Energy & utilities | Modelled case study
Align CII cryptography with CSA CCOP 2026
How do we align cryptography and key custody with CSA CII CCOP 2026 without disrupting OT?
Reviewed as of 2026-10-26 · primary scenario
The modelled organisation
A recognisable problem reaches the operating agenda
This composite scenario follows the CISO · OT Security Lead · Compliance functions. It is grounded in the cited problem context but does not identify a real customer.
Operating environment
A critical-infrastructure operator spans IT and OT estates, field systems, control networks, vendor remote access, and regulated reporting boundaries.
What is at stake
Cryptographic changes must respect OT change windows, safety cases, air-gapped boundaries, and regulated evidence retention.
Situation
CSA's 2026 CII Code of Practice raises expectations for cryptographic governance in critical information infrastructure, including key custody and crypto-policy evidence.
Event that forces action
CSA CII CCOP 2026 adoption and CII regulatory review cycles.
Concrete system boundary
Systems this case study puts in scope
The model is specific about the operational surfaces that must be discovered, changed, or independently checked.
CII IT/OT segmentation
key custody and HSM boundaries
crypto policy tiers
regulated evidence retention
Modelled case study walkthrough
How this organisation would use QNSI
The walkthrough connects the real-world problem to a bounded QNSI contribution and an independently reviewable result.
Recognise the operating condition
CSA's 2026 CII Code of Practice raises expectations for cryptographic governance in critical information infrastructure, including key custody and crypto-policy evidence.
Frame the decision the owners must make
How do we align cryptography and key custody with CSA CII CCOP 2026 without disrupting OT?
Apply QNSI to the controlled boundary
Apply QNSI policy tiers with HSM custody, record crypto-policy evidence and stage quantum-safe transitions for CII segments.
Leave the team with a concrete result
A CII-aligned crypto-policy and custody evidence pack with staged transition records.
Prove the result in the organisation's environment
Compliance maps CCOP clauses to controls; OT owners validate change windows and air-gapped boundaries.
What useful success looks like
A decision artifact plus proof from the real environment
The model stops at a target result. It becomes an actual case study only when a customer produces and independently validates this evidence in production.
Decision artifact
A CII-aligned crypto-policy and custody evidence pack with staged transition records.
Independent validation boundary
Compliance maps CCOP clauses to controls; OT owners validate change windows and air-gapped boundaries.
Real-world problem grounding
Primary sources behind the model
These sources establish the external requirement, failure mode, or risk context used to model this case. They do not endorse HEOSSI or prove that QNSI completed the scenario.
Customer evidence status
This is modelled, not a customer claim
The organisation is a composite and the result is a target state. This page does not prove a deployment, customer outcome, certification, legal conclusion, regulator endorsement, or completed control.