A Vulnerability Governance Architecture for Power and Utilities Corporations: From Exposure Mapping to Remediation Verification
Abstract
Vulnerability management in power and utilities corporations is constrained by the long lifecycles of operational technology assets, the limited availability of vendor patches, regulatory expectations for documented remediation, and the practical impossibility of taking many control system components offline for maintenance on demand. This paper presents a governance architecture that organizes vulnerability handling from initial exposure mapping through to verified remediation across both information technology and operational technology environments. The architecture is structured around six interlocking domains. Asset and exposure inventory establish the canonical map of cyber assets and the vulnerabilities affecting them. Risk scoring and prioritization combines the Common Vulnerability Scoring System, the Exploit Prediction Scoring System, asset criticality, compensating controls, and operational impact considerations to produce a defensible action queue. Remediation orchestration coordinates patching, configuration hardening, virtual patching at the network layer, and procedural compensations. Verification confirms that intended changes took effect without unintended consequences. Reporting communicates posture to executive and regulatory audiences. Continuous improvement closes the loop through metrics and after-action reviews. The architecture aligns with the North American Electric Reliability Corporation Critical Infrastructure Protection standards on configuration change management and vulnerability assessment, with the National Institute of Standards and Technology Special Publication 800 40 on patching, and with the Department of Energy cybersecurity capability maturity model. The paper presents three illustrative scenarios spanning routine patching of corporate endpoints, emergency response to an exploited industrial control system vulnerability, and structured deferral of a low risk operational technology vulnerability with documented compensating controls. The proposed governance architecture supports both compliance reporting and substantive risk reduction.
Keywords
vulnerability management; governance; power and utilities; operational technology; NERC CIP; CVSS; EPSS; remediation.
References
Abdallah, A., Maarof, M.A. and Zainal, A. (2016). Fraud detection system: A survey. Journal of Network and Computer Applications, 68, 90 to 113. Ackerman, P. (2017). Industrial Cybersecurity: Efficiently Secure Critical Infrastructure Systems. Packt Publishing, Birmingham. Adebayo, A. (2020). Wireless internet service provider network reliability frameworks for emerging markets. International Journal of Network and Communication Research, 5(2), 88-103. Tizeti Inc., Nigeria. Adebayo, A. (2021a). Network access control patterns for distributed wireless internet service deployments. International Journal of Information Security Research, 11(4), 215-232. Tizeti Inc., Nigeria. Adebayo, A. (2021b). Secure last-mile connectivity architectures for Sub-Saharan African internet service providers. Journal of African Information Systems, 12(3), 145-162. Tizeti Inc., Nigeria. Adebayo, A. (2022a). Compliance frameworks for financial technology platforms operating across multiple jurisdictions. International Journal of Regulatory Technology, 6(3), 134-152. Squad, Nigeria. Adebayo, A. (2022b). Fintech payment infrastructure security: Threat modeling for high-volume transaction processing platforms. Journal of Financial Technology Security, 8(2), 198-217. Squad, Nigeria. Adebayo, A. (2023a). Cybersecurity workforce development through applied research curricula: A case study approach. Journal of Cybersecurity Education and Research, 14(2), 78-95. East Tennessee State University, Tennessee, USA. Adebayo, A. (2023b). Network defense practices in small and medium enterprises: Empirical observations from regional case studies. International Journal of Enterprise Security, 9(4), 245-263. East Tennessee State University, Tennessee, USA. Adebayo, A. (2024). Threat detection capability assessment for resource-constrained organizations: A maturity model approach. Journal of Information Security Practice, 17(3), 312-329. East Tennessee State University, Tennessee, USA. Adepu, S., Brasser, F., Garcia, L., Rodler, M., Davi, L., Sadeghi, A.R. and Zonouz, S. (2020). Control behavior integrity for distributed cyber physical systems. ACM/IEEE ICCPS 2020. Adesanya, O. S., Okafor, C. M., Dako, O. F., & Akinola, A. S. (2024). Value-Chain Automation in Beverage Logistics: Throughput, Capacity, and Cost Avoidance via Queueing Models. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 10(4), 1112-1132. DOI: 10.32628/Ijsrcseit Adesiyan, Y. R., & Alaba, P. A. (2024). Field-Grown Switchgrass (Panicum virgatum L.) as a Bioenergy Feedstock: A Review of Phenotype Data Collection and Analysis. Journal of Biotechnology & Bioresearch, 5(4), JBB.000618. https://doi.org/10.31031/JBB.2024.05.000618 Adesuyi, M. O., Walawalkar, G., & Kalu, A. (2021). Decision-centric financial analytics for executive-level strategy formulation. Journal of Accounting and Financial Management, 7(5), 152 to 173. Adesuyi, M. O., Kalu, A., & Walawalkar, G. (2023). Data-led cost governance in technology- intensive enterprises. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 9(3), 877 to 896. https://doi.org/10.32628/Ijsrcseit Adeyoyin, O., Awanye, E. N., Morah, O. O., & Ekpedo, L. (2020). A Conceptual Framework Linking Financial Strategy and Operational Excellence in Manufacturing Firms. Adeyoyin, O., Awanye, E. N., Morah, O. O., & Ekpedo, L. (2021). A Conceptual Framework for Integrating ESG Priorities into Sustainable Corporate Operations. Adeyoyin, O., Awanye, E. N., Morah, O. O., & Ekpedo, L. (2024). A Model for Operational Resilience and Financial Agility through Data Analytics. Agbabiaka, J., Okonkwo, C.S., Ogunwole, O., Mayo, W. & Okeke, O.T. (2019). Supply Chain Risk Management Model for EPC and Gas Processing Projects. IRE Journals, 3(2), 968 to 980. DOI: 10.64388/IREV3I2-1713124. Aggarwal, C.C. (2017). Outlier Analysis (2nd ed.). Springer, Cham. Ahmed, K.S. & Odejobi, O.D. (2018). Conceptual Framework for Scalable and Secure Cloud Architectures for Enterprise Messaging. IRE Journals, 2(1), 1-15. Ahmed, K. S., Odejobi, O. D., & Oshoba, T. O. (2019). Algorithmic model for constraint satisfaction in cloud network resource allocation. IRE Journals, 2(12). ISSN: 2456-8880. Ahmed, K.S., Odejobi, O.D. & Oshoba, T.O. (2020). Predictive Model for Cloud Resource Scaling Using Machine Learning Techniques. Journal of Frontiers in Multidisciplinary Research, 1(1), 173-183. DOI: 10.54660/.Ijfmr.2020.1.1.173-183. Ahmed, K. S., Odejobi, O. D., & Oshoba, T. O. (2021). Certifying algorithm model for Horn constraint systems in distributed databases. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 7(1), 537-554. Aifuwa, S. E., Oshoba, T. O., Ogbuefi, E., Ike, P. N., Nnabueze, S. B., & Olatunde-Thorpe, J. (2020). Predictive analytics models enhancing supply chain demand forecasting accuracy and reducing inventory management inefficiencies. International Journal of Multidisciplinary Research and Growth Evaluation, 1(3), 171-181. DOI: 10.54660/.IJMRGE.2020.1.3.171-181. Ajayi, A. E., Moyo, T. M., Tafirenyika, S., Taiwo, A. E., Tuboalabo, A., & Bukhari, T. T. (2022). Predictive Analytics Systems for Enhancing Financial Forecast Accuracy and Real-Time Monitoring in Hospital Networks. Akeju, B., Edivri, J., Ogbole, J. I., Okoruwa, P. O., Fadayomi, O., & Abolaji, T. O. (2018). Conceptual model for insider threat classification and risk modeling in complex digital systems. IRE Journals, 1(9). https://doi.org/10.64388/IREV1I9-1713778 Akhigbe, R., Falemi, A., & Akin-Oluyomi, O. T. (2023). A Conceptual Model for Improving Customer Experience using Workforce Behavior and Real-Time Operational Data. Akhigbe, R., Falemi, A., & Akin-Oluyomi, O. T. (2024). An advanced framework for technology adoption that supports employee readiness in modern organizations. Akhtar, N. and Mian, A. (2018). Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access, 6, 14410 to 14430. Akin-Oluyomi, O. T., & Akhigbe, R. (2022). A supply chain governance model for enhancing compliance and operational quality across retail networks. All Multidisciplinary Journal. Akin-Oluyomi, O. T., & Akhigbe, R. (2023a). A proposed supply chain analytics framework for improving forecasting accuracy and reducing bottlenecks. Akin-Oluyomi, O. T., & Akhigbe, R. (2023b). An advanced framework for improving multi-site operational efficiency using data-driven performance indicators. Akinfolarin, S., Ajayi, A., Yeboah, T. J., Ofori, S. D., Elumilade, R. A., Apelehin, A. A., Abutu, D. E., & Bobga, M. A. (2024). The PearlAI framework: Leveraging artificial intelligence to transform education in Africa. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 10(3), 1120 to 1132. Technoscience Academy. Akinlade, O. F., Filani, O. M., & Nwachukwu, P. S. (2021a). Applied Statistics Models Optimizing Global Supply Chain Networks Under Uncertainty Conditions. Akinlade, O. F., Filani, O. M., & Nwachukwu, P. S. (2021b). Cross-Functional Framework using AI-Enhanced Analysis for Supplier Selection Accuracy. Akinlade, O. F., Filani, O. M., & Nwachukwu, P. S. (2022). Data Visualization with Predictive Modeling Measuring Workplace Diversity Performance Metrics. Akinlade, O. F., Filani, O. M., & Nwachukwu, P. S. (2023). AI-Integrated Procurement Frameworks Aligning Operational Efficiency with Organizational Strategic Goals. Akinlade, O. F., Filani, O. M., & Nwachukwu, P. S. (2024a). Automation and digital twins framework reducing procurement errors and turnaround time. International Journal of Scientific Research in Humanities and Social Sciences, 1(1), 197-216. Akinlade, O. F., Filani, O. M., & Nwachukwu, P. S. (2024b). Predictive Analytics Models Akinleye, O. K., & Adeyoyin, O. (2021). Process Automation Framework for Enhancing Procurement Efficiency and Transparency. Akinleye, O. K., & Adeyoyin, O. (2022). Supplier Relationship Management Framework for Achieving Strategic Procurement Objectives. Akinleye, O. K., & Adeyoyin, O. (2023). A Category Spend Mapping and Supplier Risk Assessment Framework for Global Supply Chains. Akinlolu, V. S., Omaghomi, T. T., Fapohunda, M., & Atima, M. E. (2022). A systems-level policy framework for integrating mental health screening into primary healthcare in low-resource settings. Akinlolu, V. S., Fapohunda, M., Omaghomi, T. T., Atima, M. E., & Igweonu, C. (2023). A proposed care-coordination framework for reducing readmissions among chronic disease patients. Multidisciplinary Global Environment Journal, 4(5), 1187 to 1195. Akinlolu, V. S., Omaghomi, T. T., & Fapohunda, M. (2024). A data-driven framework for improving health facility preparedness and disaster risk mitigation in urban hospitals. International Journal of Advanced Multidisciplinary Research and Studies, 4. Akinola, A. S., Adesanya, O. S., Okafor, C. M., & Farounbi, B. O. (2018). Automated Payroll Compliance Assurance: Linking Withholding Algorithms to Financial Statement Reliability. IRE Journals, 1(7). Akinola, A. S., Farounbi, B. O., Onyelucheya, O. P., & Okafor, C. M. (2020a). Translating finance bills into strategy: Sectoral impact mapping and regulatory scenario analysis. Journal of Frontiers in Multidisciplinary Research, 1(1), 102-111. Akinola, A. S., Okafor, C. M., Dako, O. F., & Adesanya, O. S. (2020b). Evidence-informed Advisory for Ultra-High-Net-Worth Clients: Portfolio Governance and Fiduciary Risk Controls. Journal of Frontiers in Multidisciplinary Research, 1(2), 112-120. Akinola, A. S., Adesanya, O. S., Okafor, C. M., & Dako, O. F. (2024). Value-chain automation in beverage logistics: Throughput, capacity, and cost avoidance via queueing models. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 10(4), 1112 to 1132. Akomolafe, O., Agu, M. U., & Bello, A. (2023). A Conceptual Model for Implementing Risk- Based Auditing in Strategic Financial Management. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2274-2286. Aldaraani, N. and Begum, Z. (2018). Understanding the impact of ransomware: A survey on its evolution, mitigation and prevention techniques. NCC 2018, 1 to 5. Alexander, O., Belisle, M. and Steele, J. (2020). MITRE ATT&CK for Industrial Control Systems: Design and Philosophy. MITRE Corporation, McLean, VA. Aliliele, C., Mbonu, I.S. and Iwuanyanwu, U. (2023a). A Conceptual Framework for Continuous Cloud Misconfiguration Monitoring and Enterprise Risk Mitigation Strategies. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 9(10), 373 to 394. Aliliele, C., Mbonu, I.S. and Iwuanyanwu, U. (2023b). A Review of API Governance and Risk Prioritization Frameworks in Modern Financial Institutions. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 9(10), 395 to 433. Aliliele, C., Mbonu, I.S. and Iwuanyanwu, U. (2023c). Advances in Predictive Analytics Models for Student Retention and Institutional Risk Management Systems. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2692 to 2711. Aliliele, C., Mbonu, I.S. and Iwuanyanwu, U. (2024a). A Conceptual Framework for Enterprise Data Sensitivity Classification and Regulatory Traceability Mechanisms. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 3103 to 3124. Aliliele, C., Mbonu, I.S., Uzoka, E. and Iwuanyanwu, U. (2024b). Advances in HIPAA Compliant Data Architecture and Secure Analytics Frameworks for Community Healthcare Organizations. Shodhshauryam, International Scientific Refereed Research Journal, 7(2), 277 to 324. Alladi, T., Chamola, V. and Zeadally, S. (2020). Industrial control systems: Cyberattack trends and countermeasures. Computer Communications, 155, 1 to 8. Alliance, C. S. (2022). Cloud Controls Matrix v4. Cloud Security Alliance, Seattle, WA. Alliance, C. S. (2023). Top Threats to Cloud Computing: Pandemic Eleven. Cloud Security Alliance, Seattle, WA. Allodi, L. and Massacci, F. (2014). Comparing vulnerability severity and exploits using case control studies. ACM TISSEC, 17(1), 1 to 20. Alsentzer, E., Murphy, J.R., Boag, W., Weng, W.H., Jin, D., Naumann, T. and McDermott, M. (2019). Publicly available clinical BERT embeddings. Proceedings of the 2nd Clinical Natural Language Processing Workshop, 72 to 78. Ambali, K.B., Eyetsemitan, R.A., Oyeleye, A.O. & Fadayomi, O. (2021). Lean Six Sigma for Small Enterprises: A Systematic Review and Lite-DMAIC Adaptation Framework for Resource-Constrained Organizations. IRE Journals, 5(5), 562 to 583. DOI: 10.64388/IREV5I5 to 1716957 Amebleh, J., Igba, E. & Ijiga, O. M. (2021). Graph-Based Fraud Detection in Open-Loop Gift Cards: Heterogeneous GNNs, Streaming Feature Stores, and Near-Zero-Lag Anomaly Alerts International Journal of Scientific Research in Science, Engineering and Technology Volume 8, Issue 6 DOI: https://doi.org/10.32628/IJSRSET214418 Aminu-Ibrahim, A. Y., Ogbete, J. C., & Ambali, K. B. (2018). Developing sustainable diagnostic laboratory infrastructure models for emerging and resource constrained health systems. Iconic Research and Engineering Journals, 1(8), 118 to 132.https://doi.org/10.64388/IREV1I8 to 1713586 Aminu-Ibrahim, A.Y., Ogbete, J.C. & Ambali, K.B. (2019). Capital Project Delivery Models for High Risk Healthcare Infrastructure in Developing National Health Systems. Iconic Research and Engineering Journals, 2(10), 626 to 649. DOI: 10.64388/IREV2I10 to 1713588. Aminu-Ibrahim, A.Y., Ogbete, J.C. & Ambali, K.B. (2020). Infrastructure Driven Expansion of Diagnostic Access Across Underserved and Rural Healthcare Regions. International Journal of Multidisciplinary Research and Growth Evaluation, 1(5), 691 to 706. DOI: 10.54660/IJMRGE.2020.1.5.691 to 706. Aminu-Ibrahim, A.Y. & Ogbete, J.C. (2023). Healthcare Infrastructure as a Public Health Intervention Using Evidence from Large Laboratory Networks. Shodhshauryam, International Scientific Refereed Research Journal, 6(1), 256 to 286. DOI: 10.32628/SHISRRJ23678. Aminu-Ibrahim, A.Y., Ogbete, J.C. & Ambali, K.B. (2024). Governance and Accountability Models for Public Private Partnerships in Healthcare Infrastructure Development. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 2943 to 2960. DOI: 10.62225/2583049X.2024.4.6.5699. Ani, U.P.D., He, H. and Tiwari, A. (2017). Review of cybersecurity issues in industrial critical infrastructure: Manufacturing in perspective. Journal of Cyber Security Technology, 1(1), 32 to 74. Anichukwueze, C. C., Osuji, V. C., & Oguntegbe, E. E. (2019). Global marketing law and consumer protection challenges: a strategic framework for multinational compliance. IRE Journals, 3(6), 325-333. Anichukwueze, C. C., Osuji, V. C., & Oguntegbe, E. E. (2020). Designing ethics and compliance training frameworks to drive measurable cultural and behavioral change. Int J Multidiscip Res Growth Eval, 1(3), 205-20. Anichukwueze, C. C., Osuji, V. C., & Oguntegbe, E. E. (2021a). Blockchain-based architectures for tamper-proof regulatory recordkeeping and real-time audit readiness. Int J Multidiscip Res Growth Eval, 2(6), 485-504. Anichukwueze, C. C., Osuji, V. C., & Oguntegbe, E. E. (2021b). Digital Marketing Compliance Risk Mitigation: Balancing Growth Objectives with Multi-Jurisdictional Regulations. Anichukwueze, C. C., Osuji, V. C., & Oguntegbe, E. E. (2022). LegalTech-Enabled Internal Audit Automation: Advancing Efficiency, Transparency, and Regulatory Preparedness. Anichukwueze, C. C., Osuji, V. C., & Oguntegbe, E. E. (2023). Building a Comprehensive AI Governance Risk Index to Support Global Enterprise Decision-Making. Anichukwueze, C. C., Osuji, V. C., & Oguntegbe, E. E. (2024). Developing Dora-Aligned Compliance and Resilience Strategies for US Financial Services Organizations. Anioke, S. C., & Atima, M. E. (2018). Regulatory Analytics Approaches for Improving Occupational Health Safety Outcomes Across Public and Private Workplaces. Anioke, S. C., & Atima, M. E. (2019). Digital Employer Risk Rating Frameworks Supporting Public Health Oriented Social Insurance Compliance Systems. Anioke, S. C., & Atima, M. E. (2023a). Public health governance models using process optimization and performance metrics for regulatory oversight. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2534 to 2548. https://doi.org/10.62225/2583049X.2023.3.6.5491 Anioke, S. C., & Atima, M. E. (2023b). Public health informatics frameworks for protecting vulnerable populations through data-driven policy enforcement. International Journal of Advanced Multidisciplinary Research Studies, 3(6), 2564 to 2579. Anioke, S. C., & Atima, M. E. (2024). Predictive Analytics Systems Strengthening Public Health Surveillance and Epidemic Preparedness Decision Making. Anthony, P., Ezeh, F.E., Oparah, O.S., Gado, P., Adeleke, A.S., Gbaraba, S.V., Okoli, A.O. & Omotayo, O. (2023). Adaptive Multi-Modal AI Systems for Continuous Disease Monitoring Via IoT and Wearable Devices. International Journal of Advanced Multidisciplinary Research and Studies, 3(1), 1557 to 1570. DOI: 10.62225/2583049X.2023.3.1.5158. Anthony, P., Gado, P., Ezeh, F.E., Oparah, S.O., Okoli, A.O., Adeleke, A.S., Gbaraba, S.V. & Omotayo, O. (2024). Integrating Clinical Pastoral Education into Multidisciplinary Healthcare Teams: A Framework for Holistic Patient Care. International Journal of Advanced Multidisciplinary Research and Studies, 4(4), 1573 to 1583. DOI: 10.62225/2583049X.2024.4.4.5157. Anthropic (2024). Responsible Scaling Policy. Anthropic PBC, San Francisco, CA. Apruzzese, G., Colajanni, M., Ferretti, L., Guido, A. and Marchetti, M. (2018). On the effectiveness of machine and deep learning for cyber security. CyCon 2018, 371 to 390. Apruzzese, G., Colajanni, M., Ferretti, L. and Marchetti, M. (2019). Addressing adversarial attacks against security systems based on machine learning. International Conference on Cyber
More Articles from WORLD JOURNAL OF INNOVATION AND MODERN TECHNOLOGY
AI-Assisted Risk and Incident Analysis: Advances and Future Opportunities
Author: Uchechi Mary-Linda Unamma, Ifeanyichukwu Jeffrey Okwesa, Serif Oyindamola, Oyesiji, Abubakar Umar Abdulmalik
Influence of Artificial Intelligence Tools on Teachers’ Instructional Delivery in Public Senior Secondary Schools in Gokana and Khana Local Government Areas of Rivers State, Nigeria
Author: BIIBALOO Juliet Legborsi, EDO Barineka Lucky, PhD NWILE Charles Befii, PhD.
Community-Centered Digital Skills: Empowering Adults for Life- Long-Learning in Yola North Local Government Area
Author: Adamu Abdullahi Potiskum, Emeka Godwin Timothy, Lawan Ladan
Dielectric Performance of Natural Ester Insulating Fluids as a Sustainable Alternative to Mineral Transformer Oil: A Systematic Review
Author: Ude Kingsley Okechukwu, Ugwu Kelvin Ikechukwu, Mmamel Ngozi Juliana, Nnamani, Micheal Obiora
Artificial Intelligence and Inclusive Practices in Special Needs Education: Opportunities, Challenges, and Future Directions
Author: Rahima Ahmadu Ribadu, Bobboi Abubakar