Stage 3 summary. Practice and strategy

The 2024 to 2026 wave of cyber regulation exists because voluntary adoption failed for essential services, and it works by making security a duty of the management body rather than a discretionary line in an IT budget. In the EU the load-bearing instruments are NIS2, whose transposition deadline of 17 October 2024 was missed by several states, so that by mid-2026 the Commission had referred Ireland, Spain, France and the Netherlands to the Court of Justice; DORA, which has applied to nearly all EU financial entities since 17 January 2025; and the Cyber Resilience Act, in force from 10 December 2024 with vulnerability-reporting duties from 11 September 2026.

The United Kingdom is not covered by NIS2, and treating it as if it were is a common and consequential error. The UK path runs through the NIS Regulations 2018 and the Cyber Security and Resilience Bill, introduced on 12 November 2025 and in the Lords by June 2026, which brings managed service providers and data centres into scope with 24-hour initial incident reporting. The Cyber Assessment Framework version 4.0, released on 6 August 2025, is the outcome-based yardstick, and GB energy operators of essential services answer to Ofgem and DESNZ against an Ofgem-adapted CAF profile.

Assurance instruments have to be placed honestly. ISO/IEC 27001:2022 carries 93 controls in four themes, and its transition from the 2013 edition closed in October 2025, so 2013-era framing is now simply wrong. But certification of any kind, whether ISO 27001, Cyber Essentials or a CAF self-assessment, is a snapshot of a management system rather than proof of resistance to attack, which is why every framework is paired with the question of what a motivated attacker would do anyway.

The perimeter model assumed that inside the network was safe and outside was hostile, and the assumption has collapsed. The Verizon 2025 report shows a sharp rise in the exploitation of VPN and edge devices, so the appliance meant to guard the boundary is now itself among the most attacked assets. Zero trust is the corrective posture: never trust by location, always verify explicitly, and grant the least privilege needed, evaluating each request at a policy decision point that instructs a policy enforcement point to allow or deny.

The crucial teaching is that zero trust is not a product. NIST SP 800-207 sets out the architecture, and SP 1800-35, finalised in June 2025, documents 19 example builds using 24 vendors mapped to the CSF, which proves the posture is buildable from ordinary products while confirming there is nothing to simply purchase. CISA's Zero Trust Maturity Model version 2.0 gives the pillars and the traditional-to-optimal ladder that lets an organisation say where it actually stands rather than claiming a finished state.

Exposure reduction extends to the endpoint. Mobile device management and bring-your-own-device rules are exposure decisions, where device compliance becomes a signal that a conditional access policy can require before granting access to sensitive systems. Microsegmentation limits how far an attacker who does get in can move, which is the practical admission that prevention will sometimes fail and containment has to be designed in advance.

The software supply chain is an attack surface because most software is assembled from components the builder did not write. SolarWinds showed an attacker compromising the build pipeline itself, Log4Shell showed a single ubiquitous library exposing half the internet, and the xz-utils backdoor of 2024 showed a patient social-engineering attack on an open-source maintainer. A software bill of materials, in the SPDX or CycloneDX format, records exactly what a build contains so that the first question after a disclosure, which of our systems even includes this component, has a fast answer.

Knowing what is in a build is necessary but not sufficient, because the bill of materials has to be trustworthy. SLSA, which originated at Google, was donated to the OpenSSF and reached version 1.0 in April 2023 with 1.2 current, describes levels of build provenance, and Sigstore provides the signing that lets a consumer verify a component came from the build it claims. A VEX statement then tells downstream users whether a listed vulnerability actually affects the product, so that an SBOM does not simply generate noise.

Regulation now expects this. The CAF's contributing outcome A4.b on secure software development and support means that for critical national infrastructure, supply-chain assurance stopped being hygiene advice and became a regulated expectation in August 2025, which is why this module cross-references regulation-and-assurance rather than re-teaching it.

There are always more vulnerabilities than time to fix them, so triage is the whole discipline, and ordering a queue by CVSS base score alone is the mistake to avoid because severity is not likelihood. CVSS 4.0 measures how bad a flaw would be if exploited, which is context rather than a decision. EPSS, at version 4 since March 2025, estimates the probability that a given vulnerability will be exploited in the near term, and CISA's Known Exploited Vulnerabilities catalogue records what is being exploited right now.

The teachable rule is explicit and worth stating in order: fix anything on the KEV list first because it is being used against real targets, then work down by EPSS-weighted likelihood, and treat the CVSS score as severity context that colours the decision rather than making it. A meaningful share of actively exploited flaws carry only medium base scores, which is precisely why a CVSS-only queue misranks the real risk.

Mature teams stopped depending on a single data source after the NVD enrichment backlog of 2024 to 2025 slowed the flow of scored data, and structured methods such as SSVC decision trees give a repeatable way to turn the several inputs into an action when a single number is not a decision. The lifecycle around all this, from discovery through patch to verification, is what the SLA framing measures.

Incident response has a documented backbone in NIST SP 800-61 Revision 3, and the enduring lifecycle of preparation, detection, containment, eradication, recovery and lessons learned still frames the work. MITRE ATT&CK gives the shared language of adversary behaviour, and it is moving: version 18 in October 2025 replaced per-technique detections with structured Detection Strategies and Analytics, and version 19 in April 2026 split Defense Evasion into Stealth and Defense Impairment and added ICS sub-techniques.

The central modern idea is detection as code. A detection rule is software, and like software it rots as systems change, so it belongs in version control with authoring, review, continuous-integration testing, deployment, tuning and retirement, rather than being clicked into a console and forgotten. Treating detections this way is what keeps coverage honest as the estate underneath them moves.

The security operations centre is a capability, not a room. SIEM, SOAR and XDR each do a different job, and an organisation chooses between running its own SOC and buying managed detection and response on factors such as scale, skills and coverage hours. Purple teaming closes the loop by having attack and defence work together to prove that a detection actually fires, while cyber threat intelligence supplies the requirements that tell the SOC what to look for. The Maersk recovery from NotPetya anchors the module, and this stage returns to the same incident from the recovery angle later.

The ransomware business model shifted from locking data to stealing it. Double, triple and quadruple extortion add the threat to leak, to attack availability, and to harass customers and staff on top of encryption, and around 77 percent of 2025 attacks involved exfiltration, with some skipping encryption entirely. The asset at risk moved from availability to confidentiality, so the control set moves with it, and this is why a strong backup regime, which answers the availability half, does not defuse the threat to leak.

The payment market is collapsing while individual payouts grow. Coveware reported that about 23 percent of victims paid in the third quarter of 2025, down from 85 percent in 2019, and Chainalysis found total payments fell roughly 35 percent to 813 million US dollars in 2024. Refusing to pay is now the statistical norm, which changes the negotiation, and the ecosystem fragmented into around 85 active groups after the LockBit and ALPHV takedowns.

The payment decision is a pre-agreed procedure, not an on-the-night debate. It runs through gates: legality and sanctions exposure under OFSI and OFAC, insurer consent, the evidence that paying would actually recover data and that stolen data would actually be deleted, which payment guarantees neither, and who at board level holds the authority. The UK is legislating a targeted ban on ransom payments by the public sector and CNI operators, confirmed in the Government response of 22 July 2025, which for those organisations turns the question from whether they would pay into a plan in which they may not, making resilience the only answer.

Recovery is a first-class function in its own right. NIST CSF 2.0 and the CAF's objective D make surviving and restoring a designed capability that regulators now ask for evidence of, on the reasoning that an organisation which cannot restore is one bad afternoon from not existing. The 3-2-1 rule, three copies on two media with one off-site, is the floor rather than the finish line.

Against a live adversary the properties that matter are the ones that resist an attacker who deletes backups first. Copies need to be offline or immutable so they cannot be encrypted or erased, held under separate credentials and trust domains so a single compromised identity cannot reach them, and restored at production scale in a real test rather than assumed to work. Backup design is adversarial design, not storage administration. Recovery targets are business decisions: the recovery time objective and recovery point objective come from each service's impact tolerance, and an RTO nobody costed is a wish rather than a target.

Recovery has to be exercised before it is needed, because the first full restore must not happen during the incident. NCSC's Exercise in a Box provides a free structure of exercises across many topics, and progression runs from tabletop discussion to technical restore drills, with crisis communications and a decision cadence for the first 72 hours. Even perfect recovery does not answer exfiltration, which is where this module ties back to ransomware economics: resilience covers the availability half and governance and disclosure cover the rest. Maersk's rebuild of 45,000 PCs and 4,000 servers in about ten days, at roughly 300 million dollars of impact, is the same NotPetya incident examined through the recovery function.

Cryptography is applied trust with failure modes, and keys fail more often than algorithms do. The SP 800-57 lifecycle of generate, distribute, use, rotate, revoke and destroy is where most real weaknesses live, and a key management service or hardware security module, validated to FIPS 140-3, is where custody is meant to be held. Sometimes the right control is not holding the data at all, which is why data-loss prevention as an egress policy and tokenisation of stored payment data belong in the same module as encryption.

The post-quantum transition has dates worth memorising. NIST finalised FIPS 203 ML-KEM, FIPS 204 ML-DSA and FIPS 205 SLH-DSA on 13 August 2024, and selected HQC on 11 March 2025 as a backup key-establishment mechanism. NIST IR 8547 deprecates 112-bit-strength classical public-key cryptography by 2030 and disallows quantum-vulnerable algorithms by 2035, while the NCSC sets milestones of discovery and a plan by 2028, highest-priority migrations by 2031, and completion by 2035.

The urgency is not speculative and not already upon us. No quantum computer breaks RSA-2048 today, but harvest-now-decrypt-later means an adversary can capture encrypted traffic now and decrypt it once a capable machine exists, so anything with a long confidentiality lifetime is already exposed. The proof that migration is under way is that hybrid key agreement using X25519MLKEM768 has been the default in Chrome since version 124 in April 2024 and in Firefox since 132, and carried a large share of Cloudflare's HTTPS traffic by 2025. A migration begins with discovery: where TLS terminates, where long-lived secrets sit, and which vendors have PQC roadmaps.

In operational technology the priorities invert. Where IT protects confidentiality first, OT protects safety and availability first, because the worst outcome of an OT incident is not lost data but physical harm to people or plant. That single inversion is why IT instincts mislead here: patching a live controller may be more dangerous than the flaw, and equipment often runs for fifteen or twenty years without a reboot.

The Purdue model organises assets into levels 0 to 5, from sensors and actuators up to enterprise IT, and the honest teaching is that the clean levels blur in practice. Industrial internet-of-things sensors, cloud telemetry and remote maintenance all cross the boundaries, so the air gap that is supposed to protect industrial systems rarely survives normal operations. The ISA/IEC 62443 series answers this with zones and conduits as the design grammar, security levels SL1 to SL4, and a split of roles between asset owner, integrator and product supplier, with NIST SP 800-82 Revision 3 as the canonical free guide.

GB energy makes the stakes concrete. Energy operators of essential services fall under the NIS Regulations 2018 with Ofgem and DESNZ as competent authority, assessed against an Ofgem-adapted CAF profile that weights OT heavily, and the sector gains digital surface every quarter as system operation, market reform and metering all modernise. The IT and OT boundary in practice is held by jump hosts, protocol breaks and unidirectional gateways, alongside the organisational question of who actually owns patching a fifteen-year-old programmable logic controller.

Most bad AI-security advice comes from answering one problem with a control meant for another, so the four lenses have to stay distinct: securing AI systems, defending against AI-enabled attacks, using AI for defence, and governing AI. Keeping them apart is the first discipline, because a governance framework does not stop prompt injection and a runtime control does not discharge a legal duty.

Securing AI systems runs on the OWASP Top 10 for LLM Applications 2025, from LLM01 Prompt Injection through to unbounded consumption. Prompt injection comes in a direct form, where the user's own input subverts the model, and an indirect form, where malicious instructions arrive inside content the model retrieves, and the honest teaching is that no deterministic fix exists. Defence is therefore least-privilege tooling, careful handling of untrusted output, human approval gates on consequential actions, and adversarial testing, with agent-era risks such as excessive agency and tool poisoning of the Model Context Protocol layered on top.

AI-enabled attacks have moved from theory to record. Deepfake fraud and LLM-written lures removed the old tells, and in November 2025 Anthropic disrupted GTG-1002, a largely autonomous espionage campaign in which AI agents executed an estimated 80 to 90 percent of the operation, showing that attacker unit economics improved so that volume and quality stopped trading off. Governing all of this draws on the NCSC and CISA Guidelines for Secure AI System Development from November 2023, the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act, with the CAF weaving AI risk through existing outcomes rather than bolting it on.