Fortress Information Security — Quarterly Briefing

Within the Walls

At Fortress, everything we build is focused on helping you succeed.

In Q1, we began harnessing the speed and scale of AI to rebuild the Fortress Platform from the ground up as an AI-native system, purpose-built for third-party risk management, cyber supply chain security, vulnerability management, and GRC.

While others are layering AI onto legacy platforms, we are building for it from the start, with a focus on delivering a seamless experience and minimizing disruption for our customers.

At the same time, we are focused on helping you better communicate the value of your program, connecting your activities to measurable outcomes, including dollar-based risk reduction and return on investment.

Our commitment is to identify, deliver, and communicate value so your program's impact is clearly understood and realized across your organization, without you having to carry that burden alone.

Here's to a great Q2 ahead!

Ty Short

COO · Fortress Information Security

Safety Minute

Real Examples of Social Engineering (and what they teach us)

Most scams today don't start with hacking; they start with a conversation. Social engineering targets your emotions. Knowing how it works is your best defense.

Example 1

Coffee Shop Tax Scam

A young employee was told the business owed back taxes and had to pay $2,000 immediately or:

The shop would be shut down
Employees would be jailed
She was not allowed to contact anyone

She panicked and sent the money.

What was happening

Urgency + fear: "pay now or jail"
Isolation: "don't contact anyone"
Authority impersonation: posing as government/tax officials

Example 2

Fake Jury Duty Warrant

A man was told:

He missed jury duty and had two warrants
He had "signed" for a summons (they even sent a fake document)
If he went on federal property, he'd be arrested
He had to stay on the phone and not tell anyone
He could "fix it" by paying $3,500 for signature analysis

He suspected something was off, hung up, and went to the Sheriff's office. They confirmed: completely fake.

What was happening

Authority + realism: fake warrant, real address
Fear of legal consequences
Control tactics: stay on the phone, don't talk to others
Payment to "fix" a problem immediately

The Pattern Behind Both Scams

Even though the stories are different, the core tactics are identical:

Urgency
"Act now or something bad will happen."
Fear
Jail, fines, shutdowns, legal trouble
Isolation
"Don't tell anyone" / "Stay on the phone"
Fake Authority
Government, law enforcement, IRS, courts
Immediate Payment
Gift cards, wire transfers, or unusual payment methods

The Most Important Rule

If you are being pressured and money is involved, it is almost certainly a scam.

If you get a call like this

Pause. Real problems don't require instant payment over the phone.
Hang up immediately.
Do not send money.
Look up the official number yourself (not the one they gave you)
Call the organization directly
If unsure → go in person (like the Sheriff's office example)

Scammers don't hack your computer, they hack your emotions. If someone is rushing you, scaring you, and asking for money while telling you not to talk to anyone… that's the scam. If this could happen to them, it could happen to anyone, share this with your family.

Industry & Regulatory Highlights

At its February 19, 2026, open meeting, FERC approved five new NERC reliability standards governing inverter-based resources (IBRs) — solar, wind, and battery storage systems that use power electronics to convert DC to AC. These standards directly respond to FERC Order No. 901 (October 2023), which directed NERC to develop comprehensive IBR reliability standards over three years
Standards address IBR data sharing, model validation, and ride-through capability during grid disturbances
Large-scale IBR tripping during grid disturbances is a demonstrated systemic risk; new rules close this gap
Transmission owners and asset operators must audit IBR data, model accuracy, and inverter ride-through settings
ISOs/RTOs must update interconnection study processes and dynamic planning models
Non-compliance enforcement will follow implementation timeline, however utilities should begin gap assessment immediately

FERC approved a revised definition of "control center" in the NERC Glossary, closing longstanding ambiguity that allowed some facilities performing real-time grid monitoring and control functions to escape high-impact CIP classification and the stronger protections that come with it
The revised definition directly affects utilities with distributed control architectures, backup control centers, remote operations centers, and cloud-hosted SCADA or EMS platforms - any of these may now qualify as a control center under the updated standard and require reclassification to high or medium impact
All utilities must re-evaluate their CIP-002 asset inventories against the revised definition at their next scheduled categorization review - prior classifications should not be assumed to remain valid without a fresh assessment against the new language
NERC regional entities are expected to treat the revised definition as an audit focus area in upcoming compliance monitoring cycles - utilities that have not proactively reclassified qualifying assets face elevated enforcement risk

FERC approved 11 updated CIP standards enabling secure use of virtualization and cloud-based technologies, removing the compliance barrier that has forced utilities to maintain costly, outdated hardware to remain compliant
The rule shifts from rigid, hardware-specific requirements to objective-based security criteria, giving utilities flexibility to modernize grid technology infrastructure without sacrificing compliance standing
Utilities planning virtual or cloud-based deployments for grid-adjacent systems should immediately assess which projects were previously blocked by CIP compliance concerns and can now move forward
NERC will develop new audit procedures for virtual environments over the next 12-18 months - compliance teams should update internal CIP programs now to reflect objective-based assessment rather than hardware-checklist approaches

FERC finalized new mandatory cybersecurity controls for low-impact BES Cyber Systems - the largest and historically least-protected tier of the CIP asset population - requiring remote user authentication protocols and intrusion detection for externally connected systems
Low-impact systems have represented a known and exploited gap in CIP protections; threat actors have used poorly secured remote access points at smaller substations and remote facilities as entry paths to higher-impact environments
Utilities must audit all remote access mechanisms for low-impact systems against the new authentication requirements - vendor remote access to remote substations and smaller facilities is expected to be the most common area of non-compliance
Intrusion detection for low-impact systems is the more complex implementation challenge; utilities should design their monitoring solution with the broader CIP-015-1 INSM framework in mind rather than building a standalone point solution for this requirement alone

H.R. 7266

Rural & Municipal Utility Cybersecurity Act

Passed out of the House Energy & Commerce Committee unanimously on March 5, 2026. This bipartisan bill reauthorizes the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program and authorizes $250 million over five years to help rural co-ops and small municipal utilities deploy advanced cybersecurity technologies and participate in threat information-sharing programs.

H.R. 7272

Pipeline Cybersecurity Preparedness Act

Sponsored by Reps. Randy Weber (R-TX) and Debbie Dingell (D-MI) and advanced out of the House Energy & Commerce Committee on March 5, 2026, this bill directs the Department of Energy to establish policies, procedures, and programs to enhance the cyber and physical security of the nation's pipeline infrastructure, in consultation with federal agencies and industry stakeholders.

H.R. 7305

Energy Threat Analysis Center (ETAC) Expansion

Sponsored by Reps. Laurel Lee (R-FL) and Greg Landsman (D-OH) and cleared the House Energy & Commerce Committee on March 5, 2026, this bill expands DOE's organizational mandate to formally assign energy emergency and security functions, including cybersecurity, infrastructure resilience, emerging threats, and emergency response.

CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) is a 2022 federal law requiring critical infrastructure entities across 16 sectors to report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hour
The current deadline is set for May 2026, pushed back from the original October 2025 statutory date. However, town halls scheduled to gather industry feedback were cancelled due to the government shutdown and have not yet been rescheduled. Until that feedback is collected, CISA is unlikely to meet the May deadline, making further delay into late 2026 the more probable outcome.

What you should be doing now?

Build a 72-hour reporting capability using pre-drafted templates, legal/IR escalation paths, and a clear internal decision tree for "substantial" determinations
Integrate CIRCIA reporting into existing NIST CSF/SOAR workflows
Inventory ransom payment processes now; the 24-hour window requires pre-defined approval chains
Track the final rule, as scope and definitions could significantly change your obligations
Engage legal counsel on privilege/protection mechanics before relying on them

Threat Intel Updates & Highlights

What we saw this quarter.

157

Cybersecurity incidents affecting the US critical infrastructure supply chain, identified by Fortress during Q1.

32Data breachesVarying from ransomware to data exposures.

4Vendor breach surveysBreach-outreach surveys sent to affected vendors.

12Critical vulnerabilitiesRollup updates & critical-severity vulnerabilities in US CI supply chains.

113Threat activityIncidents targeting organizations within US CI supply chains.

5,216

Across All Industries

Overall, Fortress observed 5,216 cybersecurity incidents across all industries during Q1 — the full-spectrum backdrop against which supply-chain risk is now measured.

Industrial energy infrastructure at night — Threat FocusIranian-aligned prepositioning against US energy & defense infrastructure.

Iranian cyber threat

E-ISAC reported warnings of reconnaissance from Iranian IP addresses.
US medical technology company Stryker breached; a wiper was deployed across the company.
Several US government-affiliated vendors breached, including Lockheed Martin.

Iranian-aligned prepositioning for destructive operations

Ongoing conflict is pushing Iran to commit cyber-offensive operations.
Kinetic strikes against Iranian critical infrastructure — including energy — are leading to reciprocal attacks.
Recent large-scale supply-chain attacks (Trivy, Axios) have caused credential leakage.
Credential harvesting, phishing, attack-surface mapping, and third-party compromise can give Iran initial access to ICS/OT devices within US energy.
Iran has demonstrated the ability to abuse corporate administrative tools to deploy wiper commands across an entire company.
As the US threatens the Iranian energy sector, Iran may reciprocate by cyberattacking US and allied energy infrastructure.

Fortress Platform Updates

Recertification Module

Our risk ranking process has had a major facelift empowering users to easily manage risk ranks and their recertifications in one centralized view. Recertify, reassign, or create new risk ranks enabling faster decisions and complete visibility into your vendor portfolio.

Check out our interactive demo to see how it works!

Recertification Module — risk rank management view

Vendor Performance Management Module

Proactive Vendor Oversight & Accountability

Monitor vendor performance beyond risk scores with centralized tracking of SLAs, incidents, and custom KPIs. Automate performance reviews and identify underperforming vendors before they become critical issues. Transform vendor management from reactive firefighting to proactive partnership optimization with the data needed to drive accountability and smarter renewal decisions.

Vendor Performance Management Module — performance dashboard

Enhanced Navigation & Productivity

We've refined the everyday interactions that make your workday smoother. Browser tabs now display descriptive page titles instead of generic labels, enabling effortless switching between workflows. Tab badges intelligently show only "open" items requiring attention, filtering out completed work. Notification emails now include custom fields with readable labels instead of cryptic IDs.

These refinements eliminate daily frustrations, helping your team navigate faster and work more confidently across the platform.

Client Success Story

Safeguarding SLAs with Automatic SBOM-to-DDPA Conversion

A Fortress client who actively leverages Software Bill of Materials (SBOMs) and Data Driven Product Assessments (DDPAs) was experiencing delays in receiving vendor files required to complete SBOM reviews. To stay on track with internal service level commitments, the client refined their workflow to automatically convert an SBOM request into a DDPA if the necessary file is not received within 48 hours.

SBOM reviews depend on timely delivery of vendor provided component lists. When those files arrive late, or not at all, review queues stall, and teams risk missing SLA timelines. The client needed a way to preserve decision grades without being gated by supplier response times.

The client instituted a 48-hour escalation rule: if an SBOM file hasn't been received within two business days, the request auto converts to a DDPA. DDPAs provide rapid, open source, product level risk intelligence, evaluating ~65 security controls across categories such as vulnerability response, patching cadence, and disclosure processes—delivered on a short turnaround.

The client plans to expand the policy with notification workflows that alert vendors when a request is approaching the 48-hour threshold, plus reporting dashboards to monitor conversion rates, cycle time, and SLA performance. This continuous improvement loop will further streamline intake and ensure high quality, time-bound evaluations across their portfolio.

Within the Walls

In This Edition