Cyber Essentials Plus at LDS: Security as a Foundation for Reliable Systems
We have achieved Cyber Essentials Plus at LDS.
Not for the badge, but for the standard it holds us to.
Cyber Essentials Plus is independently verified. It requires hands-on technical assessment, testing devices, configurations, access controls and vulnerability management in a live environment. It is designed to answer a simple question: do the controls actually work, in practice?
That process is deliberately rigorous.
It moves the conversation beyond policies and intentions and into evidence. What is configured, not what is documented. What is enforced, not what is assumed. And importantly, whether those controls are applied consistently across the organisation.
For us, going through that process meant taking a close look at how our environment operates day to day.
Reviewing endpoint configurations. Validating access controls. Ensuring patching and vulnerability management processes hold up under scrutiny. More importantly, it meant challenging our own assumptions and checking that what we think is happening is actually happening, everywhere and consistently.
One moment during the audit captured that well.
As part of the independent testing, the assessor attempted to access systems using a deliberately unpatched device. It is a straightforward test, but a revealing one. Either your controls hold, or they do not. In our case, access was blocked exactly as intended, because the policies we have put in place are enforced consistently.
That is what this certification is really about.
Not perfection, but reliability. Systems behaving as designed, even when tested from the outside.
This matters because of the space we operate in.
The energy systems we design and optimise are no longer isolated. They are connected, data-driven and increasingly autonomous. They rely on continuous interaction between assets, platforms and external networks to function effectively.
In that environment, cyber security is not a separate concern. It is a core characteristic of system performance.
A system that is vulnerable is a system that cannot be relied upon, whether that risk manifests as disruption, degraded performance or loss of control. Cyber, in that sense, becomes a constraint on reliability, just as much as physical design or operational limits.
If it is not secure, it is not reliable.
That is why this matters for our clients.
Achieving Cyber Essentials Plus demonstrates that the foundations are in place:
- risk is actively managed, not passively accepted
- systems are resilient to common attack vectors
- controls are applied consistently across the environment
- and assurance comes from independent testing, not internal belief
It reduces the likelihood of avoidable failure. It strengthens the resilience of the systems we design and operate. It provides confidence that what has been put in place will stand up under real-world conditions.
It also reflects how we approach engineering at LDS more broadly.
Start with strong fundamentals. Build from first principles. Test assumptions. Ensure that what is designed performs as expected in reality, not just in theory.
Cyber Essentials Plus is one step in that direction, not an endpoint.
We will share more on what we have learned through the process and how it continues to shape the way we think about system design, resilience and performance. For now, it is a meaningful milestone for the team and a clear reinforcement of the standards we hold ourselves to.
