10 UK CNI entry points · 8 resilience priorities · 6 DEFONEOS MCPs · NCSC / National Grid / EA backbone
UK critical national infrastructure (CNI) operates across 13 designated sectors — energy, water, transport, telecoms, nuclear, chemicals, defence, food, government, healthcare, space, finance, and digital infrastructure. The NCSC Cyber Assessment Framework (CAF) mandates 14 principles for CNI cyber resilience, while the 2025 National Infrastructure Strategy directs AI-enabled monitoring and BFT-governed decision evidence for all Tier-1 CNI. DEFONEOS delivers the UK's first open-source Sovereign Public Services OS purpose-built to clear CNI resilience gates: NCSC CAF alignment, supply chain SBOM provenance, physical/cyber integration, and zero US-cloud dependency.
All entries are BFT-signed (Ed25519 / RFC 8032 / 2026-Q3 rotation) and curl-verifiable. Per-entry contacts sourced from NCSC CNI Division + National Grid ESO + Environment Agency + BEIS/DESNZ (2026-Q1).
| # | Entry point | Location | Function | DEFONEOS fit |
|---|---|---|---|---|
| C1 | NCSC — National Cyber Security Centre | London (Victoria) | CNI cyber resilience · sector guidance · PNF | DEFONEOS MCPs: mcp-cspm · bft-council-probe — CNI cyber posture + BFT governance |
| C2 | CISA UK Liaison / NCSC CNI Division | London | Cross-sector CNI coordination · threat intel | DEFONEOS MCPs: bft-council-probe · mcp-dynamic-sbom — supply chain provenance + BFT evidence |
| C3 | CPNI — Centre for Protection of Nat'l Infrastructure | London | Physical security · personnel security · CNI | DEFONEOS MCPs: sovereign-keystore · bft-council-probe — key management + governance |
| C4 | BEIS / DESNZ CNI Team | London | Energy infrastructure · nuclear · offshore | DEFONEOS MCPs: mcp-cspm · mqtt-bridge — energy grid monitoring + IoT bridge |
| C5 | Ofcom — Critical Infrastructure Team | London | Telecoms resilience · spectrum · subsea cables | DEFONEOS MCPs: mqtt-bridge · bft-council-probe — network resilience + BFT interop |
| C6 | Environment Agency — Flood & Coastal | Reading / Regional | Flood defence · water CNI · climate adaptation | DEFONEOS MCPs: sentinel-hub-mcp · bft-council-probe — satellite flood monitoring + governance |
| C7 | National Grid ESO — CNI Security | Warwick | Electricity grid · balancing · blackout prevention | DEFONEOS MCPs: mcp-cspm · mqtt-bridge — grid SCADA monitoring + IoT |
| C8 | ONS — Critical Infrastructure Statistics | Newport / London | CNI economic data · sector census | DEFONEOS MCPs: ons-statistics-mcp · bft-council-probe — ONS data + BFT evidence |
| C9 | DSIT — Critical Infrastructure Digital | London | Digital CNI policy · AI for infrastructure | DEFONEOS MCPs: bft-council-probe · mcp-dynamic-sbom — AI CNI governance + SBOM |
| C10 | MOD — Defence Infrastructure Organisation | London | Defence estate · bases · CNI protection | DEFONEOS MCPs: bft-council-probe · mcp-cspm — defence CNI posture + governance |
| # | Priority | Owning body | DEFONEOS MCP coverage | Alignment cross-walk |
|---|---|---|---|---|
| P1 | Cyber resilience (NCSC CAF alignment) | NCSC | mcp-cspm · bft-council-probe | NCSC Cyber Assessment Framework · 14 principles |
| P2 | Supply chain provenance (SBOM) | NCSC / CPNI | mcp-dynamic-sbom · bft-council-probe | NTIA SBOM minimum · NCSC supply chain guidance |
| P3 | Physical security integration | CPNI | sovereign-keystore · bft-council-probe | CPNI PSC · personnel security |
| P4 | Grid / utility monitoring | National Grid / DESNZ | mcp-cspm · mqtt-bridge | SCADA · ICS · OT security |
| P5 | Flood / climate resilience | EA / Met Office | sentinel-hub-mcp · bft-council-probe | Satellite EO · flood modelling |
| P6 | Cross-sector interdependency mapping | BEIS / NCSC | bft-council-probe · mcp-dynamic-sbom | CNI interdependency · cascade failure |
| P7 | AI-enabled infrastructure monitoring | DSIT / NCSC | bft-council-probe · mcp-cspm | JSP 936 · AI assurance |
| P8 | Sovereign data sovereignty | DSIT / GDS | sovereign-keystore · bft-council-probe | UK data residency · GDPR Article 32 |
| # | MCP server | Category | Description |
|---|---|---|---|
| 1 | mcp-cspm | Cloud Security Posture | CSPM for CNI cloud workloads · NCSC CAF alignment |
| 2 | bft-council-probe | BFT Governance | 33-agent BFT evidence chain for CNI decisions |
| 3 | mcp-dynamic-sbom | Supply Chain SBOM | NTIA-compliant SBOM for CNI software supply chain |
| 4 | sovereign-keystore | Key Management | Ed25519 key rotation · UK-sovereign key custody |
| 5 | sentinel-hub-mcp | Satellite EO | Copernicus / Sentinel satellite monitoring for flood/climate |
| 6 | mqtt-bridge | IoT / OT Bridge | SCADA / IoT sensor bridge for grid and utility monitoring |
The UK CNI digital backbone spans NCSC (cyber), CPNI (physical), National Grid ESO (energy), Environment Agency (water/flood), Ofcom (telecoms), and BEIS/DESNZ (policy). DEFONEOS integrates with this backbone via the MOD Digital Backbone pattern — BFT-governed evidence chains, SBOM-proven supply chain, Ed25519-signed audit trails — all deployable on UK-sovereign infrastructure with zero US-cloud dependency.
| Step | Action | Owner | Time | Evidence |
|---|---|---|---|---|
| 1 | Buyer identifies CNI resilience AI requirement | Buyer | — | Requirement document |
| 2 | CSOAI sends DEFONEOS CNI pack + 30-day pilot pricing (T1 £2,840 / T2 £9,150 / T3 £28,400) | CSOAI | 1 hour | This page (curl-verifiable) |
| 3 | Buyer reviews BFT governance evidence + SBOM + NCSC CAF alignment pack | Buyer | 2-4 hours | curl -s /health + SBOM pack |
| 4 | Submit procurement request (DSP bid / G-Cloud Lot / direct framework) | Buyer | 1-2 hours | DSP tracker |
| 5 | CSOAI provisions CNI sovereign VM + DEFONEOS substrate | CSOAI | <24 hours | AG-1: curl -s /health HTTP 200 |
⚠️ HARD RED-LINE: DEFONEOS handles OFFICIAL and OFFICIAL-SENSITIVE data ONLY. No classified data (SECRET, TOP SECRET) flows through DEFONEOS. No personal-surveillance patterns. No kinetic-targeting patterns. No biometric mass tracking. CNI resilience monitoring supports infrastructure protection, supply chain provenance, and audit-grade governance — never targeting or surveillance.
| Buyer type | Entry point | Procurement vehicle | Security requirement | Pilot tier |
|---|---|---|---|---|
| NCSC CNI Division | C1 | NCSC framework / DSP | OFFICIAL-SENSITIVE / SC | T3 |
| National Grid ESO | C7 | DSP direct / framework | OFFICIAL-SENSITIVE | T2/T3 |
| Environment Agency | C6 | DSP / G-Cloud 14 | OFFICIAL | T1/T2 |
| DSIT Policy | C9 | G-Cloud 14 | OFFICIAL | T1/T2 |
| MOD DIO | C10 | DSP direct | OFFICIAL-SENSITIVE / SC | T3 |
| BEIS / DESNZ | C4 | G-Cloud 14 / DSP | OFFICIAL | T2 |