Resilience mandates,held to evidence.
Resilience mandates for operators of critical infrastructure and custodians of regulated data — advisory and delivery oversight, not a managed security service.
- Focus
- OT and IT
- Position
- Advisory · Oversight
- Governance
- PMO-led
OT · ITRisk is a governance problem before it is a technical one.
- Operators
- Energy, utilities, industrial and transport operators; custodians of regulated data
- Scope
- Assessment, control design oversight, vendor selection, regulatory alignment, governance
- Position
- Advisory and delivery oversight; we do not operate a managed security service
Most security spending is decided before anyone can show what it reduces. Vendors are selected on reputation, controls are adopted because a framework names them, and the programme is measured by activity rather than by what an operator can actually continue to do during an incident.
AQUAMERGE works on the operating case. We assess what the operator cannot afford to lose, identify where the technology estate and the operational estate meet, and set out the controls and the sequencing that follow from that — then hold the delivery to it.
Where an industrial estate is involved, the operational technology is treated as the constraint it is: systems that cannot be patched on a conventional cycle, equipment with decade-long service lives, and safety consequences that outrank availability.
We hold the mandate and the evidence. We do not claim certifications, framework compliance or technology partnerships we have not contracted.
Five parts of a resilience mandate.
Advisory and oversight. Delivery is performed by the operator's own teams and selected vendors, governed through a single mandate.
- 01
Risk and resilience assessment
Critical functions, dependencies and single points of failure identified, with the operational consequence of each outage stated in business terms.
- 02
OT and IT security
Industrial and energy estates assessed separately from the corporate estate, with segmentation, remote access and recovery sequenced against production risk.
- 03
Vendor selection and oversight
Requirements written before products are demonstrated, with vendor performance measured against contracted obligations rather than claims.
- 04
Regulatory alignment
Obligations mapped to controls that exist and can be evidenced, including reporting and record-keeping duties.
- 05
Programme governance
A PMO holding priorities, budget, dependencies and reporting, so the programme is managed as delivery rather than as a series of purchases.
Four stages from assessment to assurance.
- 01
Assess
Critical functions, estate inventory, dependencies and existing controls documented and tested against the operating case.
- 02
Design
Target controls, sequencing and vendor requirements set out, with cost and operational impact stated for each.
- 03
Deliver
Implementation overseen across internal teams and vendors, with change control applied to production environments.
- 04
Assure
Controls evidenced, tested and reported to the board or regulator, with the residual risk stated plainly.
The mandate is advisory and supervisory. It does not replace the operator's own accountability or the role of its regulators.
Evidence rather than assurance by assertion.
Operating consequence first
Each control is justified by what the operator can continue to do, not by what a framework lists.
Industrial reality
OT estates assessed on their own terms: long service lives, safety consequences and constrained maintenance windows.
Vendor accountability
Requirements written and performance measured against the contract, with oversight held through delivery.
No unsupported claims
We do not claim certifications, framework compliance or technology partnerships we have not contracted.
Discuss a resilience mandate.
Tell us the estate, the obligation and the event you are preparing for. We will tell you whether we can help and where the mandate should start.