NCSC publishes first water sector guidance on secure connectivity for industrial control systems

The NCSC has published new guidance specifically for the water sector, adding a worked example to its existing Secure Connectivity Principles framework. This is the first content authored by the Industrial Control System Community of Interest to appear on ncsc.gov.uk. The guidance provides practical advice on how water companies should approach secure connectivity in operational technology environments, addressing the specific challenges of industrial control systems that manage critical water infrastructure.

Why this matters for UK organisations

Water sector organisations operate industrial control systems that are often decades old, run on legacy protocols, and were designed for reliability and safety rather than security. The NCSC's decision to publish sector-specific connectivity guidance acknowledges that securing these environments requires understanding operational constraints, safety requirements, and the practical realities of systems that cannot simply be patched, replaced or isolated in the same way as IT infrastructure. This is particularly relevant given the regulatory attention on water companies and the operational impact that connectivity decisions have on both security posture and system availability. For organisations in other critical infrastructure sectors, the guidance provides a useful reference point for how to think about secure connectivity in environments where traditional IT security assumptions do not always apply.

What to review

Organisations operating industrial control systems should review how secure connectivity principles are being applied in OT environments, particularly around network segmentation, remote access, and monitoring. The NCSC guidance provides a practical framework for making defensible decisions about connectivity in environments where operational continuity and safety are primary concerns. It is worth reviewing whether your organisation has clear ownership of OT security decisions, whether connectivity policies reflect the specific operational context of industrial systems, and whether there is a documented approach to balancing security, safety and operational requirements. For water companies specifically, this guidance should be treated as a baseline for reviewing current practice and identifying gaps in how connectivity is managed across operational technology estates.

Source: NCSC UK