At the time many column inches were written about how the UK primary nuclear operator was managing cybersecurity, but it transpired it was not.

← Back to Blog

At the time many column inches were written about how the UK primary nuclear operator was managing cybersecurity, but it transpired it was not. The successful prosecution of Sellafield was a small demonstration that the UKs nuclear regulator was willing to take action. Albeit the fine levied on Sellafield was derisory, and not indicative of the seriousness of the failure.Both UK and US regulators have adopted a range of cybersecurity risk management frameworks. One suspects however the challenge at hand is not one of having plenty of paper to read, frameworks and standards. Its one of implementation, oversight and assurance. Or the lack of it. Worst of all in the case of Sellafield the company denied that it had failed to manage cybersecurity, unto the point the UK regulator investigated the incident. A demonstration of the culture of denial that seems to pervade. Maybe a £20mn fine and criminal and civil penalties against board members would send a clear message.@Thaddeus Dziekanowski Brian D. McCarthy Faisal KhanVeritas GRC#cybersecurity #cyberriskmanagement #cyberregulation

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7304459647334113281