Annex A: Key activities for the delivery of the strategy Annex A: Key activities for the delivery of the strategy n 1. Develop a comprehensive understanding of the cyber risks across the civil nuclear sector What is happening now? dr Aim aw The Centre for the Protection of National Infrastructure (CPNI) and CESG gather intelligence and provide advice upon on the current and future threat that cyber poses to the civil nuclear sector. This information is being shared with industry via senior boards, and on the CISP Platform. In addition CPNI host information exchanges where organisations discuss where issues have arisen on-site and solutions they are using to mitigate these risks. These outputs will be delivered by the National Cyber Security Centre following its launch in autumn 2016. ith For the civil nuclear sector to share and receive threat information within the sector and with Government in an effective and timely manner. The improvement in the distribution of threat information will raise senior managers’ and boards’ awareness and understanding of the threat cyber attacks pose to their organisation. This can include changing the way this information is presented to include further guidance on the potential financial and reputational cost of a successful cyber attack if the issue is not mitigated. W The improvement of information sharing within the sector will allow organisations to change their threat posture, and benefit from the other sites experiences of how to manage and mitigate cyber issues. As organisations are reliant on the credibility of the civil nuclear sector as a whole, all parties are incentivised to agree to a solution For the civil nuclear sector to have identified all of its critical cyber assets and systems, for these assets and systems to have an owner, incident response and recovery plan. As part of the move to outcome focused regulation, duty holders are required to understand and own the risk that cyber poses to them. To achieve this industry are required to identify all of critical cyber assets and identify the risk of compromise and the potential impact of compromise. Duty holder will use this information to prioritise resources to assets that represent that cyber poses the biggest impact13. Areas of vulnerability can be effectively managed and mitigated by improving cyber hygiene (for 13 Impact is equal to risk of compromise multiplied by potential consequence of compromise. 18