Sectors · Energy
Energy & utilities
Critical infrastructure, converging IT and operational technology, and a competent authority that expects evidence make energy a high-stakes security environment.
The pressure
Critical, and closely assessed.
Energy and utilities run systems the country depends on, and the regulation reflects it. Operators of essential services fall under the UK Network and Information Systems Regulations 2018, with Ofgem and DESNZ acting as competent authorities for the sector, and are assessed against the NCSC Cyber Assessment Framework: a set of objectives, principles and contributing outcomes you have to evidence rather than assert.
The harder problem sits underneath. Control systems and operational technology were built for availability and long service life, and now connect to corporate IT, remote maintenance links and supplier networks. You cannot simply patch a safety-critical asset on a Tuesday, so the answer is architecture, segmentation and monitoring rather than a bigger agent estate. Companies with EU operations, or supplying essential services into the EU, have NIS2 to consider as well.
Challenges we hear
The pressures specific to energy and utilities.
- Reaching a defensible CAF profile, then evidencing it to the competent authority year after year
- Segmenting operational technology from corporate IT without disrupting operations
- Legacy control systems that cannot be patched or restarted on an IT schedule
- Remote access used by original equipment manufacturers and maintenance contractors
- Incident-reporting duties with short clocks, and the decision-making needed to meet them
- Monitoring an estate that spans data centres, control rooms, substations and remote sites
- Finding and keeping people who genuinely understand both IT security and OT
Rules that apply
The obligations and standards in play.
- The UK NIS Regulations 2018, with Ofgem and DESNZ as competent authorities for the energy sector
- The NCSC Cyber Assessment Framework: the objectives, principles and contributing outcomes you are assessed against
- IEC 62443 for industrial automation and control systems, including zones and conduits
- ISO 27001 for the management system that holds the whole thing together
- NIS2, where you have EU operations or supply essential services into the EU
- UK GDPR for customer, metering and workforce data
Where to start
Four steps towards a CAF profile you can defend.
- Confirm which competent authority covers each licensed activity you carry out
- Build an asset inventory that is as solid for operational technology as for corporate IT
- Confirm the target CAF profile your competent authority has set, and gap-assess against it
- Segment and log every remote-access route used by OEMs and contractors
How we help
Protection and proof, joined up.
- CAF-aligned gap assessment, with a prioritised route to a profile you can defend
- 24×7 monitoring across corporate IT and, where it is safe to do so, the OT boundary
- Network segmentation and access control between IT and OT environments
- Remote-access governance for OEMs, integrators and maintenance contractors
- Incident-response readiness built around operational, not just technical, decisions
FAQ
Questions buyers actually ask
- Working through the fourteen principles against the target profile your competent authority has set, judging each contributing outcome as achieved, not achieved or, where the framework allows it, partially achieved, and recording the evidence behind each judgement. The output is a prioritised improvement plan you can defend at review.
- It depends on the gaps. Governance and documentation gaps can often close within a cycle. Architectural changes, such as segmenting operational technology or extending monitoring into the control network, usually take longer and need planned outages. A credible plan sequences the quicker improvements first and shows steady progress each cycle.
- Yes. Under the NIS Regulations 2018, an incident with a significant impact on the continuity of your essential service must be notified to your competent authority without undue delay and no later than 72 hours after you become aware of it.
- Route it through a single, monitored entry point rather than tools each vendor installs; require named accounts and multi-factor authentication; open access only for an agreed window; and record sessions into control systems. Remove standing access that is no longer needed.
- That is not yet known. The Bill passed the House of Commons in June 2026 and is before the House of Lords, and many of its detailed duties are expected to follow through secondary legislation. Until then the NIS Regulations 2018 remain the law. Our regulation tracker, under Resources, shows the current stage.
Operating critical infrastructure?
We’ll help you evidence the CAF outcomes and harden where IT meets OT.
Book a call