Water is Critical National Infrastructure (CNI), it sits up there alongside Power Generation, Oil and Gas and Healthcare.

← Back to Blog

Water is Critical National Infrastructure (CNI), it sits up there alongside Power Generation, Oil and Gas and Healthcare. By example U.S water providers have faced significant threats from Nation State actors over the passed 2 years and it is well documented that UK water providers face elevated risk from hackers (https://lnkd.in/etjtEya3). Demonstrated by the cyber attack against Southern Water this month.

‘Three water companies — South East Water, Sutton and East Surrey Water and Portsmouth Water — all lack internal audit functions, the Chartered Institute of Internal Auditors said in a letter to Ofwat chief executive David Black, placing them at greater risk of breaching their statutory duties.’

At a time when we face a significant cybersecurity threat from nation state threat actors. How can we guarantee boards are providing the necessary oversight, assurance of cybersecurity risk, if they do not have the internal capabilities evaluate compliance? EU NIS 2 cyber regulation, although not effecting the UK directly, requires CNI providers including water companies to implement stringent cybersecurity risk management programs for a good reason. UK water companies do not have enough 3rd line resources to oversight basic financial performance, let alone complex cyber risk management.

The costs to remediating cyber attacks is significant. With water companies on the UK regulators watch list, due to their financial stability, it is surely a necessity for Water companies to have the necessary internal audit skills to oversight financial performance and cybersecurity?

@Thaddeus Dziekanowski Brian D. McCarthy

Veritas GRC

#cybersecurity #cyberriskmanagement #cni

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7168198061737910272