Securing Critical National Infrastructure

CNI security and resilience are now a shared legal obligation. Time to invest.

16th September 2025 • Online

CISOs face more scrutiny, more firms in scope, broader duties, and a stronger regulatory environment. Organisations found wanting will be in trouble.

 

More security investment is both compulsory and a strategic opportunity

The UK faces increasingly severe and frequent cyber threats from hostile states and cybercriminals. Recent incidents (e.g. ransomware attack on NHS suppliers) illustrate real-world impacts of cyber breaches. Supply chains are a major vulnerability, and current resilience is not improving fast enough.

The case for change is obvious: The current framework, based on the NIS Regulations 2018, is outdated and narrowly scoped. The next set of UK legislation aims to expand and modernise these regulations to match today’s threat landscape. And it aligns with the EU’s NIS2 directive while reflecting UK-specific needs. Of course, in the EU, and for anyone who wishes to do business there, things are moving even faster.

CISOs face expanding regulatory scope and empowered regulators:

  • Managed Service Providers (MSPs) to be brought under regulation due to their critical IT roles.
  • Supply chain security strengthened by allowing regulators to designate “Critical Suppliers” subject to new duties.
  • Stronger technical standards and methodological requirements aligned with the NCSC Cyber Assessment Framework.
  • Enhanced incident reporting (within 24–72 hours), including obligations for customer notifications.
  • ICO granted proactive powers to collect data and act before incidents.
  • Introduction of modern cost recovery mechanisms to make regulators financially self-sustaining.
  • Delegated powers for the Secretary of State to swiftly update regulations without new primary legislation.

So, what does this mean for CNI organisations and those who service them?

  • Businesses, especially MSPs and digital service providers, will face new compliance and reporting duties. Critical SMEs and other third parties may also come under regulation if they support essential services.
  • Your organisation may now be in scope, especially if you offer or rely on managed services, data centres, or critical suppliers.
  • Incidents affecting confidentiality, availability, or integrity must be reported within 24–72 hours –not just service disruptions.
  • Regulators can now designate specific third parties as Critical Suppliers –you may be liable for their cyber failings.
  • Expect proactive enforcement, more detailed technical standards (aligned with the NCSC CAF), and fee-based funding of oversight.
  • The Secretary of State may direct your firm or regulator to take urgent action in response to national security threats.

Increased regulation looks like a burden –and it certainly means more investment in security. But it is also a strategic opportunity.

  • Regulatory clarity means less ambiguity on cyber expectations.
  • Proactive compliance and supply chain hygiene can become competitive advantages.
  • This is a call to CNI security professionals to harden your risk posture before enforcement catches up.

This is a national infrastructure priority and CISOs must lead the shift from compliance minimalism to strategic cyber resilience.

 

The e-Crime & Cybersecurity CNI Summit will take place online and will look at how cybersecurity teams are tackling this new world.
Join our real-life case studies and in-depth technical sessions from the security and privacy teams behind some of the world’s most admired brands. 

View details of the previous event

  • Regulation – changing the game in cybersecurity?

    • Regulations are expanding the scope of who is included in CNI and the levels of accountability for firms and senior officers.
    • So how does this new regulatory environment change the cybersecurity calculus? How do new reporting duties affect you?
    • What happens if you are designated a critical third party? What do firms need to do now?

  • Securing Arm’s Length Bodies – a systemic issue

    • The neglect of cybersecurity in ALBs is a systemic issue driven by low budgets, weak oversight, outdated IT, and a lack of security culture.
    • ALBs need help to impose cybersecurity standards (e.g., mandatory NCSC frameworks), help with security culture and training and help with incident response and other core security functions.
    • Can you help them with these challenges?

  • A better approach to outsourcing cybersecurity

    • While outsourcing cybersecurity can improve security posture, organisations must retain key in-house cybersecurity expertise.
    • They need to oversee vendors, ensure clear contract terms and SLAs and regularly audit security providers to assess compliance and performance.
    • Can you help them adopt a hybrid model, where critical security functions remain inhouse while external providers handle specific tasks?

  • Managing insider threats at a time of crisis

    • When economies are under stress, employees too can find themselves in financial difficulty. When geopolitical tensions rise, people can take sides.
    • Insider threats of various kinds become far more prevalent and dangerous at times like these.
    • How have security and other MIS tools matured to make detecting malicious insiders easier and more accurate?

  • Securing legacy technology

    • It isn’t just the EOL of Windows 10 – though that is clearly a big deal.
    • Public Sector organisations need to ensure legacy systems that cannot be replaced are isolated, monitored, and mitigated by compensating controls.
    • Can segmentation, virtual patching, data encryption, emulation, and secure API gateways help? What are your solutions?

  • From cybercrime to cyberwar

    • Blurred lines between cyber-spies, cybercriminals and cyber-armies have transformed the (in)security landscape.
    • Nation-state exploits are now widely available.
    • How can the various elements of government work better with private sector solution providers and endusers to build security that can cope with not-quite-nation-state attackers?

  • Developing a risk-based approach to the Cloud

    • It’s hard to square the need for national security with Cloud usage. Major defence contractors avoid it completely.
    • So, what about critical sector such as healthcare or HMRC or nuclear energy or border control.
    • What does a balanced Cloud strategy look like – given the choice may be between crumbling legacy systems and Cloud? How can risks be reduced to acceptable levels?

  • The ultimate third-party problem

    • The public sector’s dependency on third-parties is complete. This is one of the great unsolved problems in general cybersecurity.
    • How should the public sector go about managing the risk? What should it prioritise in both its own security practices and in its suppliers?
    • And what kinds of security architecture and solutions should these organisations look to implement asap?

  • Upskilling security teams

    • Organisations have limited budgets
    • The skills shortage in security staff is growing
    • This dynamic affects the type of on prem security operation firms can employ
    • So how can CISOs continuously upskill their teams?

  • Ransomware – dealing with the new normal

    • The US Treasury reported that companies paid an estimated $5.2 billion in BitCoin transactions due to ransomware payments for companies in 2021
    • Only a quarter of ransomware attacks are reported
    • Ransomware is here to stay. So how can CISOs stop it being a permanent tax on the business?

  • Embracing risk management

    • Until cybersecurity is truly seen as risk management and not a whack-a-mole IT problem, the hackers will continue to evade outmoded control frameworks
    • Part of this is down to CISOs, part of it to Boards and part of it to solution providers
    • The banks have done it. When will the rest of business catch up?

  • Cloud incident response

    • Recent Cloud outages have not simply disrupted low-level infrastructure.
    • They have disabled cybersecurity solutions and sometimes shut down corporate access to critical network assets.
    • As well as managing Cloud security, CISOs need good Cloud incident response. How are they going about it?

Who attends

Job titles

PCI Manager
Senior Internal Auditor
Payments Design Authority
OT Security Analyst
CIO
Chief Information Security Officer
Information Security Engineering Principal - Head of Technical IS Assurance & GRC Platforms
GRC Manager
Programme Manager
Director of Financial Operations
Cyber Security Analyst
OT Technical Director
InfoSec Manager - Digital Investigations & Forensics
Principle InfoSec Architect
Global PCI Analyst
Head of Security Architecture
Lead Security & Compliance
Information Security Officer
Security Assurance Analyst
Head of Information Security
IT Compliance Manager
IPR Manager - Data and Technology
Group CISO
Principle Security Engineer
Senior Project Manager
I.T. Security Manager
Security Eng
Security Programme Manager
Security Training and Awareness Manager
Head of Client Onboarding
Lead Enterprise Security Architect
Information Security Specialist
Information Security Operational Analyst
Information Security Manager
Senior Information Security Officer
Group Chief Information Security Officer
Head of Detection and Response
Cyber Intelligence Specialist
Operational Audit Manager
Group CISO - Interim
Information Security Analyst
Global Head of Security Architecture
MD
Head of Cyber Security
Group Information Security Manager
Divisional Information Security Officer
IT
Information Security Analyst
Cyber Security Manager - ‪Penetration Testing
Senior Security Engineering Manager
Director of Information Security
Business Professional
Cyber Security Manager
Head of Technology & Payments
Chief Risk Officer
Information Security Risk & Assurance Specialist
Cyber Security Analyst
Cybersecurity Architect
Manager, GMS Europe
Cyber Compliance Analyst
Senior Cyber Security Consultant
Senior Security Product Manager
Product Manager
Finance Project Manager
Compliance and Security Analyst
Data Protection Administrator
SOC Analyst
Group Head of Security Engineering and Product Security
Vice President Cyber Security
IS Security Support Engineer
Payments Strategy Associate
Cyber Security Consultant
Head of Information Security Assurance
Head of Information Security
Director of Information Security
Senior Security Manager
Senior Information Security Manager
Data Protection/Cyber Security Manager
IT Security Manager
Payment Security Manager
Compliance and Audit Manager
Card Systems Specialist
Information Security Consultant
Senior GRC Operations Analyst
Information Security Manager
Cyber Security Risk and Compliance
Payment Operations and Assurance Manager
Security Operations Lead
Information Security Manager
Cyber Intelligence Specialist
Lead Cyber Authority
IT Security Manager
Digital Safety Compliance Analyst
Information Security Manager
IT Compliance Manager
SOC Manager
Group Application Security Manager
Head of Data Protection and Privacy
Cyber Security - OT Security Product Manager
Information Security Risk & Assurance Specialist
Cyber Security Change Manager
Head of IT Compliance
Information Security Analyst
Information security Manager
IT Risk and Compliance Analyst
Head of Group Management Services Europe
Cybersecurity Security
Cybersecurity Manager
Cyber Security Operations Lead
Team Lead, Card Systems UK and Ireland
PCI DSS Compliance Lead
Senior Cyber Security Analyst
Payments Acceptance Manager
Project Manager
Cyber Governance Consultant
Head of Security Risk, Assurance & Compliance
Assistant Manager Internal Audit
Assistant Manager Internal Audit
Group Data Protection Officer
Senior Manager Information Security
Head of Cyber Regulation and Policy
Domain Architect-Payments
Head of Cyber Development and Assurance
Cyber Compliance Analyst
Group Data Protection Administrator
CISO
Head of Data Engineering & Data Platform
Payments Compliance Product Owner
Senior Manager-Cyber Security
Director of Security Strategy and Governance, Risk & Compliance
IPR Analyst
Senior Infrastructure Security Architect
Information Security Manager
Director of IT
Payment solution designer
Cloud Security Threat & Vulnerability Specialist
Internal Audit Manager
Editor
Head of Global Cyber Security
Cyber Security Analyst
Cyber risk and compliance analyst
IS/IT Audit Manager
UK Security Operations Manager
Product Manager (Compliance Frameworks)
Platform Security Manager
Global PCI Lead
Cyber Security Architect
Digital Safety Compliance Manager
Cyber Security Manager
Global Head of Cyber Governance, Risk and Control
Lead Security Architect
Security Compliance Manager
Head of Information Security Services
Cyber Security Manager
Director, Security Operations
Information Security Risk and Assurance Specialist
Associate Director
Cybersecurity
Head of Security and Compliance
Head of DevOps
CISO
Principal Cloud Security Engineer
Chief Information Security Officer
Cyber Risk & Assurance Manager
Head of Security Data Science
Information Security Manager
Project Manager - Cyber Security
Head of Information Security
Cyber Security Analyst
Identity and Security Analyst
Security Consultant
Solution Architect - PCI

Companies

EasyJet
Formula 1
Vodafone
BT
Pennon Group
Ocado
Which?
Brambles Industries
Hutchison 3G UK Ltd t/as Three UK
Tata Communications
Sky
IMG Media Limited
Wejo
Which?
Virgin Media O2
Trainline
Heathrow
Pearson
BP
Sky
BBC
Network Rail
Toyota PLC
Vodafone
Post Office
BP
Sky
Virgin Media O2
EasyJet
A.P. Moller - Maersk
South Western Railway
British Car Auctions (BCA)
Hutchison Whampoa (Europe) Limited
Manchester Airports Group (MAG)
National Highways
Hutchison 3G UK Ltd t/as Three UK
Sky
Informa
Pearson
BBC
The Walt Disney Company
Hutchison Whampoa (Europe) Limited
National Grid
BT
Wessex Water plc
Valero Energy Corporation
Virgin Media
Sky
SSEN Transmission
RATP Dev
Virgin Media O2
BP
Pearson
Sky
BBC
Cadent Gas
National Grid
Constellation Automotive Group
DPD (UK)
BP
Informa
Transport for Greater Manchester (TfGM)
Associated British Ports
Network Rail
Rail Delivery Group
Informa
Transport for London (TfL)
International Airlines Group (IAG)
BT
Sky
BBC
OVO Group
British Airways
Tesco Mobile
Contact Centre Panel
Communisis
Hutchison 3G UK Ltd t/as Three UK
Aston Martin Lagonda Limited
OVO Group
Virgin Media O2
Sky
Ocado
Reward Gateway
Hutchison 3G UK Ltd t/as Three UK
Rail Delivery Group
DHL
North Sea Transition Authority
Vodafone
South Western Railway
Sky
BT
British Car Auctions (BCA)
Toyota PLC
Manchester Airports Group (MAG)
Transport for London (TfL)
Trainline
BBC
Post Office
Scottish Water
UK Power Networks
Trainline
Hutchison Whampoa (Europe) Limited
Pearson
ETEL (European Tyre Enterprise Ltd)
Sky
Virgin Media O2
BP
Vodafone
Hutchison 3G UK Ltd t/as Three UK
TieTa
WPP Group
Giffgaff
Avanti West Coast
M&C Saatchi Ltd
Formula 1
The AA
OVO Group
Cadent Gas
Sky
Arriva Group
Associated British Ports
Delinian Limited
Alesther
Springer Nature
Ocado
Delinian Limited
Telia Company
M&C Saatchi Ltd
Sky
Hutchison Whampoa (Europe) Limited
British Airways
Valero Energy Corporation
Virgin Media O2
BT
FedEx
Transport for Greater Manchester (TfGM)
ETEL (European Tyre Enterprise Ltd)
Constellation Automotive Group
Hutchison Whampoa (Europe) Limited
Financial Times (FT)
Communisis
Pearson
A.P. Moller - Maersk
Vodafone
Heathrow
British Airways
Woven by Toyota
Sky
ETEL (European Tyre Enterprise Ltd)
Transport for London (TfL)
Pearson
Trainline
TieTa
Vodafone
Post Office
Liberty Global
Virtually Informed
Condé Nast
Cadent Gas
Manchester Airports Group (MAG)
WPP Group
Sky
Taylor & Francis Group
Pearson
BP
Virgin Media O2
Vodafone
Hutchison Whampoa (Europe) Limited
BBC
Penguin Random House
British Airways
Sky

Employee Size

10,000+
10,000+
10,000+
1000-1999
10,000+
10,000+
10,000+
10,000+
10,000+
10,000+
5000-9999
10,000+
10,000+
10,000+
10,000+
10,000+
500-999
3000-4999
10,000+
100-499
10,000+
10,000+
10,000+
10,000+
10,000+
10,000+
10,000+
10,000+
5000-9999
100-499
10,000+
100-499
3000-4999
1000-1999
1000-1999
5000-9999
10,000+
5000-9999
10,000+
10,000+
3000-4999
1000-1999
1-99
10,000+
10,000+
1000-1999
10,000+
1000-1999
10,000+
10,000+
10,000+
10,000+
3000-4999
1-99
1000-1999
5000-9999
3000-4999
10,000+
10,000+
10,000+
10,000+
10,000+
10,000+
10,000+
500-999
3000-4999
10,000+
10,000+
1000-1999
10,000+
10,000+
10,000+
1000-1999
10,000+
500-999
5000-9999
100-499
10,000+
100-499
10,000+
2000-2999
10,000+
10,000+
1000-1999
500-999
5000-9999
10,000+
10,000+
10,000+
10,000+
10,000+
10,000+
5000-9999
10,000+
2000-2999
1000-1999
10,000+
5000-9999
10,000+
5000-9999
1000-1999
10,000+
10,000+
10,000+
10,000+
10,000+
10,000+
10,000+
1000-1999
10,000+
10,000+
10,000+
5000-9999
1000-1999
5000-9999
10,000+
10,000+
10,000+
3000-4999
10,000+
10,000+
10,000+
5000-9999
10,000+
3000-4999
10,000+
1000-1999
10,000+
10,000+
10,000+
10,000+
10,000+
10,000+
100-499
10,000+
5000-9999
10,000+
Jan-99
5000-9999
5000-9999
5000-9999
10,000+
1000-1999
3000-4999
10,000+
10,000+
10,000+
5000-9999
1000-1999
10,000+
10,000+
2000-2999
10,000+
500-999
10,000+
5000-9999
10,000+
10,000+
3000-4999
100-499
500-999
10,000+
10,000+
5000-9999
10,000+
10,000+
10,000+
10,000+
10,000+
500-999
10,000+
5000-9999