What keeps Energy & Utilities IT leaders awake
NCSC CAF Profile A + NIS2 OES obligations
Operators of Essential Services face NCSC Cyber Assessment Framework expectations + NIS2 incident reporting (24h initial, 72h significant) + specific Article 21 risk-management measures. Most utilities have CAF gaps they haven't evidenced yet.
OT / ICS visibility most teams don't have
Substations, water treatment SCADA, gas pressure-reduction stations, generation control systems — the asset register is often a 10-year-old spreadsheet. You can't protect what you can't see. Passive OT asset discovery is the starting point.
IT/OT segmentation + Purdue model reality
IEC 62443 zone/conduit segmentation between corporate IT (Level 5) and operations (Levels 0-3) is the theory. The reality is engineering laptops that move between both, vendor remote-access for OEM maintenance, and historian data flows that exist for good business reasons.
OEM remote access for plant maintenance
Siemens, ABB, Honeywell, Schneider, GE Vernova all need remote access to the kit they sold you for warranty + diagnostics. The default is "VPN with shared password to a flat OT network" — which is the threat-modelling worst-case.
Engineered for energy & utilities reality
NCSC CAF gap analysis + remediation
Servnet maps your current posture to NCSC Cyber Assessment Framework objectives + indicators. Prioritised remediation plan tied to NIS2 Article 21 risk-management measures. Evidence pack for your competent authority.
OT asset discovery + visibility
Claroty, Nozomi Networks or Dragos for passive OT asset discovery — builds the asset register you didn't know you needed. Network anomaly detection for ICS protocols (Modbus, DNP3, IEC 61850, OPC-UA).
Purdue-model segmentation + jump server
Fortinet or Palo Alto firewalls enforcing IEC 62443 zones. Privileged Access Management (CyberArk, BeyondTrust) for engineering-laptop and OEM remote-vendor access through a hardened jump server. No flat L2/L3 between zones.
SIEM / 24×7 SOC tuned for OT signals
Microsoft Sentinel, Splunk, or LogRhythm tuned to surface ICS-relevant alerts (unauthorised engineering changes, anomalous OPC traffic, PLC firmware change events). Co-managed SOC or fully-managed MDR options.
The frameworks Servnet supports
NIS2 Directive
Operators of Essential Services in energy, water, transport, healthcare in scope; Article 21 controls + incident reporting are mandatory.
NCSC Cyber Assessment Framework
Profile A for CNI; Profile B for important entities. UK reg expectation for OES sectors.
IEC 62443
International standard for industrial automation + control system security — the zone/conduit model.
Ofgem RIIO + Ofwat AMP
Sector-specific price-control settlements increasingly include cyber resilience expectations.
ISO 27001 + ISO 27019
ISO 27019 extends 27001 for energy sector ICS — adopted by larger DNOs and water companies.
CPNI / NPSA guidance
National Protective Security Authority guidance for protecting CNI from cyber + physical threats.
Customer profiles served
- ✓Distribution Network Operators (DNOs)
- ✓Water companies (clean + waste)
- ✓Generation operators (gas, biomass, renewable, energy storage)
- ✓Energy supply licensees + retailers
- ✓Smart meter and grid-edge IoT operators
- ✓Heat-network operators + EV charging networks
Energy & Utilities IT FAQs
Do you understand NIS2 + NCSC Cyber Assessment Framework?
Yes — Servnet runs CAF gap analyses against Profile A or B (depending on your sector + scope), maps gaps to NIS2 Article 21 controls, and supports the evidence pack your competent authority will request. Most OES customers complete gap-to-remediation in 4-6 months.
Can you deploy OT asset discovery (Claroty, Nozomi, Dragos)?
Yes — we partner with Claroty, Nozomi Networks and Dragos for passive OT asset discovery deployments. Most operators uncover 20-40% more OT assets than their spreadsheet asset register listed, often including unauthorised engineering laptops.
Do you provide IEC 62443 zone/conduit segmentation?
Yes — Fortinet or Palo Alto firewall-led zone/conduit segmentation aligned to IEC 62443-3-3 system security levels. Includes the engineering / vendor remote-access controls through hardened jump servers that pass NCSC CAF scrutiny.
Can you support OT-aware SIEM + 24×7 SOC monitoring?
Yes — Microsoft Sentinel, Splunk and LogRhythm SIEM deployments tuned for ICS protocols, plus co-managed or fully-managed SOC options. Critical-infrastructure customers typically run 24×7 monitoring with sub-15-minute alert investigation SLAs.
Energy & Utilities IT briefing — monthly
Vendor releases, energy & utilities-specific security alerts and compliance updates relevant to UK energy & utilities IT teams. Once a month, easy unsubscribe.
You can unsubscribe at any time. We never share email addresses with third parties.
Ready to talk to a Energy & Utilities IT specialist?
One conversation. No sales script, no obligation, no auto-renewals. We'll scope the technical detail and price honestly.