Key Takeaways
- A small-scale gas generator was taken offline for four days in July 2026. The UK Government confirmed the incident but has not formally attributed it. [1]
- Under the Network and Information Systems Regulations 2018, electricity generation is captured only at 2GW cumulative capacity, and the threshold expressly excludes generators that are not connected to a transmission system. [2]
- On 5 August 2026 the Department for Energy Security and Net Zero and Ofgem confirmed that baseline cyber resilience requirements for all Ofgem licensees will be built on Cyber Essentials Plus, consulted on during 2027 and in place across the sector by the end of 2030. [3]
- The same government response acknowledges that Cyber Essentials Plus excludes operational technology and lacks controls covering governance, incident response, risk management and supply chain. Its Plus tier applies the same five technical controls as Cyber Essentials with independent testing, rather than extending them. [3] [9]
- IT and OT segregation was the single most requested additional control among consultation respondents, raised by 18 of the 49 organisations and individuals who replied. [3]
Why This Matters Now
In July 2026 a small-scale British generating asset stopped producing power for four days following a cyber incident. Michael Shanks, Minister of State at the Department for Energy Security and Net Zero, confirmed that the incident had affected a small-scale energy generator, and the Department stated that at no point was the wider energy system at risk. [1] Press reporting linked the intrusion to Iranian-aligned actors, though the UK Government has made no formal attribution.
The detail that matters for security leaders is not the attribution. It is the position of the asset. A four-day outage at a small distribution-connected generator is an outage at something well below the regulatory perimeter drawn in 2018, which means the operator was almost certainly under no statutory cyber resilience obligation at all.
That perimeter is not a historical accident. The Government’s own Energy Sector Cyber Security Strategy states that the NIS Regulations were only ever intended to apply to the most critical operators and therefore do not provide holistic coverage of the energy system. [4] The strategy also commits Government to encourage more reporting of cyber incidents that fall below NIS thresholds, which is a plain acknowledgement that the sub-threshold estate is a blind spot.
The threat is not theoretical. In December 2025 a threat actor targeted around 30 distributed renewable assets in Poland, including wind and solar farms and a combined heat and power plant. Generation and heat supply held, and the plant involved served nearly 500,000 heat customers. What matters is how the attacker got in: internet-exposed firewall appliances without multi-factor authentication, unpatched devices and reused credentials. Most of those routes could have been closed by basic cyber hygiene. A parallel attack the same day on a smaller plant serving 50,000 residents did interrupt cogeneration, shutting down a steam turbine and the water treatment system. [5] [6]
Meanwhile the estate is growing. Government projections cited in the March 2026 consultation put battery storage capacity on a six-fold increase and wind and solar capacity almost tripling by 2030. [5] Ofgem currently regulates just over 1,400 licensed operators, and Government has described the absence of cyber resilience requirements across a large proportion of them as one of two fundamental reform needs. [3]
What the Regulatory Position Actually Is
Schedule 2 of the NIS Regulations 2018 sets the thresholds at which an operator becomes an Operator of Essential Services. For downstream gas and electricity these are as follows.
| Essential Service | Electricity | Gas (Downstream) |
| Generation | 2GW or more (cumulative) | N/A |
| Transmission | More than 250,000 final customers | More than 250,000 final customers |
| Offshore Transmission | 2GW or more (cumulative) | N/A |
| Distribution | More than 250,000 final customers | More than 250,000 final customers |
| Interconnectors | 1GW or more | More than 20M m3 gas per day |
| Supply | More than 250,000 final customers | More than 250,000 final customers |
| Load Control | 300MW or more | N/A |
Source: DESNZ and Ofgem consultation documents, drawn from NIS Regulations 2018 Schedule 2. Generation excludes nuclear generators and generators not connected to a transmission system. Capacity is cumulated across affiliated undertakings. Load control is not yet in force and will be commenced through the Cyber Security and Resilience Bill. [2] [3]
Two features of that table deserve attention. First, generation capacity is cumulated across a corporate group, so a modest site inside a large portfolio can sit above the line while a standalone site of identical rating sits below it. Second, generators not connected to a transmission system are carved out regardless of size, which removes most distribution-connected embedded generation from scope entirely.
Government consulted on this between 27 March and 22 May 2026 and published its response on 5 August 2026. Nineteen respondents told Government that the electricity generation threshold should change. Twenty-one argued that thresholds should be driven by risk or impact rather than by supply or generation volume, and 19 said the sector has become distributed to the point where current thresholds no longer reflect where risk arises. Six respondents proposed specific replacement figures, including 200MW and 500MW for generation. [3]
Government has not adopted a new number. It has commissioned the National Energy System Operator to advise on which services and thresholds should apply, and intends to consult on any revisions during 2027, subject to the Cyber Security and Resilience Bill receiving Royal Assent. The response states that Royal Assent is expected in early 2027, though secondary coverage consistently reports an expectation of late 2026. The Bill completed Lords Second Reading on 14 July 2026 and entered Lords Committee Stage on 1 September 2026. [3] [8]
Alongside that review, Government confirmed it will introduce baseline cyber resilience requirements for all Ofgem licensees, delivered through licence conditions and founded on Cyber Essentials Plus. Ofgem will consult on the detail during 2027. The public commitment is that a baseline level of cyber resilience will be in place across the whole downstream gas and electricity system by the end of 2030. Any intermediate tier between baseline and NIS is expected to be considered only after 2030. [3]
Who is Affected by the Sub-Threshold Gap?
Sub-threshold generators and distributed energy operators. Operators of embedded gas plant, solar, onshore wind, battery storage and long duration storage that fall below 2GW, or that are not transmission-connected, carry no statutory cyber resilience obligation today and will carry none until baseline requirements are implemented through licence conditions. Many of these sites are unmanned and dependent on remote access.
NIS-designated operators. Designation does not insulate a large operator from the gap. NIS requirements apply only to the network and information systems on which the essential service relies, which Government acknowledges leaves ancillary, supporting and back-end systems outside scope. [5] Large operators also depend on smaller counterparties for flexibility, balancing and aggregation.
Aggregators, flexibility platforms and remote service providers. Consultation respondents identified flexibility services, aggregators and orchestration platforms as the most commonly proposed additions to the essential services list, alongside digital and data platforms and remote monitoring and management providers. [3] Some of these organisations will be captured as large load controllers at 300MW of aggregate controllable load. Many will not.
Boards and investors in generation assets. The regulatory floor is now dated and public. A board that waits for 2030 is accepting four years of exposure on an asset class that has already been taken offline once.
What Are the Challenges the 2030 Baseline Does Not Solve?
The most significant issue is that the announced remedy is shaped for information technology, not for the control systems that took the plant offline.
Government has been candid about this. The consultation observed that Cyber Essentials is primarily suitable for IT, that many downstream gas and electricity operators rely on SCADA systems, programmable logic controllers, human machine interfaces and remote telemetry units, and that applying Cyber Essentials controls to those environments can be challenging and in certain circumstances unsuitable. [5] The government response goes further, recognising that Cyber Essentials Plus has limitations for the energy sector in relation to the exclusion of operational technology and the absence of controls for governance, incident response, risk management and supply chain. [3]
Respondents said the same thing with numbers behind it. IT and OT integration or network segmentation was the leading requested addition at 18 respondents, followed by incident response and exercising at 17, remote access management at 13, supply chain visibility at 12 and governance at 10. When asked for alternative frameworks, respondents most often named the NCSC Cyber Assessment Framework at 16 and IEC 62443 at 15, ahead of ISO 27001 at 14. [3] The sector asked for an OT-aware standard. What has been confirmed so far is an IT scheme that Government intends to build on, with the additional controls still to be designed. It is worth being precise about what the Plus tier adds: Cyber Essentials Plus applies the same five technical controls as Cyber Essentials and subjects them to independent technical testing rather than extending them. [9] Choosing Plus over the base scheme raises the assurance level, not the scope.
Three further constraints compound this. Government intends that, where possible, baseline requirements should apply only to systems not already covered by existing cyber resilience obligations, which creates scope boundaries that operators will need to evidence rather than assume. [3] Consultation respondents reported that the prescriptiveness of Cyber Essentials controls and the inability to use compensating controls were common drivers of cost in OT-heavy and legacy environments. [3] And the assurance route for complex estates is still under exploration, with Government committing only to examine the potential of NCSC Cyber Essentials Pathways. [3]
The practical conclusion for a security leader is that compliance and resilience are not the same programme here, and neither of them arrives before 2030.
How IOActive Can Help
The gap this post describes is not a compliance problem yet, which is precisely why it is an assessment problem now. An operator below the 2GW line has no licence condition to evidence against and no NIS designation to scope, so the only reliable way to establish its position is to test the estate against a framework the eventual baseline will have to catch up to.
IOActive has operated in industrial control environments since building the first proof-of-concept worm against the smart grid in 2009 [10], and has helped define standards and best practices including NIST 800-53 and 800-37. The services below map to the specific gaps the 2030 baseline leaves open.
Full Stack Security Assessments
Government has confirmed that Cyber Essentials Plus excludes operational technology and that applying its controls to SCADA systems, programmable logic controllers, human machine interfaces and remote telemetry units can be unsuitable. Our Full Stack assessments examine the whole environment rather than a single layer, covering the controllers and HMIs at distribution-connected sites, the OT/IT boundary, and the cellular and vendor paths that commonly provide unmanned generation assets with connectivity nobody has inventoried. Where the baseline will eventually ask for evidence, an assessment produces it rather than assuming it.
Hardware and Firmware Security Research
The assets in question are largely unmanned and remotely operated, which places the security of the controller and telemetry unit itself in scope rather than only the network around it. Our hardware and firmware research examines the devices deployed at these sites directly, at a depth that network-layer testing cannot reach and that no IT-derived certification scheme currently asks for.
Supply Chain Integrity
Consultation respondents named supply chain visibility among the leading controls missing from Cyber Essentials Plus, and identified aggregators, flexibility platforms and remote monitoring providers as the additions most often proposed to the essential services list. Our Supply Chain Integrity work assesses the posture of technology providers and critical third parties, covering firmware, embedded systems, remote access arrangements and procurement, so that inherited risk is identified before it becomes a shared incident. For operators contracting with aggregators and remote service providers, this is the exposure that sits outside their own perimeter and inside their own outage.
Red Team and Purple Team Services
Incident response and exercising was the second most requested addition to the baseline, at 17 respondents. Adversary simulation is how an operator establishes whether an intrusion at a small asset would be detected and contained before it interrupts generation, rather than assuming the segmentation on the network diagram holds under test.
Advisory Services
The 2027 consultations will ask operators to state which systems fall inside a future baseline, which already sit inside NIS scope, and where residual OT exposure lies. That is a scoping determination an operator has to be able to defend, not describe. Our Advisory Services cover programmatic security review, security programme development and management, and Virtual CISO support, and the output is a documented scope position for each asset, a remediation sequence with named owners and dates, and the evidence pack a board or regulator will ask for.
If you would like to discuss where your generation or distributed energy assets sit against the thresholds described in this post, and what the residual OT exposure looks like, we welcome the conversation.
What are the Recommended Next Steps for Operators?
- Establish the regulatory position of every generating asset in the portfolio, including cumulative group capacity and whether the connection is to a transmission or a distribution system, and record the basis for each determination.
- Treat the 2030 baseline as a floor rather than a target, and assess the estate against an OT-aware framework such as IEC 62443 or the NCSC Cyber Assessment Framework rather than waiting for licence conditions to be drafted.
- Inventory remote access into unmanned sites, including vendor and maintenance pathways, and verify that segmentation between corporate IT and control networks holds under test rather than on the network diagram.
- Extend incident response plans to cover loss of generation at a sub-threshold asset, and exercise them, given that incident response and exercising was the second most requested control in the consultation.
- Review contractual cyber security obligations with aggregators, flexibility platforms and remote monitoring providers, several of which may be brought into NIS scope during the 2027 review.
- Engage with the Ofgem consultation expected during 2027, since the additional controls that sit above Cyber Essentials Plus are still being designed and sector evidence will shape them.
Conclusion
The regulatory perimeter for British electricity generation was drawn around a small number of very large assets in 2018, for an energy system that no longer exists. Government has recognised this, commissioned advice on where the line should move, and committed to a baseline for every Ofgem licensee by the end of 2030. That work is welcome and it is also four years away, and the scheme chosen as its foundation does not currently reach operational technology.
Operators that have already been targeted do not have four years, and press analysis published a month after the incident concluded that Britain’s small power plants face continued cyber risk. [7] The organisations that come through the next phase in good order will be those that treat the 2030 baseline as the minimum they will eventually be asked to evidence, and build OT security ahead of it on their own timetable.
References
- The Register, “Iran-linked cyberattack shut down a UK power plant”, 24 August 2026, carrying the Department for Energy Security and Net Zero statement on the small-scale energy generator incident. https://www.theregister.com/security/2026/08/24/iran-linked-cyberattack-shut-down-a-uk-power-plant/ First reported by The Sunday Telegraph, 22 August 2026 (paywalled).
- The Network and Information Systems Regulations 2018, Schedule 2, U.K. Essential Services and Threshold Requirements. https://www.legislation.gov.uk/uksi/2018/506/schedule/2 (revised text as in force at 2 September 2026).
- Department for Energy Security and Net Zero and Ofgem, “Reshaping cyber regulation in downstream gas and electricity: government response”, 5 August 2026. https://www.gov.uk/government/consultations/whole-energy-cyber-resilience-requirements-reshaping-cyber-regulation-in-downstream-gas-and-electricity
- Department for Energy Security and Net Zero, Ofgem, NCSC and NESO, “Energy Sector Cyber Security Strategy”, 28 May 2026. https://www.gov.uk/government/publications/energy-sector-cyber-security-strategy/energy-sector-cyber-security-strategy
- Department for Energy Security and Net Zero and Ofgem, “Reshaping cyber regulation in downstream gas and electricity: consultation document”, 27 March 2026. https://assets.publishing.service.gov.uk/media/69c51142471d520038d0f68d/whole-energy-resilience-consultation-document.pdf
- CERT Polska, “Energy Sector Incident Report – 29 December”, published January 2026. https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/ (full report: https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf). See also CERT Polska, “Follow-Up Report of the December 2025 Energy Sector Incident”, August 2026. https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025/
- The Guardian, “UK’s small power plants face continued cyber risk after Iran-linked hack”, 27 August 2026. https://www.theguardian.com/business/2026/aug/27/uk-small-power-plants-risk-cyber-attacks-iran-hack
- Cyber Security and Resilience (Network and Information Systems) Bill, HL Bill 32, introduced to Parliament 12 November 2025. Lords Second Reading 14 July 2026, Lords Committee Stage from 1 September 2026. https://bills.parliament.uk/bills/4035
- National Cyber Security Centre, Cyber Essentials. https://www.ncsc.gov.uk/cyberessentials/overview
- M. Davis, IOActive, “Advanced Metering Infrastructure (Smart Grid) Device Security”, Black Hat USA 2009. https://blackhat.com/presentations/bh-usa-09/MDAVIS/BHUSA09-Davis-AMI-SLIDES.pdf