The Cabinet Office has published the 2015 to 2016 summary of sector resilience plans setting out the current level of resilience to risks for the UK’s critical infrastructure, including water - owing to their sensitive nature, the individual plans are classified documents.

Sector resilience plans set out the resilience of the UK’s most important infrastructure to the risks identified in the National Risk Assessment. Produced annually, plans are given to ministers to alert them to any perceived vulnerabilities, with a programme of measures to improve resilience where necessary.

The National Risk Assessment is the main document Government uses to assess the major threats (malicious terrorist attacks); hazards (non malicious risks such as human and animals diseases, industrial accidents and industrial action, natural hazards such as flooding and drought) and cyber threats the UK could face in the next five years.

The UK’s Critical Infrastructure is defined by the Government as:

“Those critical elements of infrastructure (namely assets, facilities, systems, networks or processes and the essential workers that operate and facilitate them), the loss or compromise of which could result in:

a. major detrimental impact on the availability, integrity or delivery of essential services – including those services, whose integrity, if compromised, could result in significant loss of life or casualties – taking into account significant economic or social impacts; and/or

b. significant impact on national security, national defence, or the functioning of the state.”

There are 13 UK Critical Sectors: Chemicals; Civil Nuclear; Communications; Defence; Emergency Services; Energy; Finance; Food; Government; Health; Space; Transport; and Water.

Cyber security a particular challenge

As identified in the National Risk Register of Civil Emergencies 2015, cyber security is a particular challenge as attacks are increasingly being carried out on “an industrial scale.” Some 90% of large corporations and 74% of small businesses reported an information security breach in 2015.On average, more than 33,000 malicious emails are blocked  at the Gateway to the Government Secure Intranet (GSI) every month, while around 90 sophisticated attacks are carried out against industry and government per month.

The Department for Environment, Food and Rural Affairs is the sector lead department for the water sector. According to the summary,  “an all risks regulatory framework, mutual aid agreements and high levels of investment continue to strengthen the resilience of the water industry to major disruptive events.”

In its assessment of existing resilience, the paper says that irrespective of the risk, water companies are required by law to plan to provide water by alternative means in the event of a failure of the mains supply. Disruption to electricity supplies is flagged up as a key risk – this could result in the loss of mains water and affect the movement and treatment of sewerage. A loss of telecoms could impact remote flow management and monitoring systems.

Cyber security and re-zoning are priorities for water sector

To mitigate the risk, the water companies have short-term contingency plans in place for power, which include the use of back-up generators. They also continue to develop multiple monitoring systems to reduce impacts of telecoms failure.

The paper says these resilience efforts are also bolstered by an industry-wide mutual aid agreement to enable sharing of resources between companies.

On building resilience, the paper says priorities for the water sector include:

Cyber Security: To better understand the vulnerability of the water industry to cyber-attack, the potential consequences of such an attack, and the options for mitigating the risks.

Re-zoning: To build a better understanding of the capabilities within the industry to re-route water supplies from other parts of water networks (“re-zoning”) in the event of a loss of one or more water supply assets, and of the numbers of people potentially left without supply after all re-zoning options had been implemented.

Power loss: To build a deeper understanding of the resilience of the water industry against significant power loss.

Flooding: To build a wider knowledge-base of the resilience of water supply assets to flooding across the industry.

Flooding a key risk across a number of sectors

Flooding is highlighted as a risk for a number of sectors in the paper. For example, the assessment of existing resilience in the energy sector says major risks to the energy sector include all types of flooding (including coastal flooding), storms and gales, and absence of key staff. Energy companies are currently building resilience to this by implementing a large programme of flood protection measures which is due for completion by the early 2020s.

Last week the National Infrastructure Commission launched a consultation including water, sewerage and flood defences as part of its responsibility to produce a National Infrastructure Assessment (NIA) once every Parliament.

Click here to download Summary of the 2015-16 Sector Resilence Plans

Click here to download Keeping the Country Running: Natural hazards and infrastructure

Click here to download – National Risk Register of Civil Emergencies 2015