Protection looks different in each sector
Energy, finance, health, telecommunications, water and transport share common principles but face different threats, technologies and consequences. Apply a recognised risk framework to your own context rather than copying another sector's controls wholesale. Start from the harm you must prevent and work back to the controls that prevent it.
Build on a common foundation
Identify essential services and the assets, data, people and suppliers they depend on.
Assess the realistic threats to your sector and the impact of their disruption.
Apply proportionate protective controls across IT and operational technology.
Establish detection, response and recovery capabilities sized to the consequences you face.
Account for operational technology
Many sectors run operational technology and industrial control systems that cannot simply be patched or rebooted like office IT. Segment these environments from corporate networks and the internet, control remote access tightly, and plan maintenance windows for updates. Safety and availability often outrank confidentiality in these settings, and your controls should reflect that.
Coordinate within and beyond your sector
Work with your regulator, sector peers and the relevant national authority to share threat information and good practice. Confirm the specific regulatory framework, standards and reporting duties that apply to your sector, and align your programme to them while maintaining the broader basics.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.