The Office for Nuclear Regulation's (ONR) has improved EDF’s regulatory attention level for cyber security to reflect the substantial progress made by the company.
ONR’s specialist inspectors have engaged positively with EDF as it delivered improvements through its cyber security programme. This work has strengthened governance and assurance arrangements, addressed risks associated with legacy systems, and enhanced technical controls to support a more resilient cyber security system.
Increased regulatory focus, combined with additional resources and sustained senior leadership attention within EDF, has helped embed better cyber security governance and management practices since it was placed in the significantly enhanced category in 2023.
In line with ONR’s enabling approach, inspectors pinpointed the areas EDF needed to target, while giving the company space to shape and take ownership of its improvement programme.
EDF has developed a comprehensive and well-resourced cyber security delivery programme and improvement plan that address outstanding technical matters, which align with ONR’s regulatory expectations and give confidence of timely delivery.
However, because more regulatory engagement is required to build confidence in EDF’s resolution of technical matters, it remains within ONR’s enhanced regulatory attention level, having moved from significantly enhanced.
EDF has also made broader improvements including significant progress in removing legacy technology from its IT network.
Dan Hasted, ONR’s Director of Regulation for Operating Facilities, said:
“This change in regulatory attention level represents positive progress by the company.
“By working collaboratively together, EDF has demonstrated tangible progress, increasing our confidence that cyber risks are being managed in a proportionate and effective manner.
“More work is required by EDF before a potential return to routine regulatory attention, and we will continue to hold them to account. However, we are encouraged by EDF’s commitment to make further cyber security improvements.”
ONR has three regulatory attention levels: significantly enhanced, enhanced and routine. Before a positive change in attention level can be made, ONR requires evidence of sustained improvement during a prolonged period.
ONR works closely with industry to drive continuous improvement in cyber security and regulatory advice covers the need to keep investing to protect against an ever-changing threat landscape.
As technology evolves, the nuclear sector increasingly needs to integrate IT and operational technology to improve outcomes and reduce risk.
ONR has carried out thematic interventions to clarify its expectations in this area, and offers advice and guidance supported by specialist inspectors and cyber security consultancies.
Back to the hub
