Resilience Investment at Valemont Water

The two dominant emerging risks are cyber-physical disruption of SCADA and drought-related loss of raw-water availability, both amplified by concentration: one works supplies 70% of customers. The unsupported operating system is a known vulnerability, and last year's five-hour telemetry loss is a warning, not a near-miss to be discounted. Drought is lower frequency (1-in-15 annually) but high consequence.

Within £1.8m, a balanced portfolio is SCADA segmentation and backup (£900k) + drought demand-reduction (£300k) + cyber incident-response retainer (£120k) + tabletop exercises (£80k) = £1.4m, leaving £400k. The second interconnector at £1.4m cannot be combined with the full cyber package. It addresses the single-works concentration, but choosing it alone would leave the unsupported SCADA and drought exposure largely untreated. I would use the £400k to start interconnector design, secure an interim transfer agreement, or fund a staged business case, and state that full redundancy remains a residual risk. The unsupported operating system should be isolated and replaced, not merely backed up. The portfolio reduces likelihood and consequence across both risks while keeping regulatory evidence activity funded.

The stress test should combine a tabletop exercise with a functional test. Scenario: loss of the main works for 72 hours, coinciding with telemetry loss and a 35% reduction in raw-water availability. Participants should include operations, IT/OT, communications, customer service, finance, and external responders. The test should cover detection, isolation, manual operation, alternative supply, mutual aid, critical-customer protection, public communication, and recovery.

Metrics should include: time to detect the incident; time to isolate affected OT; time to restore telemetry; hours of supply maintained; number of customers on alternative supply; coverage of critical customers such as hospitals and care homes; decision latency at the incident management team; and percentage of exercise actions closed by the due date. Targets should be set in advance, for example telemetry restored within four hours and critical customers covered for 72 hours. The exercise should produce an action plan with owners and dates, reported to the board and available for the regulator. Repeat annually and after significant changes.

The board should not frame this as a simple either/or. Cyber risk is a present vulnerability with recent evidence of telemetry loss and an unsupported platform; drought is a probabilistic natural hazard with severe consequence. Both affect the same concentration point. A defensible approach is to fund the SCADA controls and response capability first because they reduce a known, current weakness, while funding demand-reduction because it lowers drought consequence and can be delivered relatively quickly. The interconnector is the strongest structural resilience measure but cannot be bought within the approved envelope alongside the other controls.

Communication should use scenarios, not a single risk score. For example: 'If the main works is lost for 72 hours, current controls leave X customers without supply; the proposed portfolio reduces that to Y, but full redundancy is deferred.' The board should record the residual risk, the reason for deferral, the funding route, and the review date. It should avoid claiming resilience from backup alone. The regulator should see a credible plan and an honest residual position, not an optimistic label. This is managed acceptance with active monitoring.