Executive Summary the transportation and storage of nuclear material and Sensitive Nuclear Information (SNI)3 as well as the management of legacy and waste facilities. The strategy also includes some measures of effectiveness, while recognising that the nature of cyber means these may need to be adjusted and priorities may need to change over the period the strategy covers. aw n Success at a strategic level will be the demonstrable transformation of the civil nuclear industry’s approach to cyber security (the ability to deter and protect against a cyber attack) and its cyber resilience (the ability to detect, contain, mitigate the effects of, defeat and recover from a cyber attack). Operational success will be the continued safe and secure operation of legacy and future nuclear facilities in the face of growing cyber threats. Tactical success will be an increasing capability, capacity and agility of stakeholders to deal with all aspects of the cyber security challenges faced by the UK civil nuclear sector. Our commitment to the Civil Nuclear Cyber Security Strategy:  To work in partnership to transform the UK civil nuclear sector’s approach to cyber security (the ability to deter and protect against a cyber attack) and its cyber resilience (the ability to detect, contain, mitigate the effects of, defeat and recover from a cyber attack). The UK civil nuclear duty holders4 will: dr  W ith o Establish and sustain robust, effective, agile and assurable cyber security governance arrangements; o Undertake appropriate risk management processes that pre-emptively reduce the associated risks; o Increase the sector’s capability and capacity to understand and manage cyber security risks where required; o Ensure that known cyber security vulnerabilities are mitigated, so far as is reasonably practicable; o Ensure that they are resilient to, and defend themselves against, evolving cyber threats; and, o Work with their supply chain to support and encourage them to manage and mitigate their cyber vulnerabilities. 3 https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/365957/Nuclear_Industries_S ecurity_Regulations.pdf 4 The term ‘Duty Holder’ is used to define responsible persons’ on civil licensed nuclear sites and other (unlicensed) nuclear premises subject to security regulation, as defined in the Nuclear Industries Security Regulations (NISR) 2003. It is also used to refer to a ‘Licensee’ as defined in paragraph 1 of a Nuclear Site Licence granted under the provisions of the Nuclear Installations Act 1965, or a ‘developer’ carrying out work on a nuclear construction site, as described in the Nuclear Industries Security (Amendment) Regulations 2013. 3