NCSC UK Enhances OT Security with Water Sector Example for Connectivity Principles
The NCSC UK has released a new practical example for its Secure Connectivity Principles, specifically tailored for the water sector to improve Operational Technology (OT) security.
The UK's National Cyber Security Centre (NCSC) has published a new fictional worked example designed to illustrate the application of its Secure Connectivity Principles for Operational Technology (OT) environments. This guidance aims to help organizations, particularly those in critical infrastructure, bolster the security of their OT systems.
The new example focuses on a regional water utility, demonstrating how such an organization can approach the standardization of digital connectivity across its OT landscape while upholding essential requirements for safety, reliability, and cyber resilience. The NCSC emphasizes that this is not a prescriptive blueprint but rather a guide to using the principles as a target state, enabling organizations to make informed, risk-based decisions aligned with their unique operational contexts, regulatory obligations, and threat landscapes.
Developed in collaboration with the Industrial Control Systems Community of Interest (ICS COI) Boundary Expert Group, the example highlights the interplay between architectural choices, governance frameworks, and operational practices in achieving robust OT connectivity. It underscores the critical need to balance security, safety, reliability, and operational demands, especially when dealing with legacy infrastructure.
The fictional utility, 'Admin Corp Water,' walks through each of the eight secure connectivity principles. This practical application covers design considerations such as minimizing exposure, centralizing connectivity, managing legacy protocols, reinforcing network boundaries, and preparing for potential cyber incidents. The involvement of the ICS COI Boundary Expert Group, composed of practitioners from across critical national infrastructure sectors, ensures the guidance reflects real-world challenges faced in securing OT environments.
This release marks a significant milestone, being the first time the Boundary Expert Group has directly contributed authored content to the NCSC website. This collaborative model, where practitioner experience is combined with NCSC guidance, aims to produce practical and technically sound worked examples. The NCSC hopes to replicate this successful approach for other critical sectors, recognizing that each has distinct operational constraints, regulatory frameworks, and threat contexts.
By merging NCSC's cybersecurity expertise with the hands-on experience of those responsible for securing operational systems, this initiative seeks to make guidance more accessible and effective. The goal is to empower organizations to translate high-level principles into tangible, implementable security measures, thereby enhancing the overall cyber resilience of critical national infrastructure.