The UK Regulators Network, which counts Ofwat, Ofgem, the Civil Avlation Authority, Ofcom and the Office of Rail Regulation among its members, has published a report setting out the results of the first phase of its Cross-sector Resilience project and its plans for further work in phase two.

The project is focussed on finding ways for the regulators to tackle challenges to the resilience of UK’s national infrastructure which have cross-sector implications. UKRN has addressed the project in two phases - the first phase involved gathering information from all the participating regulators on resilience in their sector and then identifying gaps where further work within UKRN can offer improvements to the current levels of cross-sector resilience.

The organisations comprising UKRN together provide regulatory oversight of the companies which own and operate much of the UK’s national infrastructure. Shared resilience challenges between the sectors can arise because multiple sectors face common threats (such as those from flooding or cyber-attack), or because of the interdependency created when the sectors rely on one another (such as the use of electricity by finance, telecoms and railway companies). The term cross-sector resilience is defined by UKRN as “the extent to which each sector regulated by a UKRN member is resilient to problems in the other sectors.”  

Resilience planning a significant issue in all sectors

The report says that resilience planning is clearly a significant issue in all the sectors and there is a large amount of existing activity underway. However, although all the regulators have duties related to resilience, the detail and maturity of these varies greatly, as does the range of powers available to discharge them. It is also says that none of the regulators have specific cross-sector resilience duties and the extent to which they can address this under their general resilience work varies.

The UKRN has examined how the regulators can increase collaboration in cross-sector incident planning and response, with initial work suggesting a number of areas where further collaboration between the UKRN regulators would be beneficial.

Commenting on resilience in the regulated sectors, the Phase 1 report says that in situations where the challenges become so great that normal operation cannot be maintained, some services have minimum service levels that they must not fall below, citing the water sector as an example. The Security and Emergency Measures Direction (SEMD) provides for minimum service levels (10 to 20 litres of drinking water per person per day) that offer some protection to consumers against the total loss of services in order to protect public health.

Most sectors have one or more groups dealing with resilience issues from planning to coordinating major incident response and recovery. The National Security and Emergency Working Group (NSEWG) is the resilience group focused on the water and sewerage sector. The group is chaired by the Department for Environment, Food and Rural Affairs (Defra) and meets every six months to discuss national security and emergency planning issues which affect the water industry.

“UKRN is not a good vehicle” to assess level of resilience in each sector

UKRN says that due to a range of complexities, the resilience arrangements in each sector are quite different. The regulators decided at an early stage in the phase 1 work that the UKRN was not a good vehicle for considering whether the level of resilience in each sector is currently at the appropriate level. For the purposes of the project, UKRN has assumed that the resilience arrangements and outcomes in each sector are already the correct ones, or if not, that they will be adjusted via existing mechanisms.

Phase 1 has instead focussed on the areas where joint action by the sector regulators that makeup UKRN can have an impact - most likely to be the case where the resilience issues are cross-sector in nature which in practice, this includes two main types of issue:

Common risks – resilience risks which may be faced by stakeholders in more than one sector e.g. a common threat, such as cyber-attack or severe weather events  or a common vulnerability, such as the use of computing systems which rely on a common software component; and

Interdependencies between sectors – the use of services in one sector that have been provided by another. Examples here would include the use of the rail network to transport supplies needed to maintain telecoms networks or the use of electricity to power the computers used by finance companies.

Threats to resilience include common themes across sectors

UKRN says that although the specific threats that face each sector differ, there are some common themes.  At the highest level, these can usually be grouped into a small number of categories , including human errors, system failures, natural phenomena and malicious actions.

The report also sets out a wide range of threats which the phase 1 work has been considering which can affect the operation of infrastructure and might negatively impact the performance of a regulated sector , including:

• Weather – e.g. heavy rain leading to flooding
• Climate change – leading to severe weather, flooding, landslip etc.
• Volcanic eruption – e.g. leading to widespread ash clouds
• Space weather – e.g. solar flares
• Fire or explosion
• Terrorist attack
• Physical damage – accidental or deliberate
• Equipment failure – hardware or software
• Cyber-attack

Achieving resilient infrastructure

The report says the need for services to remain affordable means there is a practical limit on how much can be invested in resilience, requiring the available budget to be directed in the most cost effective way. According to UKRN a common way to do this is to follow a risk based approach, starting with the most serious, and developing plans to reduce the potential impact of each risk down to an acceptable level, as cost effectively as possible.

The report suggests that where very complex infrastructure is involved it may be so difficult to identify and address all possible vulnerabilities that obtaining a sufficiently high level of resistance or reliability is essentially impossible. In such situations, the most effective investment to improve resilience may be in response and recovery.

It also points out that the sector regulator may not be expert in a particular common threat, with leadership more likely to come from Government or industry stakeholders and the regulator taking a coordinating role. Citing climate change as an example, the Environment Agency’s Climate Ready service runs the Infrastructure Operators Adaptation Forum, which is attended by sector regulators as well as the companies operating the UK’s main infrastructures.

The report says that the risks presented by the interdependencies between sectors have long been understood to be significant and that without sufficient resilience, it is theoretically possible for a problem in one sector to cascade across many others, affecting much of the UK’s national infrastructure. The severe weather which caused widespread flooding and disruption across much of the UK winter of 2013/14 – including the alteration and cancellation of rail services, cancelled flights and the threat of flooding to Kenley water treatment works.

Phase 2 work to include cross-regulator emergency plan and assessment of cyber security

Key issues identified by UKRN for development in phase two as those most likely to be of benefit are as follows:

i. Cross-regulator emergency plan (CREP)

UKRN will explore the benefits of introducing a regularly reviewed and exercised framework to facilitate communication and cooperation between the regulators during major incidents affecting infrastructure resilience. This would sit alongside existing mechanisms such as COBR (Central Government’s high level crisis management facilities which are activated during major emergencies) to coordinate response and effective decision making, ad-hoc bilateral contact between regulators and sector-specific crisis management communication plans.

ii. Shared approach to assessing the state of regulated companies’ cyber security  

Working with Government and its agencies, the regulators will collaborate to determine how UKRN members can best contribute to the assessment of cyber security within their respective sectors.

iii. Joint exercise coordination

This work will establish a framework to ensure regulators are well informed about the range of exercises being planned and share the information with relevant stakeholders in their sectors to maximise opportunities for involvement.

Guide to infrastructure resilience for cross-sector users deferred

The report also sets out some additional items identified by UKRN which the regulators feel may be of less value, or less likely to be deliverable in a reasonable timeframe and are therefore not proposing to take these forward.

One idea put on the back burner which would in fact be useful to a wide range of stakeholders in various sectors is the development of a guide to infrastructure resilience for cross-sector users.

The report says that the more the sectors understand of one another’s resilience strengths and weaknesses, the better they can plan their own resilience measures and that a guide would explain each sector’s approach to resilience and set out the key information and recommendations that users in the other infrastructure sectors need to be aware of. However, UKRN says that although it has decided not to pursue the development of a guide in Phase 2, it may be useful to revisit this at some future point if interest in cross-sector resilience continues to grow.

Next steps

UKRN now plans to publish a final phase 2 report during August 2015 –the regulators anticipate that exercise coordination could come into effect immediately following this. The report says that while the cross-sector emergency plan will take some time to integrate into existing major incident plans, the regulators expect that regular testing would start before the end of 2015.

The report also flags up the possibility of new resilience requirements as a result of a new European Directive covering Network and Information Security (NIS) is currently being developed.

The regulators say that if this continues to final publication (which currently appears quite likely) it is expected to introduce new security and resilience obligations on companies in most infrastructure sectors within the next two or three years. This would have a significant impact on the resilience planning and incident reporting in most UKRN-regulated sectors.

Click here to read UKRN Cross-sector Resilience – Phase 1 report in full