11 Norm 6 (UNGGE 2015 report, paragraph 13f) – A State should not conduct or knowingly support ICT activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public; The United Kingdom recognises that states have a legitimate right to develop sovereign cyber capabilities, but in doing so each state has an obligation to ensure their use is governed in accordance with international law. On behalf of the UK, the then Attorney General Jeremy Wright QC MP set out the UK’s position on the application of international law in cyberspace, including cyber operations, in a speech at Chatham House on 23 May 201812. Norm 7 (UNGGE 2015 report, paragraph 13g) – States should take appropriate measures to protect their critical infrastructure from ICT threats, taking into account, inter alia, General Assembly resolution 58/199 (2003) “Creation of a global culture of cybersecurity and the protection of critical information infrastructure”, and other relevant resolutions; Regulatory Framework: Almost all UK critical infrastructure owned and operated by the private sector is covered by cyber regulation, requiring companies to have appropriate cyber resilience in place for their essential services, and to report cyber incidents. In 2018, the UK regulations implementing the EU Security of Networks and Information Systems (NIS) Directive came into force, representing the first instance of cross-sector CNI cyber regulation in the United Kingdom. In support of the NIS regulations the UK has produced sector-independent CNI cyber security guidance and has developed a framework which supports the assessment of the cyber resilience of regulated organisations. Also in 2018, the General Data Protection Regulation (GDPR) came into force alongside the new Data Protection Act 2018, placing a comprehensive set of new obligations on public and private sector organisations to protect all the personal data that they collect and process. The NCSC and the Information Commissioner’s Office (ICO) have developed a set of GDPR security outcomes. This guidance provides an overview of what the GDPR says about security and describes a set of securityrelated outcomes that all organisations processing personal data should seek to achieve. Mapping Critical Systems: The NCSC, lead government departments and industry have worked together to develop a process which identifies the systems that are critical to the UK CNI, including dependencies between the sectors. We have mapped the critical systems that are vital to the everyday operation of the CNI. By better understanding the interconnectedness of the various sectors, we can improve their resilience. This work will provide an overarching view of our CNI, enabling 12 https://www.gov.uk/government/speeches/cyber-and-international-law-in-the-21st-century