Standards and regulations
OT cybersecurity standards: United Kingdom
The UK regulates operators of essential services through the NIS Regulations and the NCSC Cyber Assessment Framework, with new legislation progressing to widen scope and strengthen reporting.
Key standards and regulations
| Standard | Who it applies to | What it covers | OTVista modules |
|---|---|---|---|
| NIS Regulations 2018Network and Information Systems Regulations (as amended)Regulation | Operators of essential services in energy, transport, water, health and digital infrastructure | Duties to manage security risk and report incidents, overseen by sector competent authorities such as Ofgem and DWI. | Standards & ComplianceEvidence & Audit Trail |
| Cyber Security and Resilience BillProposed update to the UK NIS regimeBill (in Parliament) | Expands to managed service providers, data centres and critical suppliers | Progressing through Parliament. Expected to strengthen incident reporting and regulator powers. Track final text before planning compliance work. | Governance & PolicyThird-party & Remote Access |
| NCSC CAFCyber Assessment FrameworkFramework | NIS-regulated organizations and others seeking a structured assessment | Outcome-based objectives and indicators of good practice, widely used by UK regulators to assess OT operators. | Standards & ComplianceDashboards & Reporting |
| HSE OG86Cyber security for industrial automation and control systemsOperational guidance | COMAH sites and other major hazard industries | HSE guidance on managing cyber risk to IACS where it could lead to a major accident. | OT Risk ManagementZones & Conduits |
| Cyber EssentialsGovernment-backed baseline schemeCertification scheme | Organizations of all sizes, often required by supply chains | A baseline of technical controls for IT. Useful for the enterprise boundary around OT. | Governance & Policy |
Summaries are for orientation only and are not legal advice. Applicability depends on your sector, size and jurisdiction, and regulations change. Confirm obligations with the official texts and your legal or compliance advisers. OTVista does not certify compliance.
Other regions
International
ISA/IEC 62443, ISO/IEC 27001 & 27002, ISO/IEC 27019, IEC 62351, IEC 61511, ISO 31000
ViewEuropean Union
NIS2, CRA, NCCS, CER, Machinery Regulation, CLC/TS 50701
ViewUnited States
NIST CSF 2.0, NIST SP 800-82 Rev. 3, NERC CIP, TSA Security Directives, AWIA 2018, CISA CPGs, DOE C2M2, CMMC 2.0
ViewMiddle East
NCA ECC-2:2024, NCA OTCC-1:2022, NCA CSCC, SACS-002, UAE IA Regulation, Dubai ISR, Qatar NIA
View
Preparing for NIS Regulations 2018 or another requirement?
We combine the OTVista Platform with compliance readiness services to get you audit-ready.