Because of CLP’s role in providing critical power infrastructure, a significant cyber security breach could have a massive impact on local economies by temporarily shuttering essential energy services. Cyber resilience and effective data protection measures allow employees and customers to proceed with their activities without fear or threat of cyberattack.
To counter this and to minimise its exposure to the ever-growing risks posed by cyber threats, CLP has built up strong governance practices and a capable and highly experienced team within CLP Digital.
The Board-level Audit & Risk Committee maintains effective oversight of cyber security risks, while Security, a department of CLP Digital, is responsible for the protection of the Company. From a cyber perspective, this protection ranges from:
Promoting cyber security and data protection awareness amongst staff;
Ensuring cyber security threats across both CLP’s Operational Technology (OT) and Information Technology (IT) systems are reduced to acceptable levels; and
Constantly monitoring CLP systems to deny an attacker any advantage.
During the year, CLP Digital undertook a comprehensive review of its cyber security strategy with the support of an external cyber security specialist consultancy. The review’s aim was to ready CLP for the potential challenges of operating as a Utility of the Future.
As a result of the review, at an operational level, CLP Digital has developed 20 cyber security standards which align with the internationally-recognised NIST Cyber Security Framework. They provide, for the first time, a comprehensive system of acceptable operational practice that will define the Company’s cyber operations going forward. The revised standards will be introduced and implemented in early 2023.
CLP puts great effort into building a corporate culture that can deal with the future challenges associated with handling the accelerating volume of data produced by digital assets. During the year, a wide range of educational initiatives to eqip employees with cyber security capabilities were delivered across the Group, including internal broadcasts, briefing sessions, pop-up booths and webinars. Furthermore, teams of employee volunteers were engaged in CLP Power’s businesses as “Cyber Champions” to help deliver key security messages directly to fellow employees and collect valuable feedback on the effectiveness of CLP Digital’s policies and standards.
