Arcanum Technical Director, Lawrie Abercrombie, explains why cyber security in operational technology environments has become a more prominent area of discussion at board level – driven by changing UK policy and the proliferation of disruptive breaches in Critical National Infrastructure.
OT is no longer a niche engineering topic. For organisations running essential services, it has become a board-level resilience issue. Regulators are now looking for evidence that the cyber risks to essential functions are understood, owned and actively managed – not simply acknowledged in policy.
There are good reasons for that shift. UK critical national infrastructure now depends on increasingly connected control systems, remote access arrangements, telemetry platforms, cloud services and specialist suppliers. At the same time, attackers have become more willing and more able to target disruption rather than just data theft. In an OT environment, a cyber incident can affect safety, production, environmental controls, customer service and public confidence.
The role of policy in building resilience
The policy direction is also clear. The UK’s Cyber Security and Resilience Bill builds on the existing NIS Regulations and is expected to increase the emphasis on resilience, oversight and accountable risk management. The latest version of the NCSC Cyber Assessment Framework – CAF 4.0 – is particularly important because it reinforces the need to demonstrate effective cyber resilience against real threats, not just the existence of documented controls.
One practical example is asset management where organisations actually need to understand what is required to deliver, maintain or support the network and information systems behind their essential functions, including data, people, systems and supporting infrastructure such as power or cooling. For OT environments, that matters. The question is not whether a policy exists, but whether the organisation can show that it understands what its essential functions are and that they are understood, protected, monitored and recoverable when it all goes wrong.
For CNI and CNI-adjacent organisations, the important point is that regulators will expect evidence. That means clear ownership, credible asset and dependency mapping, risk decisions linked to essential functions, proportionate technical controls, supply chain assurance, detection capability, incident response arrangements, recovery planning and a record of testing and improvement.
A common mistake is to treat OT security as IT security applied to a different network. The priorities are different. In IT, the emphasis in priority order is usually confidentiality, data integrity and business continuity. In OT, the first priority is safe, reliable and predictable operation of a physical process. A control that looks sensible in an office environment e.g. rapid patching, endpoint isolation or intrusive scanning, may well create unacceptable operational risk if it is applied without engineering context in an OT environment.
OT environments also tend to include long-life assets, legacy protocols, vendor-managed systems, safety constraints, infrequent maintenance windows and limited tolerance for downtime. We’ve seen equipment that is 30 years old and still working, protocols that haven’t been supported for 20 years and systems that have to run 24/7/365. Security controls have to work within those realities, they need to be technically sound, but they also need to be operationally credible.
That is why the starting point should be the essential function, not the security toolset. What service must continue? Which systems and suppliers support it? What failure modes matter most? Which cyber scenarios could affect safe or reliable operation? Only then can controls be selected and justified in a way that makes sense to engineers, executives and regulators.
Compliance is sometimes seen as a distraction from resilience. It shouldn’t be. Used properly, it gives organisations a structured way to test whether the essentials are in place: governance, understanding of the environment, protective controls, monitoring, response and recovery.
A good assessment does more than satisfy an audit request. It exposes hidden dependencies, clarifies accountability, helps prioritise investment, strengthens supplier assurance and gives senior leaders a better view of residual risk. It also creates the evidence trail needed to show that cyber risk is being managed as part of operational governance, rather than as a separate compliance exercise.
The organisations best placed for increased scrutiny will be those that can explain their decisions. They will know why a control is appropriate, where exceptions exist, how compensating measures are managed and how lessons from incidents, exercises and assurance activity feed back into improvement planning.
Arcanum works with organisations operating in high-consequence and regulated environments, where cyber security, operational risk and assurance obligations overlap. Our consultants bring practical experience across critical national infrastructure, OT security, risk management, governance, supplier assurance and regulatory readiness.
We help clients assess OT cyber maturity, map essential functions and dependencies, review governance and risk processes, align evidence to recognised frameworks such as the NCSC CAF and identify practical remediation options. Our aim is not to produce a theoretical control set. It is to help clients put defensible, proportionate measures in place that will stand up to regulatory scrutiny and still work in the real operating environment.
If your organisation runs OT that supports essential services, now is the time to understand where you stand. What evidence could you provide today? Where are the gaps? Which improvements would make the biggest difference to resilience and regulatory confidence?
Arcanum can help you answer those questions. Book an initial consultation with us to discuss your current OT assurance position, regulatory exposure and practical next steps.