Cybersecurity regulation often focuses on audits, standards and paperwork. For Carl Ketteringham, Founder and Director of Offshore Digital Engineering Limited (ODiGE), the bigger priority is how those requirements improve cybersecurity in practice.
Good cyber governance can help an energy business understand who controls its systems, who can make changes and how risk is being managed. It can also support procurement, insurance and due diligence.
Energy businesses face overlapping regulations, standards and assessment frameworks, including NIS2, the UK Network and Information Systems Regulations 2018, ISO 27001, IEC 62443 and the National Cyber Security Centre Cyber Assessment Framework (CAF).
The first challenge is establishing which requirements apply to an organisation.
In Great Britain, some operators fall under the NIS Regulations automatically when defined thresholds are met, while others may be designated by the competent authority. Across the EU, NIS2 takes a different approach based on sector and organisational size.
Supply chain companies may also be affected even when they are not directly regulated, as operators pass requirements down through:
Standards provide evidence
Standards and frameworks are not regulations themselves. Instead, they provide structured ways to demonstrate how cybersecurity requirements are being addressed.
IEC 62443 focuses on industrial automation and control systems, while ISO 27001 provides a certifiable information security management system. The CAF uses an outcome-based approach to cyber assurance.
For suppliers, Ketteringham highlights IEC 62443 in particular. Certification can provide evidence that operators use in regulatory submissions, potentially making cybersecurity capability relevant to procurement decisions.
Why operational technology is different
Operational technology (OT) creates different priorities from conventional IT.
In IT environments, confidentiality may lead cybersecurity decisions. In wind and other energy assets, availability, reliability and safety can take priority because physical equipment must continue operating safely.
Patching demonstrates the difference. Restarting a business IT system overnight may be routine, but an unexpected restart of a turbine control system could mean lost production, operational risk or warranty implications.
Governance therefore needs to establish:
This becomes more complicated when turbine controllers, converters and embedded software remain under manufacturer supply and service agreements.
Moving beyond annual compliance
Ketteringham believes that cybersecurity governance becomes inefficient when organisations rebuild their evidence shortly before each audit.
A continuously maintained record of assets, responsibilities, risks and decisions can reduce the need to reconstruct information later. It also preserves the reasoning behind decisions when personnel or suppliers change.
The commercial benefit is increasingly important. Evidence of effective governance can support prequalification questionnaires, supply chain assurance, insurance and due diligence when assets change ownership.
ODiGE’s approach is to maintain this governance position continuously with supporting evidence attached.
For Ketteringham, the objective is ultimately cultural. Cyber governance can follow a similar path to health and safety, moving from something regarded as administrative overhead towards an established part of operational competence.
When that happens, regulation becomes more than an obligation. It can provide the discipline needed to improve accountability, procurement and operational decision making.
Explore the complete industrial insight in PES Wind: https://pes.eu.com/exclusive-articles/the-half-of-cybersecurity-that-pays-you-back