It is no secret that cyber security is a priority for all sectors, as threats evolve in terms of frequency, scale, and sophistication. However, for Operators of Essential Services (OESs), this is just part of a larger, more complex picture. With the ongoing convergence of IT and OT and the resulting drive for an integrated approach to physical and cyber security, combined with increasingly complex compliance obligations, a more considered approach to the design and implementation of security ecosystems is needed.
A 'secure by design' approach.
It's no accident that we at Vysiion describe our delivery process, service and solution portfolio in this way - not just in relation to the cyber components of the delivery, but the systems, controls, and governance used in our delivery of mission-critical infrastructure into the most challenging environments, for the most stringently regulated sectors.
The Vysiion view, robust security is not a retrofit - it needs to be inherent in both approach and design, taking process, controls, hardware, and software into consideration, and ensuring stakeholders are aware of their roles and responsibilities.
So, taking a step back and considering how this works in practice, and from the earliest stages of a project...
An established project management methodology will include the creation of a risks and methods document, ensure the right security and risk management specialists have been engaged, and that processes are in place that follow best practice throughout each phase of delivery. A 'secure by design' approach takes this further by considering the full range of IT and OT security systems and processes that will overlay every element of the project - validated against the relevant frameworks and regulations, with the latest threat intelligence used to pinpoint the areas of greatest risk. Crucially, this includes all elements of the proposed supply chain, as these represent an increasingly common target for cyberattacks as a means of gaining backdoor access to critical data and infrastructure.
A rigorous, standards-based approach is essential, as OESs' regulatory obligations are rapidly evolving in response to the complexity of IT / OT systems, with regulations like NIS (2018) reflecting the larger attack surface created by this new breed of infrastructure.
As such, the following standards should be considered as the baseline for establishing secure, integrated IT and OT systems:
A rigorous, standards-based approach is essential, as OESs' regulatory obligations are rapidly evolving in response to the complexity of IT / OT systems, with regulations like NIS (2018) reflecting the larger attack surface created by this new breed of infrastructure.
As such, the following standards should be considered as the baseline for establishing secure, integrated IT and OT systems:
- ISO 27001. The globally recognised standard for information security.
- NIS (2018). Measures to optimise the resilience (both physical and cyber) of network and information systems.
- Cyber Assessment Framework (CAF). A systematic approach to measuring multiple aspects of cyber risk, maintained by the NCSC.
- IEC-62443. A framework for mitigating security vulnerabilities in the design and operation of critical infrastructure.
- Cyber Assurance of Physical Security Systems (CAPSS). Assurance for physical security systems.
Do not make assumptions here. The regulatory environment is increasingly rigorous, with standards and frameworks extending to organisations and market verticals previously exempt. For example, some manufacturers are now regarded as part of the UK's CNI sector and must be able to demonstrate appropriate and proportionate consideration has been given to the same regulatory and compliance goals.
Once the applicable standards have been identified, their robust principles can be adopted throughout the design and implementation phases and beyond, utilising proven methodologies like the Purdue Model to ensure dataflows and physical assets are identified and documented, and proactive monitoring of the potential attack surface is maintained (and automated, where appropriate). This should be subject to regular review using collated security data and the most up-to-date threat intelligence, and supported by a responsive maintenance capability, 24 / 7 support and monitoring, and regular auditing.
Once the applicable standards have been identified, their robust principles can be adopted throughout the design and implementation phases and beyond, utilising proven methodologies like the Purdue Model to ensure dataflows and physical assets are identified and documented, and proactive monitoring of the potential attack surface is maintained (and automated, where appropriate). This should be subject to regular review using collated security data and the most up-to-date threat intelligence, and supported by a responsive maintenance capability, 24 / 7 support and monitoring, and regular auditing.
The actual execution and impact of this approach will naturally vary from project to project and sector to sector, but it is essential that all OESs, their technology partners, and all organisations acting as part of their supply chains are ready and willing to adopt these principles, not only to fulfil their specific compliance obligations, but to ensure their services remain secure and available to citizens across the UK.
In this way, the 'secure by design' approach represents a powerful investment in your organisation's future, ensuring the continued availability and integrity of the critical product or service you provide.
Whatever the nature of your next project, if you are ready to adopt a 'secure by design' approach, don't hesitate to contact us. We will collaborate with you to establish an appropriate and proportionate approach, aligned with industry best practice and regulatory compliance, and drawing on our deep experience as an experienced supplier to the Defence, Energy, and wider CNI sectors.
In this way, the 'secure by design' approach represents a powerful investment in your organisation's future, ensuring the continued availability and integrity of the critical product or service you provide.
Whatever the nature of your next project, if you are ready to adopt a 'secure by design' approach, don't hesitate to contact us. We will collaborate with you to establish an appropriate and proportionate approach, aligned with industry best practice and regulatory compliance, and drawing on our deep experience as an experienced supplier to the Defence, Energy, and wider CNI sectors.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
569 Hits
With the new UK Network and Information Systems (NIS) regulations launching in October 2024, intended to boost the whole CNI sector's operational resilience and ability to manage cyber risk, Operators of Essential Services (OES) must be ready to take a proactive, structured, and auditable approach to security in order to achieve and maintain full compliance with the new legislation.
However, the resilience of CNI systems presents a number of singular challenges, all of which must be given careful consideration as we prepare for the new legislation's official launch. Central to this, any downtime not only costs millions but can leave citizens without critical services and - in extreme cases - damage assets and put people at risk of injury.
As will become clear, this process is very much a journey rather than a one-off project, but with the support of trusted technology partners, it will help to ensure the critical services that citizens depend on remain secure and available, able to weather the most sophisticated attacks.
The following should be considered the first steps of this journey, not only in terms of achieving full NIS 2 compliance, but also for establishing a whole new standard of operational resilience across the UK's entire CNI sector…
Identifying the hidden assets within CNI infrastructure
The OES must be able to provide details of what essential services, functions, systems, and sites, are within the scope of the NIS regulations.
Managing, monitoring, and updating legacy infrastructure, remains a vital element of cyber security best practice. However, CNI systems frequently include legacy OT assets that are deeply embedded and difficult to replace without unacceptable risk or disruption to critical operations. Unfortunately, this may only become apparent when the asset in question needs to be remediated and/or fails to restore after an update.
A proactive approach to the management and support of CNI OT systems is an essential component of NIS compliance. This should include monitoring tools that provide visibility of all assets and dataflows, and the ability to detect and alert security threats.
Fortunately, there are three references that support the journey:
- The Purdue Model. A well-established model for the segmentation of assets within ICS networks and the hierarchy of dataflows between them, based on four/five distinct 'zones'.
- Cyber Assessment Framework. A structure and collection of outcome-based resources for organisations to follow, providing a reference guide to help build robust cyber resilience plans.
- IEC 62443. An internationally recognised standard for the security of control systems, and the cyber security lifecycle. There are numerous elements to this, but of particular importance is planning end-of-life support for any new assets introduced into a system.
A full audit of all assets, based on these three models, is therefore the first step towards secure CNI, ensuring all legacy infrastructure has been accounted for and factored into the design of the security ecosystem. This should not only cover the assets themselves, but also the data they generate, how the data is processed, stored, and disseminated, what data needs to flow through the iDMZ, and what data needs to be accessed through a secure gateway.
The increasing convergence of IT and OT means that physical security systems (i.e. cameras and locks) must also be factored into the auditing process, something that we will explore in depth in a future article.
Know your infrastructure, understand the threat landscape
The OES must take appropriate and proportionate measures to prevent and minimise the impact of a cyber incident.
The next step is the implementation of an Intrusion Detection System (IDS), which can then normalise dataflows across the entire infrastructure and establish a baseline, so any anomalies can be automatically detected. This doesn't just mean security issues – it could also means planned maintenance, the deployment of new hardware, or elements of a specific project. Regardless of the cause, as soon as a deviation from the established baseline has been detected, the CSOC should receive an automatic alert.
This can then be expanded to draw on wider threat feeds, ensuring security teams are able to proactively secure against the very latest threats, and conduct rigorous post-mortem procedures after a validated cyber incident. Likewise, if the alert is a consequence of new assets being added or a network re-configuration, the IDS toolset can be used to establish a new baseline.
A systematic approach to testing and patching
In a heightened threat landscape, effective testing and patching is critical, but the OES must balance this against critical IT/OT systems' unique operating models.
Once full visibility of all assets and dataflows has been established, it is time to prepare for the worst. With cyberattacks against CNI systems now a near-certainty, it is unfortunately a question of 'when' not 'if' a breach occurs, which means a proactive approach to maintaining the security of all physical and digital assets is essential.
While most organisations will already have some form of regular cyber security testing in place, default IT methodologies are not suitable for integrated IT/OT systems. For example, it is common to automate patching for IT systems, ensuring the latest security updates are implemented as soon as they become available. However, this represents a significant risk for critical, high-availability OT systems and an alternative approach must therefore be taken, with testing and patching carefully controlled and co-ordinated.
Threats and vulnerabilities must be categorised and prioritised on a 'now', 'next', and 'never' basis, supported by a rigorous bi-annual maintenance schedule, undertaken by a trusted third-party. Any partner undertaking such a role must be able to demonstrate proven experience in the convergence of IT and OT and the three methodologies discussed earlier, as well as the ability to supply UK NSV-cleared staff.
NIS 2 compliance and beyond – a unique model of operational resilience
Failure to comply with these obligations could result in enforcement action and penalties, including fines of up to £17 million, depending on the severity and duration of the non-compliance and the harm caused.
As the new NIS 2 fast approaches, CNI's critical IT and OT systems need to evolve at pace. But as they do so, they must accommodate the operational complexity of high-availability systems and sector-specific constraints. When we give this deeper consideration, it becomes clear that the new NIS 2 is very much the latest step of a much longer journey. The decision-making involved – both now and in the years ahead – will be inherently complex, making the support of the right technology partner essential.
Contact us if you'd like to discuss anything we've covered here, and any other aspects of the new NIS 2 regulations before they come into effect. Our highly consultative approach and edge-to-core knowledge of OT and IT technology means that Vysiion are perfectly placed to support you on the journey to compliance and beyond.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
522 Hits
The UK's emergency services are undergoing a period of profound digital transformation, phasing out legacy platforms and connectivity in favour of highly secure, resilient platforms that support seamless communication and collaboration between frontline responders, control rooms, and national coordination centres.
However, when even the smallest instance of downtime has the potential to cost lives, the security of citizens' data is a growing concern, and the Operators of Essential Services' (OES') range of compliance obligations continues to evolve, the digital transformation process becomes considerably more complex. In particular, the transactional approach to acquiring IT services of any sort, particularly with regards to SaaS platforms and software licensing, is increasing showing its limitations for OESs, adding unnecessary complexity to IT estates that inevitably results in spiralling OPEX costs, unclear pricing, and an overall lack of control and visibility.
Nonetheless, a seamless procurement process is the foundation of any successful digital initiative for emergency services, and so it is clear a different approach is required…
Enterprise Agreements (EAs) - consolidated contracts that enable the purchasing of IT services at scale, with everything delivered through a single strategic partner for a predetermined period - offer an extremely attractive alternative to traditional channels of procurement.
With all existing and future licences managed through a single agreement, delivered by a single supplier, OESs can access the IT services they depend on - both in the control room and on the front line, with consistent, locked in pricing, and the ability to scale up or down, as required.
This offers a far greater level of flexibility that traditional provisioning, as surplus licences can be automatically reallocated and additional ones provisioned for the same pricing established at the outset of the agreement, and with the same end date - a 'true forward' that eliminates the cost and inefficiency of transactional IT procurement. Even with the increasingly fast pace of the emergency services' digital transformation, this allows for a more predictable budget and frequently leads to significant cost savings that can be reinvested in new service improvements, ultimately resulting in more lives saved.
The Exponential-e Group - Exponential-e, Vysiion, and Xpertex - have long championed such agreements across the public sector, including in our capacity as the only privately-owned UK Key Supplier to the Home Office's Emergency Services Network User Services Programme, and its ongoing work with the Ambulance Radio Programme (ARP). In the case of the latter, an EA has significantly streamlined the implementation of key Cisco platforms, with the Group's own teams supporting their design, delivery, and management as part of the service.
This model could easily be extended to other Trusts, and tailored to suit their unique requirements, particularly when legacy contracts are approaching their expiration. By transitioning to an EA with a trusted supplier, Trusts' own teams will dramatically simplify the management of their IT estates, without compromising their ability to scale and pivot as their operations expand and systems evolve, particularly with the upcoming launch of the ESN.
If you're ready to explore your own Trust's opportunities for digital transformation and how you can adopt a more efficient, more cost-effective approach to IT procurement, get in touch today.
If you're ready to explore your own Trust's opportunities for digital transformation and how you can adopt a more efficient, more cost-effective approach to IT procurement, get in touch today.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
392 Hits
The Cloud has fundamentally changed the way organisations across a range of sectors design, manage, and scale their IT infrastructure. In many cases, this has allowed them to stay abreast of unexpected shifts in the digital landscape while retaining full control of ongoing costs and turning their growing volumes of data into a powerful source of business insights. But when it comes to digital transformation, there's no such thing as a one-size-fits-all solution. At Vysiion, we've seen this over and over again throughout our work with organisations operating in some of the harshest environments, with some of the most rigorous security and compliance requirements.
In many such cases, where critical applications and data need to be available in as close to real-time as possible, the only answer is to locate hardware at the edge, which naturally limits opportunities for Cloud transformation. However, now more than ever, technology tends to evolve to fulfil the most specific requirements, especially when organisations and their technology partners work in close collaboration to drive new innovations. In fact, we may already be seeing such solutions emerging in response to these singular requirements…
Hyperconverged Infrastructure opens the door
to next-gen hybrid Cloud
Azure Stack HCI, for example, offers a new approach to Cloud transformation that enables specific systems to be maintained at the edge, where necessary – a true hybrid approach that allows Cloud platforms to be seamlessly integrated with edge computing environments to achieve the desired functionality.
The use of containerisation and virtual machines offers a level of control and flexibility that would be difficult, if not impossible, to execute exclusively with on-premises systems, while still ensuring data sovereignty and compliance obligations can be met. For additional layers of security and resilience, integration with Azure Security Center and Azure Defender is available, along with built-in redundancy.
All of this can be manged through a centralised control panel, allowing for complete visibility of operations and data flows, even for the most remote locations.
This approach has huge implications for AI and IoT projects at the edge, allowing for real-time monitoring and analytics, combined with intelligent automation of routine processes to maximise operational efficiency.
But, once again, this is not without its limitations, as standard hardware is rarely suitable for the harshest, most challenging environments – such as military zones, highly remote energy sites (e.g. oil rigs and offshore windfarms), or industrial conditions – which may make Azure Stack HCI challenging to implement.
Is ruggedised Azure HCI the ultimate edge computing solution for Defence, CNI, and Manufacturing?
It is clear that Azure Stack HCI's potential across these sectors is enormous. We must therefore consider how it can be implemented in such a way as to access all the possible benefits, while still maintaining the security and resilience of critical infrastructure in situations when environmental conditions may lead to failures.
However, based on a range of ongoing conversations with our customers and technology partners, we would argue that such measures are already available. By combining Azure HCI's full range of capabilities with high-quality, ruggedised hardware, true 'always-on' operations can be established, with seamless, highly secure flows of critical data between edge devices and the Cloud.
Whatever environments you operate in, and whatever your digital goals are at the edge, in the Cloud, or both, do not hesitate to contact us. Drawing on our deep experience designing bespoke digital transformation solutions to the most rigorous specifications, our teams will work closely with you to achieve your long-term goals, and so help establish a new standard of digital best practice across the most challenging sectors.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
493 Hits
It was recently reported that the Volt Typhoon group, already responsible for security breaches involving thousands of internet-connected devices - was able to access the US National Grid, where it remained undetected for more than 300 days.
This incident further reinforces that the biggest challenge in securing Critical National Infrastructure (CNI) is protecting and detecting threats within legacy assets - an issue compounded by the long lifespan of OT devices. State-sponsored groups like Volt Typhoon exploit known vulnerabilities, such as weak credentials and unpatched systems, to establish long-term footholds in critical environments.
Yet, across the industry, there remains a deep-rooted reluctance to modify or upgrade critical safety systems simply because they 'work.' The fear of operational disruption often outweighs security concerns, slowing progress at a time when the threat landscape is evolving rapidly. While this mindset is beginning to shift, change needs to happen faster.
That said, security standards cannot afford to slip. Regulations such as the new NIS 2 are now driving compliance, forcing organisations to take a more structured approach to securing OT environments. A proactive stance is essential, integrating secure-by-design principles, network segmentation, and OT-specific monitoring to detect stealthy threats before they escalate.
However, all is not lost, legacy systems can still be protected and brought into compliance without the need for a full-scale technology refresh. Targeted security measures, such as passive monitoring, compensating controls, and robust network architecture, can strengthen defences without disrupting operations. The Volt Typhoon campaign is a wake-up call - security must be a fundamental part of an OT system's lifecycle, not an afterthought.
Putting those security considerations at the heart of our approach to OT system lifecycle management at Vysiion. We have years of experience in the design and deployment of these systems, such that they are secure at the point of implementation and have been promoting (for almost as long) the value of maintaining that security through proactive monitoring and maintenance.
Whether we are talking about state-of-the art or legacy environments, we have the tools and capability to provide that protection, and support compliance to industry standards such as NIS 2. This encompasses:
- Our 24 / 7 NOC / SOC function providing around the clock monitoring and incident response capability
UTLISING
- A toolset developed by industry leaders such as Dragos, focused on identifying and responding to threats specific to the OT world.
- Maintenance teams delivering, via a secure remote access platform, proactive mitigation of threats and vulnerabilities that understand the realities of OT operation and work with customers to minimise operational impact.
ENHANCED WITH
- Field operations teams to provide on-site support and maintenance, where remote access is not feasible.
- An experienced design and delivery function, focused on the OT world, providing design leadership and guidance that recognises the commercial and operational realities that our OT customers operate within.
If you're in any way concerned about the ongoing convergence of IT and OT, the evolving regulatory landscape, or any of the increasingly complex security challenges the CNI sector must consider, don't hesitate to contact us. Our specialists are already working with OESs across the UK to establish new standards of security and resilience for the infrastructure our critical services depend on and are ready to explore your own challenges in depth, accelerating your organisation's digital journey.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
301 Hits
With manufacturing now officially incorporated into the UK's CNI sector, its overall levels of resilience and security must be reconsidered, incorporating best practice and technical innovations from other companies from across the sector (i.e. utilities and transport firms).
A key aspect of this will involve expanding manufacturers' definition of resilience beyond the safety and performance of physical machines to the integrity of the growing volumes of data generated on-site, and the cross-site connections that are increasingly powering tomorrow's interconnected workflows.
This is more than just a 'nice to have'. The recently announced Cyber Security and Resilience Bill is just the latest step in governments around the world taking proactive steps to secure public services – and the digital platforms and supply chains that support them – in an increasingly turbulent geopolitical landscape. As we close out Critical Infrastructure Security Month, the need for new standards of security and resilience across the entire CNI sector has never been higher, so let's explore the steps manufacturers can take to proactively establish this across their operations.
Optimising the resilience of manufacturing data lakes
The rise of 'smart' technologies within manufacturing operations is transforming the sector's workflows, but also significantly increasing the volumes of data that must now be stored and managed in full compliance with all CNI regulations, including the Cyber Security and Resilience Bill, EU NIS 2, and eCAF. Storing these large volumes of structured and unstructured data onsite will likely prove impractical, introducing a serious financial and operational burden, but at the same time, the need for real-time visibility of manufacturing operations, along with increasingly complex security and compliance challenges, means a full-scale move to the Cloud will not necessarily be viable.
Colocation offers an alternative way forward here, offering manufacturers a single answer to a range of data hosting challenges. By relocating specific volumes of data to dedicated space in external, geographically dispersed data centres, while keeping others on-site – potentially as part of a wider hybrid Cloud strategy – manufacturers will enjoy a whole new level of flexibility in terms of how they store and manage their data that will, in turn, bring them up to the standards of operational resilience that CNI demands.
Of course, putting all this into practice requires a world-class hosting environment…Enter your text here...
How Vysiion are providing the foundation for more resilient manufacturing across the UK
This is why Vysiion continues to maintain our presence in the Tier III Ark data centres – the Government's hosting environment of choice and the only data centres with pan-government accreditation at all security levels. As an active presence in these highly secure, eco-friendly hosting environments, we have helped organisations across a range of sectors develop approaches to data hosting that support the most complex workflows and compliance obligations, offering hands-on support throughout the migration process to minimise any disruption. This includes connections to the secure private networks utilised across manufacturing operations, where necessary.
Our presence in the Ark data centres, combined with our deep experience around 'smart' technologies, the ongoing convergence of IT and OT, and the manufacturing sector's unique workflows and operational models – plus comprehensive cyber security capabilities – means we are able to help you manage your data in the way that best suits your operations, your budget, and your evolving compliance obligations.
Just contact us if you would like to discuss your own manufacturing operations' data hosting requirements in greater depth.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
397 Hits
© 2026 Exponential-e Ltd. Reg. No. 04499567, Reg. Address:100 Leman Street, London E1 8EU