It is no secret that cyber security is a priority for all sectors, as threats evolve in terms of frequency, scale, and sophistication. However, for Operators of Essential Services (OESs), this is just part of a larger, more complex picture. With the ongoing convergence of IT and OT and the resulting drive for an integrated approach to physical and cyber security, combined with increasingly complex compliance obligations, a more considered approach to the design and implementation of security ecosystems is needed.
A 'secure by design' approach.
It's no accident that we at Vysiion describe our delivery process, service and solution portfolio in this way - not just in relation to the cyber components of the delivery, but the systems, controls, and governance used in our delivery of mission-critical infrastructure into the most challenging environments, for the most stringently regulated sectors.
The Vysiion view, robust security is not a retrofit - it needs to be inherent in both approach and design, taking process, controls, hardware, and software into consideration, and ensuring stakeholders are aware of their roles and responsibilities.
So, taking a step back and considering how this works in practice, and from the earliest stages of a project...
An established project management methodology will include the creation of a risks and methods document, ensure the right security and risk management specialists have been engaged, and that processes are in place that follow best practice throughout each phase of delivery. A 'secure by design' approach takes this further by considering the full range of IT and OT security systems and processes that will overlay every element of the project - validated against the relevant frameworks and regulations, with the latest threat intelligence used to pinpoint the areas of greatest risk. Crucially, this includes all elements of the proposed supply chain, as these represent an increasingly common target for cyberattacks as a means of gaining backdoor access to critical data and infrastructure.
A rigorous, standards-based approach is essential, as OESs' regulatory obligations are rapidly evolving in response to the complexity of IT / OT systems, with regulations like NIS (2018) reflecting the larger attack surface created by this new breed of infrastructure.
As such, the following standards should be considered as the baseline for establishing secure, integrated IT and OT systems:
A rigorous, standards-based approach is essential, as OESs' regulatory obligations are rapidly evolving in response to the complexity of IT / OT systems, with regulations like NIS (2018) reflecting the larger attack surface created by this new breed of infrastructure.
As such, the following standards should be considered as the baseline for establishing secure, integrated IT and OT systems:
- ISO 27001. The globally recognised standard for information security.
- NIS (2018). Measures to optimise the resilience (both physical and cyber) of network and information systems.
- Cyber Assessment Framework (CAF). A systematic approach to measuring multiple aspects of cyber risk, maintained by the NCSC.
- IEC-62443. A framework for mitigating security vulnerabilities in the design and operation of critical infrastructure.
- Cyber Assurance of Physical Security Systems (CAPSS). Assurance for physical security systems.
Do not make assumptions here. The regulatory environment is increasingly rigorous, with standards and frameworks extending to organisations and market verticals previously exempt. For example, some manufacturers are now regarded as part of the UK's CNI sector and must be able to demonstrate appropriate and proportionate consideration has been given to the same regulatory and compliance goals.
Once the applicable standards have been identified, their robust principles can be adopted throughout the design and implementation phases and beyond, utilising proven methodologies like the Purdue Model to ensure dataflows and physical assets are identified and documented, and proactive monitoring of the potential attack surface is maintained (and automated, where appropriate). This should be subject to regular review using collated security data and the most up-to-date threat intelligence, and supported by a responsive maintenance capability, 24 / 7 support and monitoring, and regular auditing.
Once the applicable standards have been identified, their robust principles can be adopted throughout the design and implementation phases and beyond, utilising proven methodologies like the Purdue Model to ensure dataflows and physical assets are identified and documented, and proactive monitoring of the potential attack surface is maintained (and automated, where appropriate). This should be subject to regular review using collated security data and the most up-to-date threat intelligence, and supported by a responsive maintenance capability, 24 / 7 support and monitoring, and regular auditing.
The actual execution and impact of this approach will naturally vary from project to project and sector to sector, but it is essential that all OESs, their technology partners, and all organisations acting as part of their supply chains are ready and willing to adopt these principles, not only to fulfil their specific compliance obligations, but to ensure their services remain secure and available to citizens across the UK.
In this way, the 'secure by design' approach represents a powerful investment in your organisation's future, ensuring the continued availability and integrity of the critical product or service you provide.
Whatever the nature of your next project, if you are ready to adopt a 'secure by design' approach, don't hesitate to contact us. We will collaborate with you to establish an appropriate and proportionate approach, aligned with industry best practice and regulatory compliance, and drawing on our deep experience as an experienced supplier to the Defence, Energy, and wider CNI sectors.
In this way, the 'secure by design' approach represents a powerful investment in your organisation's future, ensuring the continued availability and integrity of the critical product or service you provide.
Whatever the nature of your next project, if you are ready to adopt a 'secure by design' approach, don't hesitate to contact us. We will collaborate with you to establish an appropriate and proportionate approach, aligned with industry best practice and regulatory compliance, and drawing on our deep experience as an experienced supplier to the Defence, Energy, and wider CNI sectors.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
679 Hits
It was recently reported that the Volt Typhoon group, already responsible for security breaches involving thousands of internet-connected devices - was able to access the US National Grid, where it remained undetected for more than 300 days.
This incident further reinforces that the biggest challenge in securing Critical National Infrastructure (CNI) is protecting and detecting threats within legacy assets - an issue compounded by the long lifespan of OT devices. State-sponsored groups like Volt Typhoon exploit known vulnerabilities, such as weak credentials and unpatched systems, to establish long-term footholds in critical environments.
Yet, across the industry, there remains a deep-rooted reluctance to modify or upgrade critical safety systems simply because they 'work.' The fear of operational disruption often outweighs security concerns, slowing progress at a time when the threat landscape is evolving rapidly. While this mindset is beginning to shift, change needs to happen faster.
That said, security standards cannot afford to slip. Regulations such as the new NIS 2 are now driving compliance, forcing organisations to take a more structured approach to securing OT environments. A proactive stance is essential, integrating secure-by-design principles, network segmentation, and OT-specific monitoring to detect stealthy threats before they escalate.
However, all is not lost, legacy systems can still be protected and brought into compliance without the need for a full-scale technology refresh. Targeted security measures, such as passive monitoring, compensating controls, and robust network architecture, can strengthen defences without disrupting operations. The Volt Typhoon campaign is a wake-up call - security must be a fundamental part of an OT system's lifecycle, not an afterthought.
Putting those security considerations at the heart of our approach to OT system lifecycle management at Vysiion. We have years of experience in the design and deployment of these systems, such that they are secure at the point of implementation and have been promoting (for almost as long) the value of maintaining that security through proactive monitoring and maintenance.
Whether we are talking about state-of-the art or legacy environments, we have the tools and capability to provide that protection, and support compliance to industry standards such as NIS 2. This encompasses:
- Our 24 / 7 NOC / SOC function providing around the clock monitoring and incident response capability
UTLISING
- A toolset developed by industry leaders such as Dragos, focused on identifying and responding to threats specific to the OT world.
- Maintenance teams delivering, via a secure remote access platform, proactive mitigation of threats and vulnerabilities that understand the realities of OT operation and work with customers to minimise operational impact.
ENHANCED WITH
- Field operations teams to provide on-site support and maintenance, where remote access is not feasible.
- An experienced design and delivery function, focused on the OT world, providing design leadership and guidance that recognises the commercial and operational realities that our OT customers operate within.
If you're in any way concerned about the ongoing convergence of IT and OT, the evolving regulatory landscape, or any of the increasingly complex security challenges the CNI sector must consider, don't hesitate to contact us. Our specialists are already working with OESs across the UK to establish new standards of security and resilience for the infrastructure our critical services depend on and are ready to explore your own challenges in depth, accelerating your organisation's digital journey.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
380 Hits
© 2026 Exponential-e Ltd. Reg. No. 04499567, Reg. Address:100 Leman Street, London E1 8EU