Introduction
The UK Government Cyber Action Plan (January 2026) sets a clear direction for strengthening cyber security and digital resilience across across government and the wider public sector, with a strong emphasis on measurable outcomes and minimising disruption to public services. In the Ministerial Foreword, it is positioned alongside the Cyber Security and Resilience Bill—aimed at better preventing disruption to essential and digital services, including drinking water providers, transport and energy—while the Action Plan sets the equivalent standards and operating model for government.. It is not a technical handbook for operators, but it defines an operating model for government organisations—one that OT-heavy organisations may find useful to translate into their own governance, assurance and recovery practices: clear risk ownership, mandatory requirements (within government) and assurance, shared protective services, supply chain expectations, and coordinated incident response and recovery.For operators of cyber-physical systems, the critical question is not whether the policy intent is sound—it’s whether resilience can be made measurable, defensible, and prioritised under real operational constraints. That is where OT-specific Cyber Risk Quantification (CRQ) helps: it converts OT realities (loss of view/control, degraded throughput, process upset, and prolonged recovery) into decision-grade measures that governance bodies can fund, assure, and escalate with confidence.
This article is an interpretation of the Government Cyber Action Plan’s operating model and outcomes-led approach, and discusses how similar governance, assurance, and recovery disciplines can be applied in OT-heavy environments and essential service operations. It is not official UK Government guidance, and sector operators should also consult applicable regulations and their competent authorities.
Key takeaways
- Essential services share OT-driven risk patterns where disruption, loss of control, and complex recovery often carry the highest consequence.
- The plan’s strongest value is its operating model: accountability, assurance, supplier discipline, and coordinated recovery.
- OT-specific CRQ turns intent into action by quantifying scenarios and enabling prioritised investment, assurance reporting, and dependency risk management.
Cyber risk realities shared by drinking water, transport, and energy
These sectors share risk characteristics that make cyber resilience a national priority:
- High consequence of service disruption: the primary harms are often loss of availability, degraded control, or degraded service rather than data loss.
- Legacy and long-lived operational environments: technology refresh cycles can be measured in decades, and always-on operations constrain patching and change windows.
- Interconnected dependencies and supply chains: shared vendors, platforms, integrators, and managed services create correlated failure modes that can propagate across multiple operators.
- Blended cyber and operational response: effective recovery often requires coordinated action across engineering, operations, safety, and external partners—not only IT security teams.
Sector perspectives
Drinking water: securing treatment and distribution as safety-relevant operations
Key cyber risk drivers:
- Integrity and safety considerations: loss of confidence in telemetry, control logic, or dosing can create regulatory and public health impacts even where supply continues.
- Distributed footprint: treatment works, reservoirs, and pumping stations are geographically dispersed and often rely on remote connectivity.
- Third-party access pathways: integrators and specialist maintainers frequently require privileged remote access.
Typical high-impact scenarios:
- Loss of view/control across multiple remote sites resulting in manual operation, reduced throughput, or precautionary service restrictions.
- Manipulation or degradation of monitoring data leading to delayed detection of process issues.
- Outage or compromise of a shared supplier platform (identity, remote access, monitoring tooling) affecting multiple sites concurrently.
Priority resilience themes:
- Asset visibility and configuration baselines across all sites, including remote assets and communications dependencies.
- Segmentation and controlled remote access, with strong identity and session governance.
- Operationally realistic detection, response playbooks, and contingency procedures tailored to loss-of-view and loss-of-control conditions.
Transport: managing cyber risk across tightly-coupled operational ecosystems
Key cyber risk drivers:
- Complex integration: transport services rely on ecosystems of infrastructure owners, operators, customer-facing services, communications networks, and maintenance suppliers.
- Time-critical decision-making: incidents can rapidly cascade into network disruption and safety-adjacent operating constraints.
- Common dependencies: identity platforms, remote management tooling, cloud services, and payment/ticketing components can create systemic exposure.
Typical high-impact scenarios:
- Widespread disruption caused by failure, outage, or compromise of a shared supplier or technology platform.
- Ransomware or destructive activity affecting operational support systems (dispatch, control room support tooling, maintenance scheduling), resulting in degraded service.
- Attacks on customer-facing digital channels that impede passenger information, ticketing, and recovery coordination.
Priority resilience themes:
- Dependency mapping and resilience requirements for critical third parties, including outage and recovery obligations.
- Rapid containment and continuity procedures aligned to operational priorities and safety constraints.
- Exercised cross-organisational incident coordination, including clear escalation routes, decision authorities, and communications playbooks.
Energy: reducing national-scale cyber risk under real-time operational constraints
Key cyber risk drivers:
- High-value targeting: energy systems have disproportionate strategic value and are therefore attractive to sophisticated threat actors.
- Real-time constraints: stability and reliability requirements limit operational changes and require careful coordination of recovery actions.
- Interconnected operational and commercial systems: incidents can propagate across OT, enterprise IT, market operations, and customer services.
Typical high-impact scenarios:
- Disruption of critical operational functions that forces load-shedding, manual operations, or degraded control.
- Exploitation of common weaknesses across widely deployed components, creating correlated risk across operators.
- Supplier-induced systemic disruption (including major outages), affecting monitoring, identity, or remote management at scale.
Priority resilience themes:
- High-assurance monitoring and response capability for critical operational functions.
- Strong governance of changes, privileged access, and third-party connectivity.
- Scenario-based resilience planning and recovery sequencing for high-impact operational failures.
Implications of the Government Cyber Action Plan operating model for essential-service operators
The plan’s practical levers are most useful when interpreted as an integrated operating model:
- Clear ownership and escalation of cyber risk, distinguishing systemic risks that require central coordination from risks primarily managed within individual organisations.
- Risk appetite and prioritised investment, enabling leaders to define tolerances and justify resilience spending using impact, need, cost, and benefit.
- Mandatory requirements (within government) and assurance, creating evidence-based visibility of control performance and residual risk.
- Shared protective services and improved visibility, using scaled services to close common gaps across large and distributed estates.
- Incident response and recovery as a coordinated function, recognising that recovery can be prolonged and complex and may require specialist support.
- Supply chain and common dependency management, strengthening contractual, assurance, and partnership approaches for strategic suppliers and shared technology dependencies.
OT cyber risk quantification for essential services: turning intent into measurable outcomes
Operational Technology (OT) environments introduce constraints and impact pathways that are not well captured by generic IT-only risk registers. Given the plan’s emphasis on measurable objectives and assurance, one practical way OT-heavy organisations can operationalise similar governance is to use OT-focused cyber risk quantification by converting operational realities into decision-grade information that governance bodies can fund, assure, and escalate.
What OT-specific CRQ does
OT-specific CRQ quantifies cyber scenarios in operational terms (for example, loss of view/control, process upset, safety constraint activation, manual operation, degraded throughput). It then translates these into comparable measures such as service downtime, safety and compliance consequences, recovery cost, and wider economic and societal harm.
How it accelerates delivery
- Makes risk appetite actionable for OT: converts qualitative concerns into measurable tolerances and supports consistent escalation when scenarios exceed appetite.
- Improves prioritisation of investment and sequencing: enables like-for-like comparisons across interventions using quantified reduction in expected loss and operational impact.
- Strengthens assurance and reporting: adds a repeatable measurement layer over control outcomes and improves board-level and regulator-level visibility.
- Clarifies common dependency and supply chain exposure: quantifies correlated failure modes and prioritises which suppliers and dependencies require enhanced assurance and contingency planning.
- Improves exercising, response planning, and recovery objectives: provides credible, quantified scenarios that sharpen exercises, restoration sequencing, and continuity planning.
Turn OT resilience into decision-grade metrics. Use OT-specific CRQ to quantify loss-of-view/control scenarios, supplier dependency exposure, and recovery impact—so leaders can prioritise what reduces the highest-consequence risk first.
See CRQ in action
Applied to the three sectors
- Drinking water: quantify loss of telemetry or dosing integrity scenarios in terms of compliance impact, service restriction likelihood, and restoration effort.
- Transport: quantify common dependency outages in passenger delay-hours, revenue impacts, and time-to-recover for operational functions.
- Energy: quantify high-consequence operational scenarios to support escalation, prioritised resilience investment, and coordinated recovery planning.
Conclusion
For government and the wider public sector (including essential public services like drinking water, transport, and energy), the Government Cyber Action Plan signals a consistent direction: resilience expectations will be structured around clear ownership, measurable assurance, supplier discipline, and coordinated incident response and recovery. In OT-heavy environments, that direction becomes actionable only when leaders can move from broad objectives to quantified, operationally realistic decisions—what scenarios matter most, what dependencies create correlated risk, and what investments measurably reduce disruption and recovery burden.
OT-specific Cyber Risk Quantification enables this shift by translating cyber-physical scenarios into comparable measures—such as downtime exposure, compliance and safety consequences, recovery cost, and wider service impact—so governance forums can prioritise, assure, and track resilience improvements over time. The practical outcome is a resilience program that is more defensible, more prioritised, and better aligned to the realities of operating critical services—reducing blind spots, improving recovery readiness (and sequencing), and strengthening evidence that the highest-consequence risks are being actively managed.
Make resilience measurable across OT. If your leadership team needs board-ready visibility into OT cyber risk—especially for loss-of-view/control scenarios and shared supplier dependencies—OT-specific CRQ can help translate operational reality into decision-grade reporting.
Request a 15-min DeRISK CRQ Demo
Suggested next steps for operators and sector leaders
- Define a small set of OT-relevant loss scenarios per critical service—such as loss of view/control, process upset, and safety constraint activation—and quantify the likely operational impact and recovery effort.
- Convert scenarios into explicit tolerances (risk appetite) for downtime, service degradation, safety/compliance consequences, and financial exposure—then use those tolerances to drive consistent escalation and investment decisions.
- Map material common dependencies and strategic suppliers (identity, remote access, monitoring, integrators, platforms) and treat correlated failure modes as a first-class risk—embedding resilience and assurance expectations into contracts and operating procedures.
- Validate response and recovery plans through exercised scenarios that reflect OT realities and involve engineering, operations, safety, communications, and third parties—refining restoration sequencing and continuity measures based on lessons learned.
- Report quantified exposure and risk reduction over time to governance forums to support prioritised investment, evidence-based assurance, and clearer accountability for resilience outcomes.