Cloud & DevOps Company in Calgary

NERC CIP scope is the single biggest swing factor on a Calgary platform engagement. Below that line sits a scoped cloud landing zone build at Calgary rates over six to twelve weeks, covering AWS Control Tower or Azure Landing Zones, Terraform modules, baseline observability, and an IEC 62443 segmentation diagram if OT crossover is in scope, or a full DevOps platform engagement (Kubernetes, GitOps, CI/CD, secrets management, policy-as-code, runbooks) over four to eight months. SRE retainers with on-call coverage, SLO management, and incident response are tiered by the number of production services. NERC CIP-scoped engagements carry a 20 to 35 percent premium because of the documentation, evidence collection, and Reliability Coordinator coordination overhead. Calgary rates align with Edmonton and run modestly below Toronto, with OT/IT convergence work attracting a specialty premium. We quote fixed fee on platform builds and tiered monthly on operate.

NERC CIP applies to Bulk Electric System assets and the entities that operate or support them, which catches Alberta grid operators, several Calgary-headquartered transmission and generation entities, and any cloud workload that touches their operational data. We treat NERC CIP as a first-class requirement, not an afterthought. Discovery identifies BES Cyber Systems and applicable CIP-002 categorisation. Architecture builds an electronic security perimeter under CIP-005 with hardened jump hosts, an interactive remote access solution that satisfies CIP-005-7, and identity controls aligned with CIP-004 personnel training and CIP-007 patch management. Configuration change management under CIP-010 runs through Terraform with full plan and apply evidence, and information protection under CIP-011 covers data classification and disposal. We coordinate with your Reliability Coordinator on Operations Planning Standards and produce the evidence packs an internal NERC audit and the Western Electricity Coordinating Council region reviewer will request without scrambling at the eleventh hour. Cloud usage is constrained to vendor-approved cloud services and explicitly scoped in the CIP audit boundary.

Yes, and this is where most generalist consultancies discover they have no plan. Fort McMurray, Cold Lake, Kearl Lake, Horizon, Christina Lake, and Foster Creek operate with intermittent connectivity, IEC 62443 zone-and-conduit segmentation, and OT control networks that must never face the public internet. Our pattern runs corporate workloads in AWS ca-central-1 or Azure Canada Central, packages site-level inference and analytics as containerised services running on Honeywell Forge, AVEVA Edge, or dedicated edge clusters at the facility, and syncs results to corporate through unidirectional gateways or store-and-forward queues over SD-WAN. Splunk and PI System act as the audit trail. We never expose DCS or PLC networks to the internet and we never bridge OT to IT without an OT security architect and the site safety committee approving the topology in writing. Calgary corporate sees the dashboard, the site keeps inference local, and the link can fail for hours without disrupting production. Disaster recovery is documented per facility, not per region.

Calgary energy observability is a layered problem because the plant floor will not abandon its historian and corporate will not abandon its SIEM. We stitch four layers. At the OT layer, AVEVA PI System or OSIsoft historian stays canonical for process data and is integrated, not replaced. At the application layer, Datadog or New Relic instruments microservices, SAP, and Maximo with distributed tracing and APM. At the infrastructure layer, Prometheus and Grafana cover Kubernetes, nodes, and infrastructure metrics, often surfaced through Datadog for unified dashboards. At the security and compliance layer, Splunk Enterprise or Splunk Cloud absorbs logs from cloud, on-premises, and OT-adjacent systems, with content packs for NERC CIP, IEC 62443, and AER pipeline safety. SLOs ride on top with error budgets reviewed monthly. PagerDuty or Opsgenie handles paging, with explicit rotations between corporate IT and site operations so an alert never falls between the two.

Most Calgary energy operators run GitLab Ultimate self-hosted with offline package mirrors and on-premises runners because internet-dependent CI/CD is unacceptable for systems that touch operational technology. Our pattern uses GitLab self-managed for code, pipelines, and container registry, with Dependency Proxy and Package Mirroring pointed at curated upstream sources rather than open public registries. Runners are isolated per environment with no inbound internet exposure. Artifact signing uses Sigstore Cosign with hardware-backed keys from Entrust nShield or Azure Dedicated HSM. Container scanning runs Trivy and Anchore inline, with policy gates that block any image tied to a CVE above an agreed CVSS threshold or with an unverified provenance attestation. Promotion from dev to staging to production requires signed approvals captured in GitLab and mirrored into your CIP-010 evidence pack. We never use plain SSH keys for production access; everything routes through a CIP-005 compliant jump host with session recording and just-in-time access tied to your IdP.

Yes. SAP S/4HANA is the spine of finance, supply chain, and asset management at most Calgary energy majors, and the move from on-premises to RISE with SAP or operator-managed cloud is one of the most common requests we see. Our pattern follows the SAP-on-AWS or SAP-on-Azure reference architecture in ca-central-1 or Canada Central with HANA-certified instances, dedicated HSU storage, and Azure NetApp Files or FSx for ONTAP where workload patterns demand it. Network design routes through Direct Connect or ExpressRoute private virtual interfaces with redundancy across two routers and two locations. We integrate with Maximo, AVEVA PI System, and existing identity through Azure AD or AWS IAM Identity Center, run downtime-minimised migrations using SAP Cloud Appliance Library and DMO for combined migration and upgrade where appropriate, and stand up disaster recovery in a second region with HANA System Replication. Cutover plans are rehearsed at minimum twice with full business validation before production move. Calgary energy CFOs do not accept a four-hour unplanned outage on SAP.

Government of Alberta IT, Alberta Health Services, and federally regulated energy entities in Calgary all enforce residency rules that significantly narrow cloud choices. Personal information collected by Alberta public bodies must remain inside Canada under PIPA and FOIP, with very narrow exceptions. Health data under the Health Information Act stays inside Canada and inside specified hosting categories. CSE Medium-tier guidance applies to federally adjacent workloads, and Canadian Centre for Cyber Security guidance applies to anything touching federal data sharing. We default to AWS ca-central-1 in Montreal, Azure Canada Central in Toronto, and GCP northamerica-northeast1 in Montreal for storage, compute, and backup. Cross-border replication is disabled unless an explicit Privacy Impact Assessment signs off. Logging endpoints in Splunk Cloud or Datadog are pinned to Canadian regions. Key material lives in AWS KMS, Azure Key Vault, or HashiCorp Vault with HSM backing inside Canada, and we provide a residency attestation document the Office of the Information and Privacy Commissioner of Alberta can review without a follow-up letter.

Calgary corporate IT typically anchors disaster recovery in two cloud regions while oil sands facilities run with site-local resilience because a Fort McMurray facility cannot wait for a Montreal failover during an active control event. Our pattern documents Recovery Time Objectives and Recovery Point Objectives separately for each tier. Tier 1 corporate workloads (SAP, Maximo, identity) run active-passive across ca-central-1 and Canada Central with HANA System Replication, async geo-replication on storage, and DNS-based failover. Tier 2 corporate workloads run pilot light with infrastructure-as-code redeploy in under an hour. Tier 3 facility workloads run local high availability inside the IEC 62443 zone with no dependency on corporate cloud, plus store-and-forward sync once the link returns. Backups follow 3-2-1 with at least one immutable copy in a separate region. We run a tabletop disaster recovery exercise quarterly and a live failover at least annually. Calgary VP-IT does not get a passing audit on DR without that evidence.