A U.S. power company employed regularly-recurring audits of various controls, systems and programs. However, when it came to a SCADA-based cyber security vulnerability assessment, the in-house audit team did not possess the specific combination of process control experience and cyber security risks. They realized they required a third-party expert with a unique combination of knowledge of the two worlds.