One message goes to every engineer on shift by text, voice call and the other configured channels, and Ping records who has received it and who has acknowledged it.
Ping sends a notification across SMS, voice calls, email, push notifications, Microsoft Teams and web alerts. In an IT isolation, email and Teams may be gone, so text and voice carry the message. Ping can cascade through channels until an engineer acknowledges, timestamps every delivery and acknowledgement, and can target a single site, a department or an on-call rota.
Incident Manager holds predefined response plans with saved message templates and recipient groups, which is where the agreed field instructions belong. From the Crises Control app, a duty manager can send Ping messages and set up a conference call bridge. As Energy Incident Management Software, the platform keeps every alert, acknowledgement and action in one record.
Some things stay with the operator. The platform only reaches the numbers it holds, so someone has to keep the engineer and contractor list current. The app needs an internet connection and texts need mobile signal, so sites with poor coverage still need radio or a set check-in time. Senders must be able to sign in without the corporate network, which is worth testing now. And the control engineer still decides what the instruction says.
Readypower Group, a rail and infrastructure services provider, had at times used WhatsApp to update field employees and found it unavailable when users had connectivity problems. Its case study describes how it now sees who hasn't acknowledged a message and notifies them again.
Field Engineer Alerting Checklist
This checklist turns alerting field engineers during a control room outage into eight things a control room can check this month.
- Engineer and contractor mobile numbers are held outside the corporate network and refreshed on a set schedule.
- Agreed instructions exist for "stop and make safe", "carry on with caution" and "hold position", each approved by the head of network operations.
- At least two people on every shift can send, and neither needs the corporate network to sign in.
- Every instruction asks for an acknowledgement, and one person is named to chase the engineers who don't reply.
- Sites with poor mobile coverage are listed, with radio or a set check-in time as the fallback.
- The incident response plan lists the field alerting channel as a dependency.
- Every message says when the next update will come.
- The plan has been run once as a night-shift drill, with email, Teams and dispatch treated as unavailable.
Telemetry Shows The Network, Not The People
An IT isolation at 02:40 can leave a control room able to see every substation and unable to reach the people standing next to them. Telemetry tells the control engineer what the network is doing. It doesn't say whether fourteen engineers know anything has changed.
Closing that gap is cheap to set up on a quiet afternoon. It takes contact details the incident can't reach, instructions approved in advance and a channel that shows who has confirmed them. None of it needs the corporate network.
A head of network operations can test this before winter. Pick a night shift, treat email, Teams and dispatch as gone, and try to get one instruction to every engineer on shift. If every acknowledgement comes back within the time the plan allows, the control room has its answer to alerting field engineers during a control room outage. If it doesn't, the checklist above shows what's missing.
For the wider picture, read our guide to the coordination gaps in utility incidents, or see how Ping handles acknowledgement and escalation.
Frequently Asked Questions
What is out-of-band communication in a utility?
Out-of-band communication in a utility is any way of reaching staff that doesn't travel over the corporate network or the tools that depend on it. Text messages and voice calls to mobile phones, sent from a separately hosted service, are typical examples, and operational radio is another. It matters because it still works after the security team has isolated corporate IT.
Is emergency communication software the same as a dispatch system?
Emergency communication software isn't the same as a dispatch system. A dispatch system allocates planned and reactive work to engineers, while emergency communication software sends one urgent message to many people and records who acknowledged it. During an IT isolation the dispatch system may be offline, and that's when a separately hosted alerting tool earns its place.
What should a field instruction say during a cyber incident?
A field instruction during a cyber incident should say what has happened, what the engineer must do now, what they must not do, how to confirm receipt and when the next update will come. It shouldn't guess at the cause or the restoration time, because anything said early may have to be withdrawn later. The National Cyber Security Centre (NCSC) recommends writing pre-approved templates for internal updates before an incident.
Do the NIS rules require an emergency communication system for energy operators?
As at October 2026, the EU NIS2 Directive lists secured emergency communication systems within the entity, where appropriate, among its minimum cybersecurity risk-management measures, and energy is one of its sectors of high criticality. In the UK, the Network and Information Systems (NIS) Regulations 2018 cover electricity, oil and gas operators above set thresholds, and the National Cyber Security Centre's Cyber Assessment Framework (CAF) expects back-up mechanisms that can be readily activated. Each operator should check how its own regulator applies these rules.
How does Crises Control help control rooms reach field engineers?
Crises Control helps with alerting field engineers during a control room outage through Ping, which runs in the cloud, separate from the operator's own network. Ping sends one message by text, voice call, push notification and other configured channels, and records each delivery and acknowledgement with a timestamp. The energy and natural resources page shows how the platform is used across sites.
This article was drafted with AI assistance and reviewed by the Crises Control team. Featured image: AI-generated.
