Annex A: Key activities for the delivery of the strategy 4. Ensure sufficient resources are allocated to cyber security and resilience to transform capability in the sector What is happening now? aw n The sector currently has a mature and established safety culture, which has supported their cyber position. Sites are subject to inspections to ensure that they meeting their security and safety obligation. All sites have programmes in place to improve both their cyber and physical security. However, the resources allocated to cyber are usually a small percentage of the total budget Aim dr Ensuring that boards and executive directors understand their cyber risk leadership responsibilities. The improvement in the distribution of threat information from objective one will support this objective. This will allow non-executive directors to hold boards to account, and boards to make better decisions on how much resource to provide to mitigate the cyber risks, and ensure that organisations future plans are not increasing the organisation cyber risk without taking appropriate action. ith Growing the base of civil nuclear cyber security personnel. The civil nuclear sector needs to attract cyber security professionals now and in the future. To achieve this there needs to be a clear career path for cyber security professionals that are interested in joining the sector. This will be achieved by the sector taking an active role in the Cabinet Office’s cyber apprentice scheme. This will need to include a clear path for how a job holder can develop their capability and gain increasing responsibility if desired. This will be supported by providing cyber training to all professionals within the organisation, including graduates and operational technology personnel as well as encouraging regular UK personnel attendance at appropriate IAEA courses. W Our approach        Ensuring that the regulatory framework is enabling and fit for purpose Promoting an integrated approach to security and safety Ensuring that boards and executive directors understand their cyber risk leadership responsibilities and accountabilities with regard to controls and mitigations Ensuring that boards fully understand cyber risks, risk controls and risk appetite Growing the base of suitably qualified cyber security professionals in the sector Improving the cyber security proficiency and awareness of both specialists and generalist staff Growing cyber security as a fundamental component within existing organisational cultures 23