Arcanum Technical Director, Lawrie Abercrombie, explains how cyber incidents in the energy sector have implications beyond the initial compromise and quickly become a compliance issue.
“Under NIS, the question is not whether you had an incident. The question is whether you can demonstrate, through CAF outcomes and evidence, that your security measures were appropriate, proportionate, effective for an essential service.”
Energy cyber incidents rarely stay in one regulatory lane. In the UK, an event that starts as “IT compromise” can quickly become a NIS compliance conversation, because what regulators ultimately care about is whether you protected the network and information systems on which your essential service relies.
Ofgem is explicit in saying that it regulates Operators of Essential Services (OES) in electricity and gas under the Network and Information Systems Regulations 2018, and that it will monitor compliance and take enforcement action where appropriate.
A recent, high-profile utility enforcement action, South Staffordshire Water, illustrates the pattern. This breach began with phishing, remained undetected for around 20 months, escalated to domain admin and culminated in large-scale data publication.
The ICO concluded that there were significant security failings and consequently issued a monetary penalty totalling £963,900. While that was a data protection outcome, the underlying control weaknesses are exactly the kind of weaknesses a NIS Competent Authority assesses through the NCSC Cyber Assessment Framework (CAF).
For energy sector OES organisations, this article is intended to provide a practical, CAF-led view of:
- How a competent authority is likely to judge “appropriate and proportionate” measures
- What enforcement risk looks like in practice; and
- What controls and evidence actually move the needle.
The regulatory frame energy leaders need to internalise
Ofgem provides NIS guidance for Great Britain’s energy sector downstream gas and electricity OES and publishes sector-specific materials including a CAF overlay designed to help OES demonstrate the CAF security outcomes. DESNZ policy guidance reinforces that the NIS regime is implemented sector-specifically and that the CAF is the mechanism used to structure expectations and oversight for OES in energy.
Crucially, Ofgem also publishes NIS Enforcement Guidelines and Penalty Policy, describing how it may use enforcement powers and tools for contraventions under NIS, including enforcement and penalty notices and how it approaches decision-making.
So the energy story isn’t just “follow the framework”; it’s “be ready to evidence outcomes under scrutiny, because the enforcement playbook is published and increasingly mature”.
Why “basic controls” are now explicitly an energy-sector regulatory expectation
The South Staffordshire Water case (data exfiltration, long dwell time, poor monitoring, legacy systems) is instructive because the failings described publicly are not exotic, they’re foundational: limited controls enabling privilege escalation; inadequate monitoring; obsolete systems; inadequate vulnerability management. In energy, Ofgem’s DGE CAF overlay and supplementary guidance are designed precisely to help OES translate the CAF into demonstrable, sector-specific outcomes, including how to think about proportionality and appropriateness.
In other words: when regulators talk about “appropriate and proportionate”, they don’t mean “have a policy”. Instead, they mean “show evidence that controls are in place and working”, particularly around identity, monitoring, vulnerability management and resilience. If those basics are weak, you are not just operationally exposed – you are CAF-exposed.
A CAF-led “how would the NIS regulator assess this?” lens for energy OES
The CAF is structured around four objectives (A–D). Below is a practitioner-level mapping of the types of failings seen in major utility incidents (like South Staffordshire Water) to the CAF outcomes an energy regulator will probe, using the language and intent of the Ofgem DGE CAF overlay.
Important nuance for energy: the NIS question isn’t only, “Was personal data lost?” It’s “Were systems supporting the essential service appropriately protected, monitored, recoverable?” which is exactly what CAF assesses.
Objective A: Managing security risk (the “board and management system” test)
A1 Governance: Regulators expect clear accountability, oversight, prioritisation of cyber risk for in-scope systems; long periods of undetected compromise and basic control gaps typically indicate governance that didn’t drive effective assurance.
A2 Risk Management: Lack of regular scanning, unpatched critical systems, unmanaged risk exceptions are classic signs of an immature risk management loop (identify; prioritise; remediate; verify).
A3 Asset Management: Unsupported/obsolete systems in production strongly suggest incomplete asset lifecycle control, particularly relevant in energy environments with mixed IT/OT estates and long-lived assets.
What this means in practice: an energy OES should be able to evidence a repeatable assurance cycle, not just a one-off assessment, something Ofgem’s reporting and assurance materials increasingly expect
Objective B: Protecting against cyber attack (the “are controls actually effective?” test)
B2 Identity & Access Control: Domain admin compromise (or the energy equivalent, unbounded privileged access across operationally critical platforms) is a red flag for weak privilege governance and insufficient segmentation of admin roles.
B4 System Security: Unpatched vulnerabilities and legacy platforms indicate insufficient baseline hardening and vulnerability management outcomes, areas specifically emphasised in sector-tailored CAF guidance.
B5 Resilient Networks & Systems: Lateral movement across endpoints and prolonged persistence are common when segmentation, containment, secure remote administration are weak.
Energy translation: if your organisation can’t show how compromise is contained (zones, tiers, privileged paths, remote access controls), you will struggle to evidence CAF B outcomes during assurance or inspection.
Objective C: Detecting cyber security events (the “can you see an attacker?” test)
This is often where OES fail most visibly. South Staffordshire Water was reported as monitoring only ~5% of the estate, with detection triggered by IT performance issues rather than security monitoring, classic CAF C1/C2 failure signals. Ofgem’s DGE CAF overlay exists partly because “detection as a paper exercise” is not detection. Regulators expect coverage, alerting and investigative capability proportionate to essential service risk.
C1 Security Monitoring: demonstrate coverage across critical identity, endpoint, network, platform telemetry.
C2 Proactive Discovery: demonstrate timely discovery and triage (not “we found it after disruption”).
Objective D: Minimising the impact (the “resilience and recovery” test)
If detection is late, response will look weak, because containment is delayed and the attacker has time to broaden impact. That’s precisely what extended dwell time implies. In energy, resilience expectations are rising as the system decentralises and becomes more distributed; DESNZ and Ofgem are actively consulting on reshaping downstream gas and electricity cyber regulation to keep pace with evolving risks.
D1 Response & Recovery: show tested plans, exercises, recovery objectives, evidence that recovery is feasible for in-scope systems.
D2 Improvements: show how incidents and assurance findings drive measurable control improvements.
Enforcement risk in the energy sector: what “practical” looks like
Ofgem’s published NIS enforcement guidance explains how it may deploy tools and powers in response to contraventions, including enforcement and penalty notices and alternative tools, with the explicit aim of clarity and deterrence across the sector. Separately, government has been developing reforms to NIS enforcement mechanisms through the Cyber Security and Resilience (NIS) Bill, aiming to make the regime more effective and proportionate (including penalty structures and factors).
For energy OES, the real enforcement risk is usually a chain, not a single moment. Assessment / inspection activity e.g. evidence requests and required improvements lead to formal enforcement if progress and outcomes are insufficient.
The organisations that fare best are not those who “never have incidents” but those who can demonstrate:
- Clear scope definition
- Risk-based decision making
- Control effectiveness with credible evidence
Below are the improvements that consistently strengthen CAF outcomes and reduce enforcement exposure, expressed as outcomes, not product choices.
The most overlooked requirement: evidence that you’ll be asked to show
Ofgem’s NIS guidance for OES includes structured reporting and assurance materials (templates and trackers have been updated as recently as January 2026), signalling the direction of travel: repeatable reporting, remediation tracking, planned assurance. This means energy OES should maintain a CAF evidence pack that can be produced quickly and confidently.
A regulator-ready CAF evidence pack (starter checklist)
- Scope statement: what systems support the essential service, how scope boundaries are defined, how changes are controlled.
- CAF outcome mapping: your current CAF assessment with evidence per outcome, not just narrative.
- Assurance artefacts: vulnerability scan cadence and results; remediation SLAs; exceptions with approvals; control testing results.
- Resilience artefacts: exercise schedule; restore test evidence; backup integrity checks; lessons-learned actions closed. This is the difference between “we’re compliant” and “we can demonstrate outcomes”.
Where Arcanum fits in (without the hard sell)
At Arcanum, we see the same recurring challenge across critical infrastructure: organisations invest in controls, but struggle to connect them into a CAF-coherent, evidence-driven assurance story that stands up in regulatory dialogue.
Ofgem’s sector guidance and CAF overlay create a clear benchmark. Our role is to help OES translate that benchmark into operational reality and defensible evidence.
Our most effective engagements in the energy sector typically focus on:
- CAF-aligned gap assessment that tests control effectiveness (not just documentation),
- Rapid evidence pack build aligned to Ofgem expectations,
- Prioritised remediation roadmaps that show proportionality and risk-based decision making.
That’s how you reduce the chance that an incident becomes a prolonged supervisory burden: by making compliance demonstrable, measurable and continuously improving.
To close, I think it is worth mentioning three questions that every energy OES leader should ask this quarter:
- What percentage of our in-scope estate is actually monitored and can we prove it? (CAF C1)
- Can a compromised user endpoint realistically become privileged control over critical platforms in our environment? (CAF B2/B5)
- If Ofgem asked for our CAF evidence pack next week, could we produce it confidently?
This is about governance + assurance maturity. If any of those answers are uncomfortable, that’s not a reason to panic – it’s a prompt to act with focus.
If your organisation needs help to get CAF aligned, get in touch with us today for an introductory call to outline how we can help to make the process a fast and efficient one. Contact us.