Architecting OT Security at TREFOR

Welcome to Insights from an Expert, a series where we hand the microphone to some of our top-tier IT specialists and let their real-world expertise take center stage.

You will gain the type of knowledge that comes from years on the ground: what works, what does not, and which emerging areas deserve your attention as you prepare for the future.

In this article, you will gain insights from 7N consultant Jørgen Letager Hansen about how he supported TREFOR, one of Denmark’s key utility companies, in establishing a more robust, compliant, and future-ready OT network architecture. His solution was developed in close collaboration with TREFOR’s internal IT architects and cybersecurity specialists, with today’s threat landscape and the people who operate it daily in mind.

THE CHALLENGE

Securing critical operations

To support stable distribution, TREFOR set out to strengthen the backbone of its electricity operations by modernizing its OT environment and creating a clearer separation from IT.

The business goal was straightforward: keep critical operations running, even if parts of the broader network come under pressure. In practice, that meant ensuring the OT network could function in island mode during incidents, while remaining practical for less technical staff to manage in time-sensitive situations. The effort spanned all major substations and required coordination across internal teams and external suppliers – not to replace TREFOR’s people, but to give their own IT, security, and operations teams a stronger foundation, aligned decisions, and a plan they could own going forward.

At the same time, the work was shaped by increasing external pressure, including evolving geopolitical risks and tightening regulatory requirements such as NIS2, as well as the need to refresh aging infrastructure.

THE SOLUTION

Design for isolation and control

As Senior Security Architect and trusted advisor to the client, Jørgen worked in close collaboration with TREFOR’s internal IT architects and cybersecurity specialists to review and refine supplier network designs to ensure that the proposed architecture would meet TREFOR’s operational needs, without exceeding what was required in terms of cost or technical complexity.

Jørgen’s work centred on translating TREFOR’s internally defined security and business needs into clear, implementable requirements, while promoting strong alignment across internal stakeholders and external vendors. Acting as a facilitator and quality assurer, Jørgen helped ensure that individual design choices fit into a coherent overall architecture that reflected TREFOR’s long‑term operational reality.

In close collaboration with TREFOR’s own IT specialist, Jørgen was also involved in designing a network structure that allowed TREFOR to quickly isolate compromised network segments. By enabling technicians to physically separate areas within minutes, the system can maintain continued grid operation even during cybersecurity incidents. The design prioritizes usability, allowing on-site teams to act quickly without waiting for specialized IT support.

“The solution was designed with our daily operations in mind. It gives us the ability to act fast during incidents, keep critical systems running in island mode, and avoid unnecessary complexity or over-engineering,” TREFOR elaborates on the solution provided by Jørgen and the team.

As part of the joint architecture effort, Jørgen’s key contributions included:

Reviewing and validating supplier network designs to ensure they meet operational needs and support OT/IT separation.

Designing the IT/OT segmentation and island‑mode model, ensuring the OT network can run independently during incidents.

Optimizing capacity and hardware requirements across 60 kV substations and key 10kV stations, preventing over‑engineering and unnecessary spending.

Coordinating requirements across project management, internal IT, suppliers, security leadership, and business owners, ensuring a unified architectural direction.

Delivering clear architectural documentation and six aligned subproject packages, enabling vendors and internal teams to implement the design efficiently.

THE IMPACT

A resilient OT foundation

The project has strengthened TREFOR’s OT security posture and provided a clear architectural direction for future enhancements. While the implementation of some elements continues, the organization now has a cohesive design, alignment across all stakeholder groups, and robust documentation that enables efficient vendor execution.

Most importantly, TREFOR is now better prepared to operate safely and independently in the event of a cybersecurity incident, due to a network architecture purpose‑built for isolation, resilience, and regulatory readiness. The result is a stronger foundation that TREFOR’s internal teams can continue to build on and evolve over time.

“We now have a clear and coherent OT network architecture that strengthens our security posture and supports resilient operations. It gives us confidence that we can maintain grid operations during a cyber incident and continue evolving the solution over time,” TREFOR explains, highlighting the importance of a coherent OT architecture for maintaining resilient operations during cyber incidents.

The insights from expert Jørgen Letager Hansen, in the role of Senior Security Architect and trusted advisor, highlighted how matured cybersecurity and a future-ready network foundation can strengthen operational resilience.

As part of our Insights from an Expert series, it reflects the kind of real-world knowledge that shapes smarter decisions and stronger digital futures.