Managed services for the oil and gas industry: IT, OT security and cloud operations

Why oil and gas IT is harder than most industries

Remote, distributed assets

Upstream assets sit offshore or far from towns, linked by satellite or radio. Monitoring has to work on thin, high-latency links, and a site visit can mean a helicopter. Remote management, local caching and clear escalation paths matter more than in an office estate.

IT and OT have converged

Historians, SCADA servers and engineering workstations now connect to corporate networks and the cloud for analytics. That connection is where many attacks cross over. Our explainer on IT/OT convergence covers the basics.

Safety comes before availability, and availability before confidentiality

In OT you cannot reboot a controller to apply a patch on a Tuesday. Changes follow management-of-change processes, maintenance windows and vendor approvals. An MSP has to work inside those rules.

Downtime is expensive, and its cost moves with the oil price

Siemens' True Cost of Downtime 2024 report finds that the cost of a lost production hour in oil and gas rises and falls with the oil price, and peaked at record levels in 2022. Either way, outages in production systems cost far more than the IT budget that prevents them.

Critical infrastructure regulation

Energy is a critical sector everywhere. The US agency CISA describes the energy sector as "uniquely critical" because every other sector depends on it. In the EU, NIS2 applies (see below).

OT security: what to expect from a managed service provider

OT security is where generic MSPs fall short. Ask how the provider applies these practices from NIST SP 800-82 Rev. 3 and IEC 62443:

• Asset inventory first. You cannot protect controllers, HMIs and historians you have not listed. Use passive discovery on OT networks; active scanning can crash older devices.
• Zones and conduits. Separate OT from IT with a demilitarised zone, and control every path between them. IEC 62443 organises this as zones and conduits, and part 3-3 sets system security requirements and security levels.
• Secure remote access. Vendor and engineer access goes through a jump host with MFA, session recording and time-limited approval, never through a flat VPN.
• OT-aware monitoring. Network detection that understands industrial protocols, with alerts sent to a SOC that knows not to "contain" a safety system.
• Patch and backup by risk. Patch OT Windows servers in planned windows; where patching is impossible, compensate with segmentation and allow-listing. Keep tested, offline backups of controller logic and configurations.
• Shared responsibility in writing. IEC 62443 is built on shared responsibility between asset owners, integrators and product suppliers. Put the MSP's role in the RACI.

For a deeper walk-through, read our NIST SP 800-82 OT security guide and our article on OT security in energy, power, oil and gas.

NIS2 duties for oil and gas operators in the EU

NIS2 (Directive (EU) 2022/2555) lists energy as a sector of high criticality in Annex I. Under oil, it names operators of oil transmission pipelines, operators of oil production, refining and treatment facilities, storage and transmission, and central stockholding entities. Under gas, it names supply undertakings, distribution and transmission system operators, storage and LNG system operators, natural gas undertakings, and operators of natural gas refining and treatment facilities.

For in-scope companies this means:

• Article 21 measures, including risk analysis, incident handling, business continuity (backup management, disaster recovery, crisis management), supply chain security, vulnerability handling, cyber hygiene and training, cryptography, access control and multi-factor authentication.
• Article 23 reporting: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of that notification.
• Article 20 governance: management bodies must approve the measures, oversee them and can be held liable.

Supply chain security (Article 21(2)(d)) covers your MSP too. Expect to assess the provider and to have NIS2 duties reflected in its contract. Our NIS2 overview explains the rest of the directive.

Predictive maintenance and remote monitoring

Predictive maintenance uses vibration, temperature, pressure and flow data to spot failing pumps, compressors and turbines before they trip. It is one of the few digital projects with well-documented returns. The US Department of Energy's Operations & Maintenance Best Practices guide (PNNL-19634) cites industry surveys showing these average results from a functional predictive maintenance programme:

The figures are survey averages across industries, not guarantees. The managed-services part is everything that keeps the programme working: reliable data collection at remote sites, an edge or cloud platform for the models, alert routing to maintenance teams, and security on the path from sensor to cloud. See our IoT predictive maintenance service for how we set this up.

How to choose a managed services partner in oil and gas

• OT experience: Ask for references in process industries and how they handle change control on OT systems.
• Standards: Ask how their service maps to IEC 62443 and NIST SP 800-82, and whether staff hold relevant training.
• Security operations: 24/7 SOC coverage, OT-aware detections, and incident response that can meet a 24-hour NIS2 early warning.
• Remote-site design: Monitoring and patching that work over satellite and backup links.
• Data residency and access: Where logs and data are stored, and who at the provider can reach your OT networks.
• Operating model: A clear RACI between your control engineers, the OT vendor and the MSP; co-managed is common.
• Exit: Documentation, credentials and configurations handed back if you change provider.

How Opsio helps

Opsio runs managed cloud, security and operations on AWS and Azure from Karlstad, Sweden, and Bangalore, India. For industrial operators, our services cover cloud and data platforms, monitoring, SOC services, NIS2 readiness and security at the IT/OT boundary, working alongside your control engineers and OT vendors rather than replacing them.

We have not published an oil and gas case study. The closest operating model is Opus Bilprovning, a Swedish vehicle inspection company with nearly 100 stations from Kiruna to Malmö and around two million inspections a year. Opsio provides 24/7 managed CloudOps, DevOps and SecOps for its AWS estate, with one accountable team across all sites.

Frequently asked questions

What are managed services in the oil and gas industry?

They are outsourced, ongoing operation of an operator's IT, cloud, security and sometimes OT systems by a provider under a service agreement, typically covering monitoring, support, patching, backup, security operations and connectivity for offices, plants and remote sites.

Do NIS2 rules apply to oil and gas companies?

Yes, for in-scope EU entities. NIS2 Annex I lists oil pipeline operators, oil production, refining, treatment, storage and transmission operators, central stockholding entities and most gas operators. Size thresholds and national laws decide which companies are covered.

Which standards apply to OT security in oil and gas?

The most used are the ISA/IEC 62443 series for industrial automation and control systems and NIST SP 800-82 Rev. 3, the NIST guide to OT security. Many operators also align with ISO/IEC 27001 for IT.

Can OT systems run in the cloud?

Control loops and safety systems stay on site. Historians, analytics, predictive maintenance models, reporting and backups of OT data commonly run in the cloud, connected through a segmented, monitored IT/OT boundary.

How do managed services reduce costs for oil and gas operators?

Mainly by preventing downtime through monitoring and predictive maintenance, consolidating IT and cloud operations, and replacing hard-to-hire specialist roles with a shared 24/7 team. The savings depend on your starting point, so ask for a baseline assessment.

Related reading: Mastering Inventory Management for Oil and Gas Businesses.