Critical Infrastructure Protection — Mains Strategy

Mains Strategy

Start with an essential function and trace the dependencies that could interrupt it. A hypothetical hospital service may rely on power, communications, identity systems and accessible clinical information. Explain how a failure propagates before recommending controls. This turns an abstract cyber-risk answer into a public-service continuity analysis.

Group measures by purpose: governance assigns responsibility, protection reduces exposure, detection and response limit incident duration, and recovery restores a validated service. Include supplier and inter-agency coordination where the dependency map requires it. For operational technology, connect change management to safety rather than importing an office-computer maintenance rule without qualification.

Use exercises to test assumptions about fallback and restoration. Ask who authorises degraded operation, how integrity is checked before restart and whether apparently redundant systems share a failure source. Conclude with measurable readiness for essential functions, not a promise of perfect prevention. The answer should recognise limited resources and prioritise consequences while retaining accountability for routine maintenance and known weaknesses.