Benefits and challenges brought about by a remote approach to NISR implementation
Cyber threats to operational technology have adapted over recent years into a very real and dangerous threat to national infrastructure. More and more systems have been connected to the Internet, which has opened up more avenues for attacks, however it has also increased the potential for more holistic security view over what were once heavily siloed systems.
The Network and Information Systems Regulations (NISR) aim to ensure operators of essential services are aware of these new threats facing operational technology (OT) systems and that appropriate measures are in place to detect and manage a security breach. However, with the added complexity of remote working brought about by the COVID-19 pandemic, implementing the necessary changes to not only reduce cyber risk, but increase NISR compliance has been complicated. With increased focus on flexible remote working being present in most future business models, the specific challenges that were addressed, as well as the additional benefits that were realised during the past year will need to be taken into account in order to establish best practice. Most of these benefits and challenges will apply across multiple industries and will need to be carefully managed to help develop successfully resilient cyber enabled sectors.
Virtual engagement and building effective working relationships
Building effective working relationships to enable the successful integration of new procedures and processes is essential. With this engagement switching to be entirely virtual, the ability to understand a business and its employees, and determine effective recommendations in the context of NISR has created additional challenges which need to be monitored:
- Managing relationships without screen/email overloading of staff
- Reduced pace in understanding the business and its structure
- Difficulty in conveying unfamiliar complex regulations and their importance to staff
- Slow instant engagement due to limited reading of body language
- Diminished cyber security culture and awareness.
Cyber security upskilling without physical hands on training
Having joined a NISR project completely remotely without even stepping foot into the client’s organisation - nor having physically met the Atkins project team - came with its own difficulties. Also, having little prior cyber experience and learning purely through virtual working provided further challenges.
Developing staff understanding of cyber security solely through virtual learning can have considerable drawbacks. Without having hands on appreciation for a product or process, it can be difficult to realise its full impact on a business. To mitigate this, testing and development, as well as virtual training can be undertaken remotely on virtual machines, replicating products or processes that are to be implemented. This increases the upskilling of employees by offering tangible exposure to cyber products, providing a more ingrained and in-depth understanding of cyber security, whilst giving context to the more abstract elements of NISR.
Visualising integration complexities
In addition to an inexperience of physical training, having only remote engagement with a product reduces the ability to understand the intricacies around its capabilities, as well as its integration within the wider business. Limited physical involvement with a product means it’s more difficult to visualise the complexities in how it should be deployed and best integrated with an existing company structure. This can lead to added difficulties when conveying complexities to different areas of an organisation, which will have different perspectives on a project and different personalities to engage with, making it harder to collaborate effectively.
Increased accessibility to personnel
With the majority of non-critical personnel now working remotely, access to key personnel has actually increased since the shift to remote working. Although there have been challenges to overcome with remote engagement, there are benefits which have aided project progression and implementation velocity. These benefits include reduced travel time, more transparency with staff availability and easier access to operational personnel, especially when working with CNI businesses which are usually dispersed over a large geographic area.
Flexible approach with agile remote product deployment
To mitigate risk and to reduce the physical interaction required throughout the course of the pandemic, 3rd party contractors have been appointed to help deploy products to CNI sites. This comes with additional resourcing and project management challenges, but also provides added value to the project by being more flexible during the deployment phase. This includes:
- Reduced physical risk
- Minimised travel / expenses
- Increases flexibility as physical and virtual implementation of a solution can be separated.
Overall, there have been many learning opportunities whilst developing NISR compliance remotely, which will be applicable to most, if not all, cyber enabled sectors. Businesses in the future will need to be aware of these benefits and challenges when working across a physical and virtual operating model and effectively adjust their project teams to ensure they can level up their business to manage the changing cyber landscape.
Dan Patefield
Dan Patefield
Dan leads the techUK Cyber Security programme, having originally joined techUK in August 2017 as a Programme Manager working across the Cyber and Defence programmes. He is responsible for managing techUK's work across the cyber security eco-system, bringing industry together with key stakeholders across the public and private sectors. Dan also provides the industry secretariat for the Cyber Growth Partnership, the industry and Governmnet conduit for supporting growth across the sector. A key focus of his work is to strengthen the public-private partnership across cyber security to support further development of UK cyber security policy.
Before joining techUK he worked as Forum Lead for the Westminster eForum. In this role he had a focus on the technology and telecoms space, on issues ranging from Broadband and Mobile Infrastructure, the Internet of Things, Cyber Security, Data and diversity in tech. Dan has a BA in History from the University of Liverpool.
- Email:
- [email protected]
- Phone:
- 020 7331 2165
Jill Broom
Jill Broom
Jill is techUK’s Programme Manager for Cyber Security, working across the cyber eco-system to bring industry together with key stakeholders across the public and private sectors.
Prior to focusing in on techUK's cyber security work, Jill was also part of techUK's Central Government programme team, representing the supplier community of technology products and services to Whitehall departments.
Before joining techUK, Jill worked as a Senior Caseworker for an MP, advocating for local communities, businesses and individuals, so she is particularly committed to techUK’s vision of harnessing the power of technology to improve people’s lives. Jill is also an experienced editorial professional and has delivered copyediting and writing services for public-body and SME clients as well as publishers.
- Email:
- [email protected]
- Twitter:
- @honeybroom
- Website:
- www.techuk.org
- LinkedIn:
- https://www.linkedin.com/in/jill-broom-19aa824
Annie Collings
Annie Collings
Annie joined techUK as the Programme Manager for Cyber Security and Central Government in September 2023.
Prior to joining techUK, Annie worked as an Account Manager at PLMR Healthcomms, a specialist healthcare agency providing public affairs support to a wide range of medical technology clients. Annie also spent time as an Intern in an MPs constituency office and as an Intern at the Association of Independent Professionals and the Self-Employed.
Annie graduated from Nottingham Trent University, where she was an active member of the lacrosse society.
- Email:
- [email protected]
- Twitter:
- anniecollings24
- LinkedIn:
- https://www.linkedin.com/in/annie-collings-270150158/