With the new UK Network and Information Systems (NIS) regulations launching in October 2024, intended to boost the whole CNI sector's operational resilience and ability to manage cyber risk, Operators of Essential Services (OES) must be ready to take a proactive, structured, and auditable approach to security in order to achieve and maintain full compliance with the new legislation.
However, the resilience of CNI systems presents a number of singular challenges, all of which must be given careful consideration as we prepare for the new legislation's official launch. Central to this, any downtime not only costs millions but can leave citizens without critical services and - in extreme cases - damage assets and put people at risk of injury.
As will become clear, this process is very much a journey rather than a one-off project, but with the support of trusted technology partners, it will help to ensure the critical services that citizens depend on remain secure and available, able to weather the most sophisticated attacks.
The following should be considered the first steps of this journey, not only in terms of achieving full NIS 2 compliance, but also for establishing a whole new standard of operational resilience across the UK's entire CNI sector…
Identifying the hidden assets within CNI infrastructure
The OES must be able to provide details of what essential services, functions, systems, and sites, are within the scope of the NIS regulations.
Managing, monitoring, and updating legacy infrastructure, remains a vital element of cyber security best practice. However, CNI systems frequently include legacy OT assets that are deeply embedded and difficult to replace without unacceptable risk or disruption to critical operations. Unfortunately, this may only become apparent when the asset in question needs to be remediated and/or fails to restore after an update.
A proactive approach to the management and support of CNI OT systems is an essential component of NIS compliance. This should include monitoring tools that provide visibility of all assets and dataflows, and the ability to detect and alert security threats.
Fortunately, there are three references that support the journey:
- The Purdue Model. A well-established model for the segmentation of assets within ICS networks and the hierarchy of dataflows between them, based on four/five distinct 'zones'.
- Cyber Assessment Framework. A structure and collection of outcome-based resources for organisations to follow, providing a reference guide to help build robust cyber resilience plans.
- IEC 62443. An internationally recognised standard for the security of control systems, and the cyber security lifecycle. There are numerous elements to this, but of particular importance is planning end-of-life support for any new assets introduced into a system.
A full audit of all assets, based on these three models, is therefore the first step towards secure CNI, ensuring all legacy infrastructure has been accounted for and factored into the design of the security ecosystem. This should not only cover the assets themselves, but also the data they generate, how the data is processed, stored, and disseminated, what data needs to flow through the iDMZ, and what data needs to be accessed through a secure gateway.
The increasing convergence of IT and OT means that physical security systems (i.e. cameras and locks) must also be factored into the auditing process, something that we will explore in depth in a future article.
Know your infrastructure, understand the threat landscape
The OES must take appropriate and proportionate measures to prevent and minimise the impact of a cyber incident.
The next step is the implementation of an Intrusion Detection System (IDS), which can then normalise dataflows across the entire infrastructure and establish a baseline, so any anomalies can be automatically detected. This doesn't just mean security issues – it could also means planned maintenance, the deployment of new hardware, or elements of a specific project. Regardless of the cause, as soon as a deviation from the established baseline has been detected, the CSOC should receive an automatic alert.
This can then be expanded to draw on wider threat feeds, ensuring security teams are able to proactively secure against the very latest threats, and conduct rigorous post-mortem procedures after a validated cyber incident. Likewise, if the alert is a consequence of new assets being added or a network re-configuration, the IDS toolset can be used to establish a new baseline.
A systematic approach to testing and patching
In a heightened threat landscape, effective testing and patching is critical, but the OES must balance this against critical IT/OT systems' unique operating models.
Once full visibility of all assets and dataflows has been established, it is time to prepare for the worst. With cyberattacks against CNI systems now a near-certainty, it is unfortunately a question of 'when' not 'if' a breach occurs, which means a proactive approach to maintaining the security of all physical and digital assets is essential.
While most organisations will already have some form of regular cyber security testing in place, default IT methodologies are not suitable for integrated IT/OT systems. For example, it is common to automate patching for IT systems, ensuring the latest security updates are implemented as soon as they become available. However, this represents a significant risk for critical, high-availability OT systems and an alternative approach must therefore be taken, with testing and patching carefully controlled and co-ordinated.
Threats and vulnerabilities must be categorised and prioritised on a 'now', 'next', and 'never' basis, supported by a rigorous bi-annual maintenance schedule, undertaken by a trusted third-party. Any partner undertaking such a role must be able to demonstrate proven experience in the convergence of IT and OT and the three methodologies discussed earlier, as well as the ability to supply UK NSV-cleared staff.
NIS 2 compliance and beyond – a unique model of operational resilience
Failure to comply with these obligations could result in enforcement action and penalties, including fines of up to £17 million, depending on the severity and duration of the non-compliance and the harm caused.
As the new NIS 2 fast approaches, CNI's critical IT and OT systems need to evolve at pace. But as they do so, they must accommodate the operational complexity of high-availability systems and sector-specific constraints. When we give this deeper consideration, it becomes clear that the new NIS 2 is very much the latest step of a much longer journey. The decision-making involved – both now and in the years ahead – will be inherently complex, making the support of the right technology partner essential.
Contact us if you'd like to discuss anything we've covered here, and any other aspects of the new NIS 2 regulations before they come into effect. Our highly consultative approach and edge-to-core knowledge of OT and IT technology means that Vysiion are perfectly placed to support you on the journey to compliance and beyond.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
542 Hits
Although the sector as a whole has traditionally been comparatively wary of the ever-increasing pace of technology, legal services are increasingly data driven, with an abundance of AI-related discussion emerging within legal technology circles. The core Document Management Systems (DMS) and Practice Management Systems (PMS) remain the centre of focus for how and where to deploy a variety of rapidly maturing SaaS platforms, or dedicated, highly customised suites.
2701 Hits
The international hotel chain Omni Hotels & Resorts has confirmed that a cyberattack last month saw it shut down its systems, with hackers stealing personal information about its customers.
In the aftermath of the attack, hotel guests reported that they had been forced to check in on paper, that room keys didn't work, and all phone systems and Wi-Fi were offline.
90834 Hits
Any organisation that has tried to recover from a ransomware attack knows that it can be time-consuming and costly. Companies hit by an attack must choose between paying a ransom or recovering encrypted data from a backup.
Unfortunately, ransomware gangs are too aware that they can leverage significantly higher ransoms from their corporate victims if they have also compromise the company's backups. For this reason, we are seeing more and more cyber attacks targeting backups because they know that organisations desperately need them to recover if they want to avoid paying a ransom to cybercriminals.
104936 Hits
To Test or Not to Test? - When it comes to IT disaster recovery and remediation processes, regular testing is not a 'nice to have' - it's absolutely essential!
This isn't hyperbole on my part. You just have to look at the news on any given day. We've all heard the horror stories of organisations in both the public and private sectors experiencing prolonged downtime during disasters due to inadequate preparation, lack of testing, and the unsuitability of their legacy remediation processes and systems.
2748 Hits
On the 18th March 2024, the Information Commissioner's Office issued its updated guidance around the issuing of fines when organisations have been found liable for the integrity of their customers' or end users' data being compromised. It is already well-established now that failure to ensure critical data remains secure will result in costly fines, as we have seen repeatedly in multiple high-profile cases over the years.
2889 Hits
In spite of the ongoing evolution of cyber security processes and technology, human error is still responsible for 95% of data breaches1. Phishing attacks alone represent a particularly insidious risk, with 91% of organisations experiencing a successful attack in 2021 alone2.
3427 Hits
The past decade has been a challenging one for the Retail sector, to say the least. Much has already been written about the impact of online shopping and streaming services on the high street, and the rise of COVID-19 and recent supply chain disruptions have only compounded the challenges facing even the most established brick-and-mortar retailers.
3049 Hits
Maximising performance, scalability, and compliance for a leading innovator in online banking
About Tandem Money
Tandem is 'The Good Green Bank', a fully regulated digital app‐based bank founded on the idea of putting customers' needs first whilst helping them save more than just their money by pushing for a sustainable future. The acquisition of green lender Allium in 2020, an established green homes lender, accelerated Tandem's mission into the green space. Tandem offers savings, mortgages, and loans to help customers green their properties, and eventually their lives.
Challenges
The key driver behind Tandem's ongoing digital transformation was earning a full banking license in 2018 - something that had been a core focus of their infrastructure's evolution. This meant their infrastructure would need to fulfil all legal and compliance obligations around the handling of financial data, and also demonstrate the highest standard of operational resilience.
At the time, Tandem's IT and telephony infrastructure was hosted at various separate data centres, while their banking application was hosted on AWS services, and a separate site set aside for workplace recovery. Although multiple sites were involved here, the whole network depended on the London office, creating a single point of failure.
After a comprehensive evaluation of various suppliers, Tandem engaged with Exponential‐e to ensure these critical elements could be securely interconnected in order to maximise performance and scalability and ensure all requirements for full bank status were achieved. Exponential‐e's deep experience in the financial sector was critical here, providing Tandem with complete confidence that the partnership would provide a positive contribution to their journey.
Solution
The networking solution delivered by Exponential‐e interconnected all Tandem sites via a high-performance WAN - a fully managed low‐latency solution that ensured consistent performance across all sites. This was implemented by a dedicated Exponential‐e account team, who project managed every stage of the deployment to ensure there would be no service disruption and that Tandem's long-term goals remained the primary focus throughout the deployment and beyond.
Critically, this fulfilled all compliance requirements regarding the handling and storage of financial data, while ensuring Tandem's teams would have the right tools at their fingertips at all times. To ensure a disruption free migration process, secure connections were created between Exponential-e's self‐owned network and Tandem's AWS services, allowing for a successful consolidation of the different elements of their infrastructure, and providing IT teams with a higher level of control and visibility.
As the partnership between Tandem and Exponential‐e evolved, a combination of a Virtual Private Network (VPN) and Office 365 was established as the ideal combination of solutions to further optimise Tandem's overall efficiency and enable effortless collaboration between their various teams, regardless of where they were located, with security policies applied automatically and role‐based segregation opening up a wide range of opportunities for remote working.
Throughout 2020, when the COVID‐19 pandemic forced organisations worldwide to rapidly transition to a remote workforce, the inherent flexibility and scalability of Tandem's infrastructure and a robust business continuity plan showed its true worth, as the entire workforce were able to begin working remotely with minimal disruption to day‐to‐day operations, and no compromise in terms of security and compliance. This option had already been utilised on an ad‐hoc basis by Tandem's engineers, but a scenario where it would need to be utilised on a company‐wide basis had been considered and factored into the business continuity plan, with tests taking place to ensure such measures would be viable, should they ever be needed.
In this way, Tandem has demonstrated how the right infrastructure, with the support of the right technology partner, provides organisations in even the most challenging sectors with the agility to pivot in response to unexpected, large‐scale shifts in the digital landscape. Tandem's long‐term digital transformation continues, with plans in place to bring its core banking suite in house and into the Cloud, for a further layer of control and flexibility.
Solution benefits
- High‐performance VPN connectivity across multiple sites, with secure connections to the core banking suite provider.
- Full compliance with all applicable regulations regarding the handling of financial and sensitive data.
- A stress‐free transition to remote working, with zero compromise in the security of users' financial and sensitive data.
- A strong foundation for ongoing Cloud transformation and consolidation.
Exponential-e is a trusted technology partner for organisations across the Finance sector, offering innovative solutions that drive security, compliance and optimal performance at all levels.
Find out more in our Finance Brochure.
6684 Hits
Robust and secure Private Cloud infrastructure across 3 London sites.
Implementing a private Cloud and VPLS solution enables a future-proofed, scalable infrastructure. This ensures Anthony Nolan's data is accessible and available at all times so that people with blood cancer have the best chance of finding a match.
About Anthony Nolan
Anthony Nolan, now in its 40th anniversary year, was the world's first bone marrow register. The blood cancer charity has been saving lives for four decades by matching remarkable people willing to donate their bone marrow to patients in desperate need of a transplant.
Anthony Nolan operates an extensive global database of over 500,000 bone marrow, or stem cell, donors. This database enables the charity to provide over 1,000 blood cancer patients with a matching stem cell donor every year.
Solution
Anthony Nolan decided to migrate its existing infrastructure, previously housed in its headquarters in London, to two data centre sites operated by Exponential-e in London. Key to the solution is improving business continuity through migrating the servers to these sites and therefore into dedicated off-site facilities.
Anthony Nolan chose to adopt Exponential-e's VPLS into the solution, Exponential-e's Tier 3 facilities have enterprise-class connectivity provided over a Network built and integrated for 100% uptime.
By connecting over Exponential-e's virtual private LAN, Anthony Nolan is also able to extend its own Network to capture all of its offices on one private WAN. The Network also provides dual resilience enabling further contingency and security.
Our database is accessed 24 hours a day and is essential in ensuring people with blood cancer have the best chance of finding a match. We need to ensure our data is safe, accessible and available at all times, now and in the future. As we continue growing year on year this demand is only increasing and we need to ensure we have the ability to expand our capacity in the future.
Marcin Fabjanczyk Infrastructure Manager, Anthony Nolan
Challenges
With over 60,000 new donors registering per year, the rapid growth of the organisation and the volume of data it processes, means it is essential for Anthony Nolan to safeguard the management of its data to ensure business continuity. Registries across the world access the database 24 hours a day looking for a potential donor match for people with blood cancer.
If the database is not available or accessible, registries are not able to access it and this critical activity cannot take place.
Whilst the database must be constantly available, it also needs to be scalable. Anthony Nolan has a number of agreements with other donor databases, which are set to be incorporated into the same infrastructure - the set-up must be resilient enough to support this growth in data and the associated search requests.
In addition to this growth, the charity has targets to increase the rate of growth of registered donors, and is currently on track to achieve its target of 60,000 new donors every year. Its infrastructure must support this planned growth long-term.
Solution benefits
- Implemented private Cloud and VPLS solution.
- Future-proofed and scalable infrastructure.
- Business continuity through both Cloud and Network infrastructure.
- Data is always secure and private, across its own WAN and Exponential-e Tier 3 facilities.
7095 Hits
Greater connectivity resiliency, automated business continuity and increased QoS allows Fidessa to remain the market leader of multi-asset trading and investments and market data and analysis for the financial trading sector.
About Fidessa
Fidessa Group is a global business with scale, resilience, ambition and expertise - providing Financial Trading, investment and information solutions. 85% of the world's premier financial institutions trust Fidessa to provide them with multi-asset trading and investment infrastructure, market data and analysis, and decision making and workflow technology. $10 trillion worth of transactions flow across its global Network each year. Being a market leader, they also offer unique access to the world's largest and most valuable trading community of buy-side and sell-side professionals, from global institutions and investment banks to boutique brokers and niche hedge funds.
Solution
Fidessa approached Exponential-e to solve this challenge after an introduction via one of its group companies, LatentZero which was already an Exponential-e customer. LatentZero knew of Exponential-e's technology and expertise and spoke highly of its potential to solve the automated failover challenge. Another key factor in choosing Exponential-e was its expertise in dealing swiftly with Réseaux IP Européens Network Coordination Centre (RIPE NCC) applications.
At the start of the project Exponential-e helped by fulfilling the first requirement of obtaining Provider Independent (PI) IP addresses from RIPE NCC. To get Fidessa up and running quickly, a temporary subnet of Provider-Aggregatable (PA) IP addresses were provided by Exponential-e for the 100Mbps Internet connections installed at the primary office in Woking and the office in London. After RIPE NCC allocated Provider Independent (PI) IP addresses to Fidessa, Exponential-e smoothly facilitated the migration to the PI IP addresses from the temporary PA ones provided.
At the primary connection in Woking, a dynamic routing protocol was configured to be used during normal times. In the event of the primary connection failing, a floating, static route will automatically reroute the Internet traffic via the backup circuit in London.
The failover will then be managed by a Border Gateway Protocol (BGP) session, where a lower metric is configured at Woking, ensuring it is the primary route, and a higher metric is configured in London, ensuring it is only used if there is a fault with the service at Woking. However, both locations will still be able to send outbound traffic independently as needed.
Solution benefits
- Improved SLA.
- Automated Internet failover for Business Continuity.
- Increased QoS, resilience and diversity for Internet services.
Challenges
With so many major financial institutions relying on Fidessa and the company's commitment to providing resilient services to its customers, effective Business Continuity Planning (BCP) is imperative for the company. In a BCP situation the IT department might be dealing with ten or more different issues to resolve. Should there be a disaster, keeping resources free to resolve the issues that require manual attention is ideal.
Therefore, the challenge Fidessa faced was automating as much of its BCP as possible. Among the many Financial Trading tools and services that Fidessa provides, one of them includes delivery of web-based services, such as its award winning fragmentation analysis tools.
The company required resilient infrastructure to deliver these services to the international trading community and required automated failover to its London office in the event of a fault with the service at the company's head office in Woking.
The major problem Fidessa came across in trying to solve this challenge was that most providers did not have the technology or expertise necessary to provide automated failover in a BCP scenario.
After having dealt with a number of Internet Service Providers (ISPs), needing to change IP addresses because of relocations and to become more flexible in the delivery of its web-based services, Fidessa first realised it needed to obtain its own subnet of IP addresses. Secondly, the organisation realised that the provider for Internet connectivity would need to have Network reach combined with innovative technology and know-how to deliver an automated, seamless failover between Woking and London.
Two of the world's largest communications providers were approached; however, Fidessa determined that neither organisation was flexible enough nor could they provide the type of failover desired to ensure minimum impact during a disaster. These providers required manual intervention and changes to Fidessa's core Network for failover to occur between the Woking and London offices.
This was not ideal to fulfil the company's Business Continuity plans - time and effort needed would be labour and resource intensive - taking away from where these resources could be used in a disaster situation.
10883 Hits
© 2026 Exponential-e Ltd. Reg. No. 04499567, Reg. Address:100 Leman Street, London E1 8EU