Annex A: Key activities for the delivery of the strategy 2. Continuously mitigate identified issues and vulnerabilities What is happening now? aw n The civil nuclear sector have identified assets that are critical for nuclear safety and have processes in place for managing any risks identified in there systems. Successfully mitigating cyber risks is a process of continuous improvement, and the flexible approach afforded by outcome-focused regulation used in the UK offers real benefits to making this possible. It enables the industry to own and develop security solutions which most appropriately meet their unique situations as well as any risks not associated directly to nuclear regulations for safety and security (for example their own intellectual property, or issues of commercial sensitivity). Aim dr For amendments to nuclear plants and the new generation of nuclear plants to be cyber secure by design and implementation. The nuclear new build programme offers an opportunity to mitigate the cyber security risk in the design phase by a combination of both physical and cyber controls so that nuclear new build will be cyber secure by design. ith For duty holders to work with the civil nuclear supply chain to ensure that the supply chain to have the appropriate level of cyber security in their risk profile. It is important that as the civil nuclear sector improves their civil nuclear capability they also work to improve the capability of their supply chain. Duty holders are best placed to work with their supply chain to support this change. This will allow duty holders to better understand the cyber risk that they are carrying in their supply chain whilst simultaneously ensuring that the appropriate standard is being met. Our approach Implementing and refreshing appropriate good practice, controls, and mitigations Ensuring that systems and digital assets (including data) are proportionately and appropriately protected Supporting industry with access to technical assistance and tools Developing nuclear new build and other new facilities so that they are cyber secure by design Enhancing cyber security throughout the civil nuclear supply chain Identifying processes to provide appropriate assurance for (critical) digital assets W       20