Read the government response here

From WaterBriefing

The Government has accepted the National Infrastructure Commission recommendation to implement resilience standards for infrastructure operators and stress testing against the standards, subject to the outcome of the current National Resilience Strategy call for evidence.

The Government has published a policy paper setting out its initial response to the NIC report Anticipate, React, Recover: Resilient Infrastructure Systems published in May 2020 which looked at a subset of critical national infrastructure sectors – namely the energy, water, digital, road and rail sectors.

The report emphasised the need to consider resilience in the round within a framework that addresses six aspects of resilience – anticipate, resist, absorb, recover, adapt and transform – as identified by NIC.

The NIC report says that in order to deliver resilient infrastructure, a framework for resilience is required that:

• better anticipates future shocks and stresses by facing up to uncomfortable truths
• improves actions to resist, absorb and recover from shocks and stresses by testing for vulnerabilities and addressing them
• values resilience properly
• drives adaptation before it is too late

The NIC recommended that Government should introduce a statutory requirement for Secretaries of State to publish:

• clear, proportionate and realistic standards every five years for the resilience of energy, water, digital, road and rail services
• an assessment of how existing structures, powers and incentives enable operators to deliver these standards or where changes are needed.
• regulators should introduce obligations on infrastructure operators to meet these resilience standards by 2023
• regulators should require a system of regular stress testing by 2024 for energy, water, digital, road and rail infrastructure operators, to ensure that infrastructure operators’ systems and decision-making can credibly meet resilience standards for infrastructure services.
• regulators should introduce obligations by 2023 on infrastructure operators to require them to participate in stress tests and to require remedial action in case of failure of stress tests.

In March 2021, the Government published the Integrated Review which sets the overarching vision and strategic framework for building the UK’s security and resilience on a global scale. This includes an increased commitment to resilience by defending the UK’s critical national infrastructure, including the economic infrastructure sectors, as well as the UK’s people and way of life which directly depend on these sectors.

The Government said it has committed to “improv[ing] our ability… to anticipate, prevent, prepare for, respond to and recover from risks to our security and prosperity”. This will be delivered through the development of the resilience strategy which is now underway – the final strategy is due to be published in the first half of 2022.

The Government is now considering the recommendations outlined in the NIC report Anticipate, React, Recover: Resilient Infrastructure Systems’ within the wider resilience context.

The Government says in its response:

“As the development of the National Resilience Strategy is ongoing it would not be right to pre-empt the outcomes of this Strategy and how this would affect specific HMG infrastructure and CNI policy.”

“In this response, we have outlined where HMG agrees or accepts the core elements of the recommendations. The details of how HMG would implement these recommendations would not be finalised until after the development of the Strategy.”

The Government intends to offer a follow-up response after the National Resilience Strategy has been published and work to implement measures and priorities outlined in the strategy is underway.

The follow-up response will outline in greater detail the extent to which HMG will follow the NIC recommendations.

The Government response says:

“This work will establish an enduring framework to improve the UK’s resilience to emergencies and adapt to new and/or evolving risks. These risks include both malicious and non-malicious risks such as climate change, emerging technology, state threats, cyber attacks and interdependencies between sectors on both a national and global scale.”

According to the Government’s initial response, setting agreed standards is “key to effective assurance regimes” that ensure that the UK’s most critical systems and organisations are “resilient across a broad range of risks.”

Click here to download the NIC report Anticipate, React, Recover: Resilient Infrastructure Systems

Click here to read the Government policy paper setting out its initial response to the report