Cyber security for energy, utilities and critical infrastructure

Operators of essential services must show regulators that their networks and information systems are secure and resilient. We help energy, water and other critical infrastructure organisations meet NIS obligations using the NCSC Cyber Assessment Framework, across both IT and operational technology.

Talk to a member of our team

The challenge

What's driving security in your sector

NIS Regulations and the CAF

Operators of essential services are assessed against the NCSC Cyber Assessment Framework by their competent authority. Each CAF outcome needs evidence, not just policy.

Operational technology

Control systems, field devices and remote access were rarely designed with security in mind. IT and OT risk must be managed together without disrupting safe operations.

Expanding regulation

The Cyber Security and Resilience Bill is set to extend the NIS regime to managed service providers, data centres and large load controllers, with stronger incident reporting and enforcement powers.

Supply chain exposure

Integrators, maintenance contractors and managed service providers often have privileged access to critical systems, which makes supplier assurance a core part of compliance.

How we help

Practical support, from strategy to evidence

We bring our six core services together around the requirements that matter in your sector, so effort goes into the controls and evidence that make the difference.

Cyber Security Advisory

Independent advice for boards and accountable executives on NIS duties, regulatory engagement and investment priorities.

Governance & Risk Management

Cyber risk management aligned to the CAF, covering IT, OT and supply chain risk, with clear ownership and reporting.

Audit & Assurance

CAF self-assessment support, evidence reviews and independent assurance ahead of competent authority scrutiny.

Threat Modelling

Threat modelling of control systems, remote access and IT/OT boundaries to target controls where they matter most.

Cyber Security Frameworks

CAF improvement plans and alignment with ISO/IEC 27001, IEC 62443 and NIST CSF 2.0 so one programme satisfies several requirements.

At a glance

Key requirements and frameworks

Requirement	What it covers
NIS Regulations 2018	Duties for operators of essential services, overseen by sector competent authorities
NCSC Cyber Assessment Framework	Outcome-based assessment across four objectives and their principles
Cyber Security and Resilience Bill	Proposed extension of the NIS regime to new sectors and suppliers
IEC 62443	Industrial automation and control system security
ISO/IEC 27001	Information security management system

A summary for guidance only, correct as of October 2026. Requirements change; check the source for your situation.

FAQs

Common questions

For each CAF contributing outcome, you assess whether it's achieved, partially achieved or not achieved against the indicators of good practice, and back that up with evidence. We help you set the right scope, gather evidence efficiently and produce an improvement plan your regulator can follow.

Increasingly, yes. Operators must manage supply chain risk, so they pass security requirements on to suppliers through contracts and due diligence. The Cyber Security and Resilience Bill is also set to bring some suppliers, such as managed service providers, directly into scope.

Yes. We work alongside engineering and operations teams and focus on safe, practical controls that respect availability and safety requirements.

Let's talk about your next step

A short, no-obligation conversation to understand where you are and what would help most.

Book a consultation

Other sectors: Financial services & payments · Defence & supply chain · Technology, SaaS & managed services · Public sector & suppliers