The National Cyber Security Centre (NCSC) has released new guidance for securing Operational Technology (OT) environments, featuring a fictional case study focused on the water sector. This example, published on August 11, 2026, illustrates how a regional water utility, "Admin Corp Water," can implement the NCSC's Secure Connectivity Principles for OT to standardize digital connectivity while maintaining safety, reliability, and cyber resilience.
The guidance is not intended to prescribe a specific architecture but rather to demonstrate how organizations can use the NCSC's principles as a target state, making risk-informed decisions tailored to their operational context, regulatory obligations, and threat landscape. It emphasizes the interconnected roles of architectural choices, governance processes, and operational practices in achieving resilient OT connectivity, particularly when dealing with legacy infrastructure.
The fictional scenario walks through the eight secure connectivity principles, showing how they can inform design decisions such as reducing exposure, centralizing connectivity, managing legacy protocols, strengthening boundaries, and preparing for cyber incidents.
This new publication marks a significant collaboration between the NCSC and the Industrial Control Systems Community of Interest (ICS-COI) Boundary Expert Group. This group comprises practitioners from various critical national infrastructure sectors who are responsible for designing, securing, and operating the boundaries between OT and external networks. Their insights were crucial in shaping both the original guidance and this worked example, ensuring the scenarios and design considerations reflect real-world challenges.
This is the first time the Boundary Expert Group has directly authored content for the NCSC website, working collaboratively with the NCSC to validate technical approaches against the secure connectivity principles. This model aims to combine practitioner experience with NCSC guidance to produce practical and technically grounded examples. The NCSC hopes to repeat this collaborative approach in future guidance development.
The NCSC recognizes that critical sectors often face distinct operational constraints, regulatory environments, and threat contexts. Worked examples developed with sector experts help illustrate how NCSC principles can be interpreted and applied in these diverse environments, making the guidance more accessible, practical, and effective for organizations that rely on it.
