Improving Service Efficiency At City Utilities—Springfield, MO

City Utilities serves more than 160,000 customers in the Springfield, Missouri, community, providing electric, gas, water, broadband, and transit services. They are responsible for generating, transmitting, and distributing electric power, as well as acquiring, transporting, and distributing natural gas. The City Utilities service territory covers approximately 320 square miles. Recently, they have started implementing SigmaFlow Beacon to improve service efficiency.

The Challenge

Confronting an error-prone and time-consuming baseline management process.

When Chris Bailey stepped into the role of IT NERC-CIP Project Manager at City Utilities, his first priority was “stopping the madness” of the change management process. To complete change requests, staff were using three separate applications—SharePoint for change management workflows, an in-house application to manage the baseline database, and Tripwire Whitelist Profiler to report on baseline compliance. As a result, the team’s technical resources were consumed by administrative tasks. Each of these tools had separate data sets that needed to be maintained and synced.

SigmaFlow Beacon plays a key role in helping us improve our security controls assessment and baselining.” —Chris Bailey, IT NERC-CIP Project Manager

The automated security controls collected insufficient evidence that required manual work to correct. Small mistakes like missing a space left engineers battling to get clean reports. The process lacked flexibility to accommodate exceptions, which meant Chris frequently had a line at his desk to address issues, and employees consistently reported poor satisfaction around implementing changes. Since these separate systems made it more difficult to collect, correlate, and produce evidence, they also put City Utilities at risk of non-compliance. Chris not only needed to replace these disparate data sets with a unified view of his environment’s baselines but also to establish process controls enabling his team to work efficiently.

The Solution

SigmaFlow Beacon: A purpose-built baseline monitoring tool with everything in one place.

With the SigmaFlow platform, City Utilities centralized their workflows, documentation, and evidence into a coherent system. Adding Beacon created an all-in-one comprehensive monitoring and management solution. Chris and the City Utilities team especially appreciate Beacon’s secure scan feature. With Beacon’s architecture, all communications are initiated from the secure zone outward, while retaining the responsiveness to get the latest data within minutes. The team can perform scans within a workflow without logging into a separate Beacon interface.

Because SigmaFlow Beacon shows software and port exceptions by age, with color-coding that lends a degree of importance and urgency, the team can identify exactly what might be taking them out of compliance. City Utilities also uses API integrations with SigmaFlow to aggregate security control information—like system events, associated verification procedures, device configurations, removable media usage, and security alert responses—directly into their change management workflows.

The Results

Less complexity, streamlined workflows, and improved compliance.

Thanks to SigmaFlow Beacon, City Utilities was able to eliminate the complexity of working with three separate systems to complete their change requests. Tripwire, in particular, had been time-consuming to maintain, and the system was not optimized for their CIP compliance use case. City Utilities now has a single system that’s the right size for their needs and more efficient, with a common interface to seamlessly provide everything they need to achieve compliance. That means a better user experience for staff. With one consolidated, organized way to keep track of their change management, the team can free up their time from unnecessary administrative tasks and manual processes. They’re able to more quickly find exceptions and retrieve any evidence they may need to demonstrate compliance.