Offshore SCADA Support Is Not Just a Resourcing Decision
Why pipeline operators should evaluate OT/SCADA outsourcing through the lens of risk, data sovereignty, regulatory readiness, and operational resilience
At the 2026 API Conference, during a session titled “Keeping Up with Cybersecurity Compliance: Where U.S. Cybersecurity Policy Is Going Next,” a SCADA Manager from a prominent U.S. pipeline operator raised a question that many critical infrastructure leaders may already be asking.
As more pipeline operators consider outsourcing IT, OT, and SCADA support to offshore managed service providers, could future regulations restrict or prohibit that model?
The panel included legal, law enforcement, and critical infrastructure resilience perspectives, with representatives from Bracewell, the FBI, and Berkshire Hathaway. That mix of expertise made the discussion especially relevant for pipeline leaders evaluating the operational and regulatory implications of offshore SCADA support.
The question matters because offshore support is often evaluated through a narrow operational lens. Does the provider have enough resources? Can they reduce cost? Can they support the platform? Can they respond quickly?
Those are valid questions. But for OT and SCADA environments, they are not enough.
Regulators, boards, auditors, and incident response teams may eventually evaluate the decision very differently. They may ask who had access, from where, under what controls, to what systems and data, and whether that access model was appropriate for critical infrastructure.
For pipeline operators, offshore SCADA support is not just a resourcing decision. It is a risky decision.
Panelists included Lauren Clegg, Counsel, Bracewell, LLP; Ash Thorne, Acting Assistant Special Agent in Charge, FBI; David Benton, Senior Advisor, Threat Informed Resilience, Berkshire Hathaway; and Alamdar Hamdani, former U.S. Attorney and Bracewell Partner. Hamdani was appointed by President Biden and unanimously confirmed by the Senate as the top federal law enforcement official in the Southern District of Texas.
The Capacity Problem Is Real
The pressure on SCADA and OT teams is significant.
Pipeline operators are managing complex environments with aging infrastructure, evolving compliance expectations, increasing Cyber Security threats, and a limited pool of specialized talent. Many teams are being asked to modernize, secure, support, and optimize their systems while still protecting uptime and operational continuity.
In that context, managed services can be attractive. External support can help fill resource gaps, provide specialized expertise, and reduce the burden on internal teams.
The issue is not whether pipeline operators should use external support. In many cases, they should.
The issue is whether the support model is appropriate for the sensitivity of the environment.
In OT/SCADA, Location and Access Change the Risk Model
In traditional IT outsourcing, the location of the support team may be treated as a cost or service delivery consideration. In OT and SCADA, location can become part of the risk profile.
A third-party provider supporting SCADA may have access to sensitive system information, operational data, IP addresses, network details, remote access pathways, applications, configurations, historian data, and infrastructure context. Even when access is limited, the provider may still gain visibility into how critical operations are structured and supported.
That changes the conversation.
The issue is not simply whether an offshore provider can complete a technical task. The issue is whether offshore access extends the trust boundary of a critical infrastructure environment in a way that introduces new operational, regulatory, Cyber Security, or reputational exposure.
A provider may be offshore only in a staffing sense. But from an OT risk perspective, the operator may be creating cross-border exposure to systems and data that carry far greater sensitivity than a typical business application.
Data Sovereignty and Export Control Cannot Be an Afterthought
One of the most important themes raised in the 2026 API Conference discussion was the potential for export control and data sovereignty concerns.
SCADA environments can contain information that is sensitive from an operational, Cyber Security, and infrastructure perspective. If offshore resources can access that information, directly or indirectly, the operator may need to understand whether the arrangement creates additional legal, regulatory, or compliance obligations.
This is not only about where the primary provider is located.
It is also about where the data can be accessed from, whether subcontractors are involved, what support pathways exist, and whether access could extend into jurisdictions that create added concern.
These are questions that should be evaluated before support begins, not after a regulator, auditor, board member, or incident response team asks for answers.
Operators should be asking:
- What data can the provider access?
- Can operational data cross borders, directly or indirectly?
- Are export control implications understood?
- Are offshore personnel accessing SCADA systems, applications, infrastructure, or documentation?
- Are subcontractors involved?
- Are access pathways logged, monitored, restricted, and revocable?
- Has legal or compliance counsel reviewed the model?
No responsible operator wants to discover these issues during an incident.
Critical Infrastructure Support Requires a Higher Standard
There is a practical difference between supporting a business system and supporting the operational systems behind critical infrastructure.
SCADA environments help pipeline operators maintain visibility, support decisions, manage alarms, monitor assets, and protect reliable operations. Any support model that touches this environment should reflect the importance of the systems involved.
That does not mean every task requires on-site delivery. It does mean support should be designed around the realities of OT.
Those realities include uptime sensitivity, change control, remote access risk, segmentation, regulatory exposure, incident response, and the need for deep understanding of industrial operations.
A generic offshore IT model may not be enough.
Pipeline operators need partners who understand the difference between enterprise support and OT/SCADA support. They need resources who understand the consequences of downtime, the importance of operational context, and the discipline required when working near control environments.
Regulation May Be Behind, But Expectations Are Moving
The 2026 API Conference discussion also highlighted an uncomfortable reality. Regulation often moves more slowly than technology, outsourcing models, and emerging threats.
That does not mean operators should wait.
The strongest operators will move ahead of regulation by asking more rigorous questions now. Future scrutiny of offshore OT and SCADA support is plausible, especially as critical infrastructure becomes more connected and as governments pay closer attention to foreign involvement, Cyber Security exposure, and third-party access.
Even if no clear prohibition exists today, leadership should consider whether the current support model would be defensible tomorrow.
- Would it stand up to an internal risk review?
- Would it satisfy executive stakeholders?
- Would it be explainable to regulators?
- Would it be defensible after a Cyber Security incident?
- Would it support public trust if the issue became visible?
Compliance is not the same as resilience. A support model can be technically permitted and still create avoidable risk.
The Better Distinction: Offshore vs. Local and Nearshore OT/SCADA Support
The conversation should not be framed as internal support versus external support. That misses the point.
The better distinction is between offshore support models that may introduce additional jurisdictional, access, and data exposure concerns, and local or nearshore OT/SCADA support models that are better aligned with North American operational and regulatory realities.
For critical infrastructure, local or nearshore support can provide a more defensible operating model, especially when paired with certified expertise, controlled access, strong governance, and OT-aware delivery practices.
This approach recognizes that SCADA support is not a commodity service. It is part of the operating model that protects reliability, resilience, and confidence.
The goal is not simply to find people who can support the technology. The goal is to build a support model that reduces uncertainty.
What Pipeline Operators Should Evaluate Before Outsourcing SCADA Support
Before outsourcing OT or SCADA-managed services, pipeline operators should evaluate the support model across several dimensions.
Access: What systems, data, credentials, applications, network details, and environments will the provider access?
Location: Where are support resources physically located?
Jurisdiction: What countries, legal environments, and subcontracting pathways may be involved?
Data handling: What operational data could cross borders, either directly or indirectly?
Remote access: How is access approved, monitored, logged, limited, and revoked?
Segmentation: Is provider access restricted to the minimum required scope?
Cyber Security controls: Are secure remote access, monitoring, identity management, and incident response processes in place?
Operational fit: Does the provider understand ICS and OT realities, or are they applying a generic IT support model?
Regulatory readiness: Could the model withstand future scrutiny from regulators, auditors, and executive stakeholders?
Incident accountability: If an incident occurs, can the organization clearly explain who had access, from where, under what controls, and why the model was considered appropriate?
These questions are not barriers to outsourcing. They are the foundation for responsible outsourcing.
Dexcent’s Position: Local and Nearshore by Design
Dexcent’s OT/SCADA strategy has been built around local and nearshore professional AVEVA-certified resources.
That decision is intentional.
For critical infrastructure operators, SCADA support should reduce operational uncertainty, not add new questions about access, jurisdiction, data exposure, and accountability.
SCADA and OT systems require more than technical availability. They require operational understanding, disciplined delivery, Cyber Security awareness, and an appreciation for the regulatory and reputational realities pipeline leaders face.
Dexcent’s approach is designed to help operators strengthen their SCADA and OT environments without introducing unnecessary complexity or avoidable risk.
We support pipeline operators with resources who understand the North American operating context, the importance of secure and reliable SCADA environments, and the need to align people, process, and technology around long-term resilience.
This is not only a delivery model. It is a risk management philosophy.
The Decision Leaders Should Be Making Now
Pipeline operators do not need to wait for new regulations to ask better questions about offshore SCADA support.
They can act now by reviewing where support is delivered, how access is managed, what data may be exposed, whether the operating model is defensible, and whether the provider understands the realities of OT and SCADA environments.
The future of SCADA support will not be judged only by cost, coverage, or resource availability.
It will be judged by whether the support model protects the systems, data, and operations that critical infrastructure depends on.
If you are evaluating offshore SCADA or OT managed services, Dexcent can help you assess the operational, Cyber Security, data sovereignty, and regulatory readiness risks before access is granted.
