Cybersecurity Requirements Every Upstream ERP Must Meet

The threat landscape for oil and gas companies has shifted dramatically. Ransomware attacks targeting the upstream sector surged 935% between April 2024 and April 2025, according to a report from cybersecurity firm Zscaler, a figure that would have seemed unthinkable just a few years ago. High-profile incidents involving industry names like Halliburton and Newpark Resources have underscored a sobering reality: upstream operators are no longer peripheral targets. They are prime ones.

For E&P companies, the enterprise resource planning (ERP) system sits at the center of everything: production accounting, land and lease management, joint interest billing, financial reporting, and more. If that system is compromised, operations grind to a halt. Data walks out the door. Trust erodes. Choosing an ERP that takes cybersecurity seriously isn't just good IT hygiene. It's a business continuity imperative.

Here are the core cybersecurity requirements every upstream ERP must meet in today's threat environment.

1. Role-Based Access Control and Least Privilege

One of the most fundamental security principles, and one most frequently overlooked, is ensuring that users only have access to what they need to do their jobs. An ERP that serves as a single database for financials, production data, and land records holds an enormous volume of sensitive information. Without granular role-based access control (RBAC), a single compromised account can expose far more than it should.

A secure upstream ERP must support configurable permission levels across departments and job functions, with the ability to restrict access down to specific data fields and workflows. Multi-factor authentication (MFA) should be mandatory for all users, not optional. Industry frameworks including NIST, ISO 27001, and NERC CIP all cite access control as a foundational requirement, and for good reason. It limits the blast radius when credentials are stolen.

2. Data Encryption: In Transit and At Rest

Sensitive upstream data (well production volumes, ownership interests, revenue splits, lease terms) is valuable to competitors and attackers alike. An ERP must encrypt data both when it's moving between systems and when it's sitting in storage.

At a minimum, this means TLS encryption for all data in transit and AES-256 (or equivalent) encryption for data at rest. Cloud-hosted ERP platforms that handle their own infrastructure must be able to demonstrate that these standards are consistently applied across the entire data lifecycle. If your vendor can't clearly articulate how your data is encrypted, that's a red flag.

3. Audit Trails and Activity Logging

Regulatory compliance and internal governance both depend on knowing who accessed what, when, and what they did with it. A compliant upstream ERP must maintain comprehensive, tamper-resistant audit logs of user activity across all modules.

This matters for more than just compliance. When an incident occurs (whether a breach, an unauthorized data export, or a suspicious configuration change) audit logs are often the first place investigators turn. Without them, forensic analysis becomes guesswork. Look for ERP systems that log all data modifications, login events, permission changes, and report exports, with logs retained for a defined period that meets your regulatory obligations.

4. Disaster Recovery and Business Continuity Planning

Ransomware attacks don't just steal data. They lock operators out of their own systems. The Zscaler report noted that data exfiltrated by ransomware actors rose 92% year over year, reaching 238 terabytes. For an upstream operator whose ERP contains years of production history, contract data, and financial records, the consequences of losing access are severe.

A cybersecurity-ready ERP must include robust disaster recovery capabilities: automated backups with tested restoration procedures, defined recovery time objectives (RTOs), and geographically redundant data storage. Cloud-hosted SaaS platforms offer a natural advantage here; when the vendor manages infrastructure, disaster recovery protocols can be built into the service level agreement rather than left to the operator's in-house IT team.

5. Vendor Security and Supply Chain Risk Management

Some of the most damaging breaches in the energy sector have come not through direct attacks, but through third-party vendors. The CLOP ransomware attack that compromised Hitachi Energy in 2023 exploited a zero-day vulnerability in a file transfer tool, not in Hitachi's own systems. FERC's 2025 CIP audit lessons learned report highlighted third-party vendor due diligence as a persistent compliance gap.

When evaluating an upstream ERP, scrutinize the vendor's own security posture. Do they conduct regular penetration testing? How do they manage software vulnerabilities and patch cadences? What is their incident response protocol if their systems are compromised? A vendor that cannot answer these questions with confidence creates risk for every operator running their software.

6. Compliance Alignment with Industry Frameworks

Upstream operators don't exist in a regulatory vacuum. Depending on their operations and assets, they may be subject to requirements from NIST Cybersecurity Framework (CSF), ISA/IEC 62443 for industrial control system security, NERC CIP standards where bulk electric system assets are involved, and TSA Security Directives for pipeline operations. An ERP system should be built to support compliance with these frameworks, not create obstacles to it.

That means built-in controls that map to regulatory requirements, configurable reporting that surfaces the data auditors need, and a vendor that actively monitors the regulatory landscape and adapts the product accordingly.

7. Secure Remote Access

The days of ERP access being limited to a corporate office are long gone. Field personnel, operations teams, and finance staff need to access upstream data from multiple locations and devices. That convenience creates exposure.

A cybersecurity-ready ERP must enforce secure remote access protocols, including VPN or equivalent encrypted connections, device authentication, session timeouts, and MFA at every entry point. NERC CIP's updated CIP-005-7 standard now requires MFA even for assets previously classified as low-risk, reflecting how seriously regulators are taking remote access as an attack vector.

What This Means for Upstream Operators

The upstream sector is a target. Ransomware groups are active, sophisticated, and increasingly focused on energy companies whose operational disruption creates maximum pressure to pay. The ERP system, the nerve center of your operation, cannot be an afterthought in your security posture.

At Enertia Software, cybersecurity is built into the foundation of our platform. As the only fully integrated, single-database ERP built exclusively for upstream oil and gas, our SaaS solution is hosted in a secure cloud environment with enterprise-grade protections across the entire data lifecycle. Your data is live, audited, and secured so your team can focus on running wells, not worrying about what's running in the background.

If your current ERP can't answer yes to every requirement above, it may be time to ask harder questions.

Ready to learn more about how Enertia protects your upstream operations? Contact our team to schedule a conversation.