EDF has made ‘substantial progress’ on cybersecurity, says nuclear regulator - New Civil Engineer
The Office for Nuclear Regulation (ONR) has lowered its regulatory attention level for EDF from 'significantly enhanced' to 'enhanced' after the operator made substantial progress on cybersecurity.
The ONR has found that EDF has made "substantial progress" on improving its cyber security, enabling the regulator to reduce its regulatory attention level from 'significantly enhanced' to 'enhanced'.
The ONR placed EDF under 'significantly enhanced' regulatory attention for cyber security in April 2023. The regulator has now said that EDF’s work to improve its cyber security has "strengthened governance and assurance arrangements, addressed risks associated with legacy systems, and enhanced technical controls to support a more resilient cyber security system".
A statement published on 11 October said: "Increased regulatory focus, combined with additional resources and sustained senior leadership attention within EDF, has helped embed better cyber security governance and management practices."
This change in regulatory attention level represents positive progress by the company. By working collaboratively together, EDF has demonstrated tangible progress, increasing our confidence that cyber risks are being managed in a proportionate and effective manner.
The regulator described EDF’s cyber security delivery programme and improvement plan as "comprehensive" and "well-resourced", which "align with ONR’s regulatory expectations and give confidence of timely delivery".
However, before the ONR can move EDF’s cyber security regime to 'routine' levels of regulatory attention, "more regulatory engagement is required to build confidence in EDF’s resolution of, technical matters", the ONR added.
EDF has also made "significant progress" in removing "legacy technology" from its IT network, the regulator confirmed.
We are pleased ONR has recognised the substantial emphasis and effort made by EDF to continue building mature cyber security systems. They identified improvements to our governance and assurances, that we have addressed the potential for issues with legacy IT systems and that we had improved technical controls to develop a more resilient system.
EDF will continue working closely with ONR to make the most of the improvements that can be made across our estate, as part of UK critical national infrastructure.
Related
