Cyber Security Regulations Drive Resilience Agenda for Offshore Energy Infrastructure

We are reaching a critical juncture in cyber security for industrial and critical infrastructure environments. The frequency, sophistication, and intent behind cyber-attacks are all increasing, becoming more complex, more targeted and more sophisticated. But at the same time, legislation is evolving rapidly to further rise to this challenge.

This is not simply a tightening of rules. It represents a fundamental shift in approach. Regulatory frameworks are becoming more preventative than prescriptive, and increasingly punitive where organizations fail to act. In effect, they reflect a strategic shift to prioritizing proactive security measures, continuous visibility, and resilience, over reactive incident response.

This legislation can be a blueprint for resilience, not just compliance, across our Critical National Infrastructure (CNI).

Critical National Infrastructure

In the UK, CNI spans 13 sectors, as defined by the National Protective Security Authority (NPSA): chemicals, civil nuclear, communications, defense, emergency services, energy, finance, food, government, health, space, transport, and water. These sectors underpin the functioning of society, and their resilience is essential.

Recent years have demonstrated how interconnected our systems can be. From the global disruption caused by COVID-19 to the geopolitical instability we’re witnessing today, the resilience of critical infrastructure has been repeatedly tested and increasingly scrutinized.

Physical vulnerabilities have become highly visible while in the digital domain, these vulnerabilities are even more pervasive. For our CNI, this creates a uniquely complex risk environment where physical and digital threats are deeply interconnected.

Globally, CNI is heavily dependent on operational technology (OT), an environment increasingly in the crosshairs of cyber-attackers. Unlike traditional IT systems, OT controls physical processes - from water treatment and power generation to pipeline flow, offshore oil and gas production, maritime operations, transport systems and manufacturing lines.

The challenges are multiple and fluid and for CNI, frequently exacerbated by legacy systems with reliance on legacy OT infrastructure being a central challenge. These mission critical systems were often the first to be installed, interconnected and automated in an earlier and very different threat environment. Built for reliability and longevity - and not for today’s highly connected, high-cyber-risk environments – many areas of CNI OT infrastructure are fragile and vulnerable to being cyber-attacked. There are challenges too for response and recovery. This is particularly true across offshore platforms and substations, marine terminals, and other long-life energy assets, where operational systems may remain in service for decades.

As a result, many organizations are operating with significant technical debt. Systems are often difficult to patch, expensive to replace and tightly integrated into critical operations.

Modernizing them is not simply a technical challenge, it’s an operational and financial one.

Increased Connectivity and Supply Chain Vulnerabilities

Increased connectivity between IT and OT environments has expanded the attack surface. Many cyber incidents affecting OT systems originate in enterprise IT networks before spreading into operational environments, highlighting the need for integrated security strategies.

Supply chain attacks are also on the rise. As organizations become more interconnected, attackers are exploiting trusted third-party relationships to gain access to critical systems. Managed service providers, software vendors and contractors are all potential entry points, especially in offshore and maritime sectors where operators rely on extensive third-party ecosystems to maintain critical assets.

According to the National Cyber Security Centre (NCSC), ransomware remains one of the most immediate and damaging risks facing UK organizations, with incidents rising sharply and affecting all sectors. ¹

Attacks reached record levels in in 2025 and have continued at a sustained level, affecting organizations of all sizes. ² For CNI operators, the consequences of downtime are severe, making them particularly vulnerable. Data exfiltration adds another layer of risk, increasing both financial and operational impact.

Bad actors take many forms and further complicate the threat landscape. It’s not unsurprising – and as highlighted in the PwC Annual Threat Dynamics 2026 report³ – that cyber-attacks against sectors such as energy and maritime infrastructure, offshore oil and gas, defence and aerospace increasingly correlate with geopolitical developments.

This has seen bad actors targeting OT infrastructure for strategic advantage, often operating with long-term strategic objectives, targeting OT systems to pre-position themselves within infrastructure. They may remain undetected for extended periods before executing disruptive actions aligned with their objectives.

In its Global Cybersecurity Outlook 2026⁴, the World Economic Forum highlights AI as the most significant driver of change in cyber security in the year ahead. Pace of development on both sides of the cyber security coin is exponential. AI and quantum computing are both powers for good and ill when it comes to cyber security. From a protection and defensive perspective, however, they provide opportunity for effective risk mitigation.

Regulation Made Practical

The regulatory landscape is evolving quickly to address these challenges. Globally, understanding compliance jurisdiction of a growing web of cross border cyber-regulation is essential.

In the UK, the upcoming Cyber Security and Resilience (Network and Information Systems (NIS) Bill will significantly expand the scope of existing regulations. More organisations, including managed service providers, data centres and critical suppliers to essential services, will fall under its remit, with increased emphasis on supply chain accountability.

One of the most significant changes is the introduction of rapid reporting requirements. Organizations will be expected to notify regulators within 24 hours of a significant incident, followed by a detailed report within 72 hours. This represents a substantial shift from previous timelines and places a premium on detection and response capabilities.

More robust financial penalties tied to global turnover will also come into effect. Organizations failing to comply will be faced with penalties of 4% of their annual global turnover, up to $17 million. Additionally, daily fines of up to $130,000 can be applied for ongoing failures. Beyond enforcement, the legislation strengthens oversight powers and introduces greater scrutiny of risks to national security.

At a European level, directives such as NIS2 and the Cyber Resilience Act (CRA) are reinforcing similar principles, requiring organizations to implement risk-based security measures and demonstrate their effectiveness. Taken together, these frameworks signal a clear shift. It is no longer sufficient to have controls in place. Organizations must be able to prove that those controls work in real-world conditions.

Mitigating Risk and Building Resilience

For organizations operating critical infrastructure, improving cyber resilience is not a single initiative but a continuous process that must be embedded across the lifecycle of operations.

At ABB, we support businesses across CNI sectors with exposure in OT environments, including offshore oil and gas operators, energy infrastructure owners and maritime organizations. We address the challenges, and often the overwhelm, associated with cyber security through a structured, risk-based approach. This aligns closely with evolving regulatory expectations while remaining firmly grounded in operational reality.

In many cases, these measures are not new, but they are not consistently applied in OT environments. Addressing this gap can deliver significant improvements in security posture without requiring large-scale transformation. From this foundation, organizations can take a phased approach to strengthening resilience.

Gaining a clear understanding of assets, communication flows and vulnerabilities across OT environments is essential, particularly where offshore facilities, vessels and remote energy assets must be monitored and managed securely. You cannot protect what you don’t know you have, so determining a comprehensive view of OT assets, risks and technical debt is key. This includes identifying legacy systems, mapping dependencies and understanding potential impact scenarios.

Resilience begins with foundational controls, such as network segmentation, secure remote access, and managing identities and access rights, to reduce the attack surface and create a defensible architecture. Ensuring robust backup and recovery processes as well as conducting regular risk assessments and incident response planning are also essential.

Equally fundamental is deploying monitoring capabilities tailored to OT environments by enabling early identification of anomalies and potential threats. As reporting requirements tighten, the ability to detect and understand incidents in real-time becomes increasingly important. OT environments present unique challenges for monitoring, including strict protocols and availability requirements.

However, without effective event and network monitoring, organizations cannot meet regulatory timelines or respond quickly enough to minimize impact. Improved situational awareness enables earlier detection of threats, faster response and better decision-making during incidents.

It also provides the evidence needed to support compliance and post-incident analysis, particularly considering the new UK NIS regulation requiring that response includes the delivery of a detailed report within a 72-hour window. This is only possible if organizations can detect incidents in the first place.

Developing and testing incident response plans that reflect the operational constraints of industrial systems is crucial to ensuring rapid and coordinated action to minimize downtime. It is also integral to making sure robust backup and recovery processes are in place to minimize any downtime and support business continuity.

This approach can support organizations in moving beyond compliance. By aligning security investments with operational risk and regulatory requirements, this creates a platform to build resilience that is sustainable and measurable.

It is an approach that we have proven works within brownfield operations which, for CNI, comprises offshore production facilities, offshore wind infrastructure and other operational energy assets where retrofitting technology, systems and process are ensuring compliance and resilience. For greenfield, it reinforces the need to integrate cyber security during the design and operation of systems rather than treating it as an afterthought.

As regulatory pressures heighten and threat landscapes evolve, structured frameworks provide a practical path forward - helping operators prioritize action, allocate resources effectively, and strengthen their overall security position.

Looking Ahead: From Challenge to Opportunity

There is no escaping the fact that for many organizations operating in CNI, the trifactor of legacy systems, evolving threats and increasingly punitive regulation is a perfect storm. Cyber threats to critical infrastructure will continue to grow in scale and complexity. At the same time, regulatory expectations will become increasingly more demanding.

By viewing regulation as a catalyst rather than a constraint, and by investing in defensible architectures and foundational controls, organizations can strengthen resilience, reduce risk and ensure the robustness and continuation of essential services across critical energy and industrial sectors to weather the storms that show no signs of stopping.