Annex A: Key activities for the delivery of the strategy 3. Improve the sector’s capability to detect, respond, and recover from cyber incidents What is happening now? aw n The civil nuclear sector has a strong safety culture and a mature exercising programme. To date these programmes have focused on a safety incident or mechanical failure. However industry is in the process of building up its experience in responding to a cyber incident. This has included a number of table top exercises where the communication channels between duty holders and Government have been tested. The lessons learned from these exercise have been tested as part of a technical exercise. This raised personnel’s understanding of the challenges a cyber incident poses for governance (for example smaller command chains, and the importance of record keeping), communication between the different parts of incident response (for example personnel manning perimeter defence and intrusion detection systems) as well as the need to fully understand what is on your network. dr Aim ith For organisations in the civil nuclear sector to include cyber within their exercise programme. The sector will benefit from including cyber within their incident response progamme. This would include ensuring that as part of all incidents cyber is considered as a potential vector and the necessary precautions are taken before it is ruled out. In addition, Government, industry, the regulator and other stakeholders should develop appropriate lines for a cyber incident (including speculation that cyber is the cause for a non-cyber incident). W For the civil nuclear sector to be resilient to a cyber attack. By taking part in technical exercising the sector will gain an understanding of what an adversary will do when attempting to compromise a system, and test whether they would detect an intrusion. This should result in sites being able to improve their protective monitoring and detection systems as well as provide a potential opportunity for Information Technology and Operational Technology personnel to get a broader understanding of the difference between their roles. In addition, the sector will develop plans to identify how it will respond and recover from an incident effecting one of its critical digital assets. Our approach    Ensuring that the sector has the capability to detect, defend against, and effectively respond to cyber security incidents Ensuring that robust incident management procedures are in place, mature, and well implemented across the sector Testing complex cyber incident response capability through exercising 21