Critical Infrastructure Runs on Trust It Can’t Prove: Closing the Evidence Gap Before the Regulator Finds It

Introduction

Ask an energy utility, a hospital network or a water provider whether their operations are secure, and the answer is almost always yes. Ask them to prove it, with records rather than reassurance, and the confidence usually thins out fast. Critical infrastructure operators are increasingly expected to demonstrate resilience on demand, not just claim it, and demonstrating it requires evidence most organisations have not been systematically keeping.

The regulatory reality facing these operators has become genuinely two-sided. Physical resilience obligations under KRITIS-style frameworks now sit alongside cybersecurity and incident-reporting duties under regimes like NIS2, because an operator significant enough to register as critical infrastructure is, by definition, also significant enough to fall under essential-entity cybersecurity requirements. This article looks at why the evidence gap on the cyber side of that obligation is so common, and what closing it actually requires.

• Takeaway 1: Critical infrastructure status now carries both physical and cyber obligations simultaneously. An operator registered as a critical facility is typically also classified as an essential entity under cybersecurity regulation, with a separate evidence bar to meet.
• Takeaway 2: Physical resilience is easier to demonstrate than cyber resilience because it is visible. A fence, a guard rotation or a backup generator can be inspected directly; access controls and data governance cannot be verified by walking the site.
• Takeaway 3: Trust in cyber resilience without records is not resilience, it is an assumption. An operator that cannot produce a specific account of who accessed what, and when, is relying on the absence of an incident rather than on demonstrated control.
• Takeaway 4: Regulators increasingly expect continuous evidence, not a one-time assessment. A risk assessment filed once does not answer what a supervisory authority asks after an actual incident: what happened, and what controls were operating at the time.
• Takeaway 5: The evidence a critical infrastructure operator needs is the same evidence every essential entity needs, just under higher scrutiny. A complete, continuous, cross-channel audit trail closes the gap between claiming resilience and proving it.

Executive Summary

Critical infrastructure operators face a compliance surface that has genuinely expanded: physical resilience requirements, covering registration, risk assessment and protective measures against sabotage or disaster, now sit alongside cybersecurity obligations that apply because the same operator qualifies as an essential entity under broader cyber regulatory compliance. The physical side tends to get proportionate attention because it produces visible, inspectable evidence. The cyber side tends to lag, because the evidence it requires, a continuous, queryable record of data access and system activity, is harder to produce after the fact if it was never being captured systematically. For risk and compliance leaders in these sectors, the practical priority is closing the evidence gap on the side of the obligation that is easiest to underinvest in precisely because failure there is invisible until an incident, or a regulator, makes it visible.

Why Critical Infrastructure Now Means Both Physical and Cyber Obligations

The operators who qualify as critical infrastructure, in sectors such as energy, health, water, transport and digital infrastructure, increasingly find that their designation triggers two separate, parallel sets of obligations rather than one.

Physical Resilience and Cyber Resilience Are Regulated as Distinct Obligations

Physical resilience frameworks focus on the continuity of essential services against disasters, sabotage and physical disruption: registration with the relevant authorities, impact assessments, and protective measures for the facility itself. Cybersecurity obligations, applying because the same operator is also classified as an essential entity, focus on a different set of risks entirely: incident reporting, risk management of information systems, and evidence of technical and organisational security measures. An operator can satisfy one thoroughly and still be exposed on the other.

Scrutiny Rises Faster Than Most Operators’ Evidence Practices Do

As designation thresholds capture more organisations and coordination between physical and cyber supervisory authorities increases, the practical expectation on operators rises correspondingly: not just having controls, but being able to produce a specific, timestamped account of how those controls performed when something happened. Many operators built their evidence practices for a lower level of scrutiny and have not caught up to what is now expected of them.

Why Physical Evidence Is Easy and Cyber Evidence Is Hard

The asymmetry between the two obligations is not about which one operators take more seriously. It is about which one produces evidence naturally and which one requires deliberate design to produce evidence at all.

You Can Walk the Perimeter, You Cannot Walk the Access Log

A physical security measure, a fence, a badge reader, a guard rotation, is something an inspector can verify by observing it directly. Cyber resilience has no equivalent walk-through. Whether access to sensitive systems and data was actually controlled, monitored and logged as claimed can only be verified by examining records, and those records only exist if the underlying systems were built to capture them continuously in the first place.

Absence of an Incident Is Not Evidence of Control

Many operators quietly treat the fact that nothing has gone wrong yet as a substitute for demonstrated control. This is a dangerous substitution, because it collapses the moment an incident or a regulatory inquiry actually happens. An operator asked to show exactly what happened during a specific window, who accessed which systems, and what data moved where, needs that answer to already exist as a record. It cannot be reconstructed retroactively from memory or assumption.

What Closing the Cyber Evidence Gap Actually Requires

Closing this gap is not primarily a matter of writing better policies. It is a matter of ensuring the systems handling sensitive operational and personal data actually generate the evidence a policy claims exists.

Continuous Logging Across Every System That Touches Sensitive Data

An operator’s evidence gap is rarely about willingness to comply. It is about logging that was configured for operational troubleshooting rather than regulatory evidence, throttled under load, incomplete across systems, or simply never correlated into a single account of what happened. Continuous, complete logging across every channel handling sensitive data turns an incident inquiry into a matter of retrieving records rather than reconstructing a guess.

Evidence Has to Be Ready Before the Regulator Asks, Not After

A supervisory authority investigating an incident at a critical infrastructure operator will ask specific questions: what data was accessed, by whom, under what authorisation, and what controls were in place. An operator that can answer immediately, from existing records, is in a fundamentally different position than one that has to explain why the records do not exist or cannot be assembled in the time available.

Building the Evidence Base Before It Is Needed

The practical priority for a critical infrastructure operator is to audit the cyber side of its obligations with the same rigour it already applies to physical resilience: confirm that logging is continuous and complete across every system handling sensitive operational or personal data, that the resulting record can be queried quickly rather than assembled manually, and that it would actually satisfy a supervisory authority asking for specifics. Doing this before an incident, rather than during one, is what turns a resilience claim into a resilience fact.

How a Data Control Plane Provides the Evidence Critical Infrastructure Operators Need

Proving cyber resilience, rather than asserting it, requires a governance layer that captures every access, send, share and download across every channel sensitive data moves through, including email, file sharing, APIs and AI agents, continuously and in a form that can be queried on demand rather than reconstructed after the fact.

The Kiteworks Data Control Plane applies data-aware, zero-trust controls to every action across every channel and captures each one in a tamper-proof, unthrottled audit log that feeds directly into SIEM tooling, giving critical infrastructure operators a continuous, queryable record of exactly what happened to sensitive data, when, and under whose authorisation. Single-tenant deployment, on-premises, in a self-hosted cloud tenancy, or as a dedicated hosted instance, means this evidence base sits under the operator’s own control rather than depending on a shared, external platform. When a supervisory authority or an internal investigation asks what happened, the answer already exists as a record, rather than needing to be assembled under pressure.

Organisations that want to see whether their own cyber evidence practices would hold up under this kind of scrutiny can schedule a custom demo to walk through how continuous, cross-channel audit evidence applies to their own critical infrastructure environment.