The UK National Cyber Security Centre (NCSC) published guidance to help organisations design, secure, and manage Operational Technology (OT) environments. It sets out eight core principles to improve resilience, reduce exposure, and support secure architectural decision‑making. The NCSC positions these as goals rather than minimum requirements, and operators of essential services (including those within scope of the UK NIS Regulations) will find them particularly relevant.
The NCSC co‑developed the principles with international partners in Australia, Canada, the US, Germany, the Netherlands, and New Zealand.
Key Takeaways from the Eight Principles
Balance the Risks and Opportunities
Build a business case—backed by a comprehensive risk analysis—before you introduce or change OT connectivity.
Limit the Exposure of Your Connectivity
Remove unnecessary access paths and use exposure‑management measures to reduce externally reachable or uncontrolled communication routes.
Centralise and Standardise Network Connections
Use fewer, tightly controlled connection points and apply consistent security controls across the OT environment.
Use Standardised and Secure Protocols
Adopt standard, secure protocols to reduce complexity and ensure predictable, secure communications.
Harden Your OT Boundary
Harden OT boundary controls with modern, modular components you can replace as needs change.
Limit the Impact of Compromise
Use layered controls, segmentation, and containment to restrict lateral movement and minimise disruption during an incident.
Log and Monitor All Connectivity
Continuously capture and monitor OT connectivity to support early detection and response. Focus logging on: (i) unauthorised activity; (ii) anomalous behaviour; (iii) break-glass access; and (iv) data‑flow monitoring.
Establish an Isolation Plan
Define and maintain a plan to isolate OT environments during cyber incidents, aligned to business continuity processes. Confirm you can isolate sites, applications, and/or services.
Although the NCSC’s guidance is not new, it signals what the UK NCSC expects as good practice for OT connectivity. Companies should: (1) maintain clear visibility of OT environments (what connections exist, why they exist, and how OT connects to the wider IT environment); (2) assume compromise and plan for it (e.g., containment measures, recovery plans, backups, and enhanced logging); and (3) standardise procedures to reduce complexity and support consistent, resilient operations.
