Translating the new regulatorystandards into a sustainablecyber strategy.
Keeping pace with advances in IT and OT.
Discover Exponential-e Group’s four-phase, risk-based model for achieving and maintaining full CNI cyber compliance and operational resilience.
Phase 1: CAF-A
Phase 2: CAF-B
Phase 3: CAF-C
Phase 4: CAF-D
Conclusion
As cyber-attacks on the UK’s Critical National Infrastructure (CNI) continue to escalate, the regulatory environment has evolved in response. This widening of scope embraces more organisations - particularly those who are either defined as Operators of Essential Services (OESs), or part of the critical supply chain.
The IEC-62443 standard. A series of international standards regarding the security of industrial automation and control systems (IACS), encompassing both technical and process-related areas.
The new Cyber Security and Resilience Bill. Issued in 2025, the most recent Cyber Security and Resilience Bill broadens the range of sectors subject to these regulations, brings in additional measures to accommodate the security risks presented by highly dispersed global supply chains, and aims to enhance flexibility and responsiveness in response to emerging cyber threats.
The NCSC NIS 2018 directive. Domestic UK laws that require OESs to adhere to clear standards around the security and resilience of network and information systems - both physical and digital. In December 2022, these regulations were updated to cover Managed Service Providers (MSPs).
In this document, we provide a phased, four-stage process for not only achieving full compliance with the latest Government regulations regarding the security and resilience of CNI systems, but ensuring the right systems and processes are in place to maintain compliance as the threat landscape continues to evolve. This model combines the NCSC’s Cyber Assessment Framework (CAF) guidance, IGP’s, with the Exponential-e Group’s twenty-plus years of experience of working with OESs - including organisations within the energy, healthcare, transport, emergency services, manufacturing, and Government sectors - across the UK in some of the most challenging, highly regulated environments.
CAF provides OESs with a robust framework for optimising the cyber security and resilience of critical functions, designed to support the assessment processes for the key regulations explained above.
Consisting of Exponential-e, Vysiion, and Xpertex, along with EXPO.e and EXPO.e Networks, the Exponential-e Group boasts a unique blend of experience, expertise, and technical capabilities. Working collaboratively, teams from across the Group use validated digital innovation to successfully deliver challenging, high-performance projects for critical applications across all CNI sectors, with a ‘defence-in-depth’ approach enabling true ‘peace of mind as-a-service’. Our commitment to innovation and customer satisfaction is at the forefront of our endeavours and is reflected in our nine ISO accreditations and industry leading NPS score, updated live on our website.
