In my opinion we certainly can NOT blame the IT folks. They know about the security problems. We especially cannot blame SCADA IT security groups at LDCs as NERC CIP does not mandate LDC compliance.