Executive Summary Executive Summary Civil nuclear is essential to us all, individually, and nationally n The civil nuclear sector is part of the UK’s Critical National Infrastructure (CNI)1. It generates essential baseload, low carbon electricity critical to families and businesses. It offers significant benefits in terms of security of electricity supply. The civil nuclear sector also stores, processes and transports some of the most dangerous radioactive material. aw Tackling cyber threats to civil nuclear means looking at risks posed by legacy systems as well as future equipment dr Nuclear safety and nuclear security are essential to any nuclear operation. Computers and electronic controls play a part in all civil nuclear facilities – in design, commissioning, and operation. As the UK is on the verge of constructing a new fleet of nuclear reactors to take us through to the middle of this century, the sector is facing the challenge of protecting legacy facilities, new build projects and supply chains for civil nuclear from cyber attacks. These attacks could disrupt supply, damage facilities, delay hazard and risk reduction, and risk adverse impacts to workers, the public or the environment. This strategy sets out what cyber risks will be addressed, by whom, when, and how success will be measured W ith The National Cyber Security Strategy set out the Government’s overarching plan “to make Britain confident, capable and resilient in a fast-moving digital world.”2 This strategy specifically supports the Government in ensuring that the UK has a secure and resilient energy system, by ensuring that the civil nuclear sector is able to defend against, recover from, and is resilient to evolving cyber threats. This enables the sector to continue to produce secure, affordable and clean energy. The strategy will also support the safe, responsible and cost effective management of the UK’s energy legacy. This strategy sets out a path to keeping the UK civil nuclear sector ahead of rapidly evolving threats to, and vulnerabilities in, software and equipment in the next five years. It sets out clear expectations, and what roles the industry, Government, and regulators need to play. It has been produced with sector consultation, to set stretching but achievable ambitions to address the risks to safe and secure operation of civil nuclear facilities and 1 http://www.cpni.gov.uk/about/cni/ https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/567242/national_cyber_secur ity_strategy_2016.pdf 2 2