Critical Infrastructure Cyber Resilience Law

Detailed Explanation With Case Laws

1. Introduction

Critical infrastructure cyber resilience law means the legal rules used to protect important infrastructure from cyber-attacks and to ensure that essential services can continue operating, recover quickly and learn from cyber incidents.

Electricity grids, gas networks, water systems, telecommunications, transport and digital infrastructure increasingly depend on computer networks, operational technology (OT), remote-control systems and data. A cyber-attack on these systems can therefore create physical and economic consequences, not merely an information-security problem.

In the UK, the Network and Information Systems (NIS) Regulations 2018 are an important part of this framework. They impose security and resilience duties on operators of essential services, including energy, water, transport, health and digital infrastructure. (GOV.UK)

2. Meaning of Cyber Resilience

Cybersecurity mainly focuses on preventing and detecting attacks. Cyber resilience is broader.

It requires an organisation to:

identify cyber risks;

protect important systems;

detect attacks quickly;

respond effectively;

maintain essential operations where possible;

recover after an incident; and

improve its systems after the incident.

Therefore, the legal objective is not always to guarantee that an attack will never happen. The objective is to ensure that an attack does not cause unacceptable disruption to an essential service.

3. Critical Infrastructure and the Energy Sector

Electricity infrastructure presents particular cyber risks because modern grids contain both IT systems and operational technology.

Examples include:

SCADA systems;

electricity control centres;

smart meters;

substations;

digital protection systems;

energy-management systems;

remote-control equipment; and

communication networks.

The UK's energy-sector NIS guidance requires designated Operators of Essential Services (OES) to manage security risks affecting systems supporting essential energy services. (GOV.UK)

The UK's 2026 Energy Sector Cyber Security Strategy also recognises the need to identify critical systems, understand dependencies and prepare response and recovery plans for sophisticated cyber incidents. (GOV.UK)

4. Main Legal Duties

A. Risk Assessment

Operators must identify important systems and assess threats against them. This includes considering vulnerabilities, dependencies and possible consequences of disruption.

B. Appropriate Security Measures

The NIS framework requires appropriate and proportionate measures to manage risks to network and information systems. This can include technical controls, access management, monitoring, incident response and business continuity arrangements. (GOV.UK)

C. Incident Reporting

Serious incidents must be reported to the relevant regulatory authority. Reporting allows regulators to understand threats and coordinate responses.

D. Testing and Assurance

Cyber resilience requires regular testing rather than simply having written policies. Organisations may need audits, assessments, exercises and technical assurance.

E. Supply-Chain Security

A critical operator can depend on software providers, cloud services, telecommunications companies and other suppliers. Therefore, cyber resilience increasingly includes third-party and supply-chain risks.

5. UK Cyber Security and Resilience Bill

The UK is also reforming the NIS framework through the Cyber Security and Resilience (Network and Information Systems) Bill, introduced to Parliament in November 2025. The proposed reforms seek broader coverage, stronger incident reporting and stronger regulatory powers. (GOV.UK)

For the energy sector, the 2026 government strategy states that the existing NIS framework has improved resilience but does not cover the entire energy system. The government therefore plans measures to increase baseline cyber resilience across the wider electricity and gas system. (GOV.UK)

6. Case Laws

Hikvision USA, Inc. v FCC

This US federal case is useful for understanding the legal boundaries of critical-infrastructure regulation. The court considered the FCC's reliance on different government definitions of critical infrastructure and examined whether the regulator had adequately connected its regulatory action with the statutory framework.

The case demonstrates an important principle: government classification and cybersecurity regulation must have a proper legal basis and a rational connection with the risks being regulated.

Van Buren v United States (2021)

The US Supreme Court considered the meaning of authorised access to computer information under the Computer Fraud and Abuse Act. The decision is relevant to cybersecurity law because it illustrates how courts carefully interpret statutory language governing access to computer systems.

For critical infrastructure, clear statutory definitions are particularly important because operators, employees and contractors need to understand what conduct is legally authorised.

7. Importance for Energy Law

Cyber resilience is now closely connected with electricity reliability and energy security. A successful cyber incident could affect generation, transmission, distribution or market operations.

The legal framework therefore increasingly requires a combination of:

cybersecurity + physical security + operational resilience + emergency planning + supply-chain security.

The 2026 UK strategy specifically seeks to protect the energy system's most critical components and strengthen cyber assurance and regulatory oversight. (GOV.UK)

8. Conclusion

Critical infrastructure cyber resilience law creates a legal system for ensuring that essential infrastructure can prevent, withstand, respond to and recover from cyber-attacks. In the energy sector, this is particularly important because digital systems now control many physical electricity and gas operations.

The development of the UK NIS framework and proposed Cyber Security and Resilience Bill shows a movement toward risk-based regulation, stronger incident reporting, supply-chain protection and wider coverage of essential infrastructure. The central legal principle is that critical infrastructure operators must take security seriously throughout the entire life of an infrastructure system—from design and procurement to operation, incident response and recovery.