A UK energy sector operator engaged with NCC Group, an NCSC-approved Cyber Resilience Audit scheme provider, to validate its cyber resilience position, strengthen evidence and support future regulatory assurance.
Situation
Independent cyber resilience assurance for UK energy operations
In the UK energy sector, cyber resilience means protecting complex, geographically dispersed assets while meeting sector-specific regulatory expectations. For this client, assurance covered its asset base, including IT and OT systems supporting essential services under the NIS Regulations.
As the client’s Information Security Officer explained, the role is about translating group-level strategy into a national-level operating environment with its own laws, regulators, asset types and resilience priorities. That means ensuring cyber resilience across a varied UK estate while maintaining alignment with the Cyber Assessment Framework and the expectations of CRA scheme partners.
“My role within the company is primarily about ensuring cyber resilience. It covers all the infrastructure that we operate.”
The client had already adopted the NCSC Cyber Assessment Framework and had experience of self-assessment and formal NIS inspection. It wanted something that sat between the two: an independent view that could challenge assumptions before a regulator did.
At a glance
Customer: A UK energy sector operator responsible for both IT and OT infrastructure environments.
Challenge: The client needed an independent review of its cyber resilience position before future regulatory milestones came into force, moving beyond self-assessment to evidence-led validation.
Solution: NCC Group, an NCSC-approved Cyber Resilience Audit scheme provider, delivered independent CAF-based audits across UK sites, combining evidence gathering, fieldwork, asset walkthroughs, policy and procedure assessment, and site team discussions to show how controls perform in practice.
Results: The engagement validated the client’s priorities, strengthened evidence for senior management and regulators, and gave the client a clear, independent view of its cyber resilience position, with practical outputs to support ongoing improvement.
“For us, the Cyber Resilience Audit and the work with NCC Group has really been a headline topic. It has given us valuable outputs we can use to make sure the company is genuinely more resilient and more secure.”
Information Security Officer, client
Challenge
Moving from self-assessment to evidence-led validation
The client had already completed self-assessments against regulatory standards but wanted to test its confidence against independent evidence. It needed objective validation of where controls were working, where gaps remained and whether its improvement priorities were the right ones to focus on.
“We were looking for something in the middle, where somebody independent and objective could come in, see our workings out and discuss how we arrived at that position.”
The client also recognised the wider direction of travel in cyber resilience assurance. As regulatory scrutiny increases, suitably qualified third parties will be expected to play a greater role in future assurance activity. By engaging early with the Cyber Resilience Audit scheme, the team could challenge assumptions, validate current priorities and strengthen the evidence behind future reporting.
A time-sensitive regulatory reporting deadline added urgency. The client needed assurance quickly enough to support their assertions made as part of external reporting, while still ensuring the work was properly scoped, evidenced and controlled.
Solution
A collaborative Cyber Resilience Audit grounded in operational reality
After considering a shortlist of approved providers, the organisation chose NCC Group because of its status as a National Cyber Security Centre (NCSC)-approved Cyber Resilience Audit scheme provider, and because the early engagement felt clear, credible and collaborative. From the outset, NCC Group helped shape the scope around the client’s objectives, ensuring the audit reflected its operating environment rather than become a generic, tick-box assessment.
“It was very much, tell us what you want to get out of this and we’ll guide you along. That counted for an awful lot.”
The engagement began with scoping and evidence planning before moving quickly into fieldwork. NCC Group provided an evidence list up front, helping the client prepare thoroughly and create a controlled repository for documentation. This gave the auditors access to the information they needed while enabling the client to manage permissions, retention and deletion in line with its own governance and regulatory obligations.
On-site, NCC Group reviewed evidence, spoke with operational teams and used site walks to connect diagrams, processes and controls with real operating environments. The assessment tested not only whether documents existed, but whether controls could be evidenced, explained and understood in practice.
“They consistently challenged our assumed knowledge versus the evidence that we had, and that was really appreciated.”
The outputs were structured around the CAF, showing the current position for each relevant outcome and setting out what needed to be done to address any gaps. The review process remained collaborative throughout. NCC Group retained its independent audit opinion, while working with the client to ensure the final reports accurately reflected its terminology, context and operating environment.
“It proved to be a real partnership. They clearly understood what we wanted from the engagement, which was to validate our self-assessments and double check we hadn’t got any gaps open that we thought were closed.”
“Meeting teams on-site and seeing the operational environment first-hand helped us build a complete picture of the client’s cyber resilience. The collaborative approach meant we could focus on assurance that was meaningful, practical and grounded in the organisation’s unique environment.”
Hannah McCartney, Senior Security Consultant, NCC Group
Benefits
Stronger evidence, clearer priorities and confidence beyond compliance
The engagement gave the client a clear, independent view of its cyber resilience position. It validated self-assessments, confirmed where evidence was strong and highlighted where improvement activity should be focused. For the team, this meant moving from confidence based on subjective experience to confidence backed by objective evidence.
“It made us think about how we can independently prove what we know to be true. It’s no good just saying we know it’s true to the regulator - we need to be able to back it up with concrete evidence.”
The audit outputs also supported broader stakeholder conversations. The findings gave senior management a tangible view of the client’s independent assessment position. They also gave the client stronger assurance evidence to support future regulatory reporting and demonstrate that its self-reported position was grounded in reality.
“The reports give us something tangible we can use with senior management. They help show where we are, why we have taken that view and what we need to do next.”
Beyond the reports, the engagement helped confirm that the client was focusing on the right gaps and that priorities were aligned to the CAF. It also gave the client greater confidence ahead of future milestones and created a repeatable model for future assurance activity as the client continues its improvement journey.
“The benefit for us is knowing that the areas we are prioritising are the right ones. NCC Group’s independent view has helped us focus our improvement activity where it matters most.”
The engagement also supported a broader programme of assurance activity, with the client continuing to work with NCC Group on follow-up technical security testing as part of ongoing compliance work and resilience priorities.
For the client, the outcome was a more grounded, evidence-led view of resilience - one that supported assurance, strengthened internal confidence and helped them continue improving rather than treating compliance as a one-off exercise.
“The engagement with NCC Group has given us valuable outputs we can use to make the organisation more resilient and more secure. It has helped us validate our position, focus on the right gaps and build confidence in the work still to come. Although this was a milestone engagement at a point in time, it’s likely to be the first of many.”
"What stood out during this audit was that security was not confined to specialist cyber teams; it was clearly embedded across the client’s business. The client was open and transparent throughout the engagement, providing clear evidence not only of compliance with requirements, but also of controls operating effectively in practice. This commitment to a proportionate, risk-based approach to security demonstrates a mature understanding of regulatory expectations and the effective integration of NIS requirements into day-to-day business operations."
Julian Brown, Managing Security Consultant, NCC Group
Responsible for critical infrastructure?
Talk to our team about independent cyber resilience assurance.