Energy interconnector: ISO 27001 & IEC 62443 audits passed in 6 months

Context

A lean operator (around 40 people) running a high-voltage subsea electricity interconnector between the UK and continental Europe. Under ISO 27001, IEC 62443, NIS legislation and shareholder scrutiny, it needed to structure cyber risk and compliance governance quickly, across both IT and OT.

FuturWork deployed a senior Risk & Compliance Manager working across both countries.

Challenges

• No structured governance. No regulatory register, policy repository or compliance dashboard, and fragmented IT and OT documentation.
• Imminent dual audit. ISO 27001 and IEC 62443 certification required within 6 months, with evidence-based risk management.
• IT–OT integration risk. Coexisting IT and OT environments, with no measurable KPIs for third parties.

What we did

• Governance structure. Central regulatory register, policy repository, RASCI model, three lines of defense and stakeholder mapping.
• Modern risk framework. Bowtie methodology and risk assessments aligned with NIST, ISO 27001 and IEC 62443, each with an accountable owner.
• Audit and executive reporting. Internal audit plan, evidence repository, management dashboards and audit coordination.

Results

• ISO 27001 and IEC 62443 audits passed
• 100% of compliance evidence centralized
• From gaps to audit success in 6 months

From fragmented compliance to cross-border audit success.

Facing a similar challenge? Talk to our team.