Case Study · Regulatory & Carve-Out Separation · Regulated Critical Infrastructure
Turning Paper Independence into Actual Control
The legal instruction was clear enough: separate the enterprise. That was not the difficult part. The difficult part was proving what separation actually meant when the strategy, infrastructure, security, suppliers and investment decisions still sat somewhere else. The paperwork said autonomy. The plumbing said otherwise.
>20%
Projected transition expenditure reduction versus the accelerated route
3 options
Full separation architectures independently evaluated
10-point
Assessment framework across cyber, resilience and control
1 taxonomy
Unified TBM language across the technical estate
The question
Can a regulator hold an enterprise to account when it has a vision for separation, but not enough clarity on the strategy, roadmap, costs, dependencies or technical plan to know whether the proposal in front of it is credible?
A mandate with teeth
A regulated critical infrastructure operator had been instructed to separate from its parent group. The legal boundary was drawn clearly enough. Beneath it, however, the operating model, hosting arrangements, cyber controls, supplier contracts and technology investment decisions remained deeply shared.
That distinction mattered. Corporate independence is not established by moving boxes on an organisation chart or replacing one service agreement with another. It exists only when an enterprise can understand, fund, secure, operate and change the systems on which its obligations depend — and can prove who is accountable when those systems fail.
Two flawed choices
The regulator was presented with two routes. The first accelerated separation but depended on unresolved hosting exits, compressed delivery assumptions and significant investment before the underlying dependencies had been properly evidenced. The second promised minimum change, but preserved substantial reliance on the parent through service arrangements whose control, accountability and exit mechanics were not strong enough.
Neither proposal answered the central question. One moved quickly without demonstrating that the destination was safe. The other reduced immediate disruption by leaving the very dependencies the mandate was intended to remove. Optimism had taken the place of architecture, and cost estimates were being discussed before the technical estate had a common language.
Finding the fire, not admiring the smoke
Watchmen created an objective Technology Business Management taxonomy spanning applications, platforms and infrastructure. That common model allowed conflicting plans and assertions to be compared against the same evidence rather than defended through different terminology.
Three separation architectures were then tested using a 10-point assessment framework covering cyber posture, operational resilience, technical control, commercial independence, delivery feasibility and transition risk. Shared hosting, security operations, supplier dependencies and decision rights were traced to the point at which accountability either became real or disappeared into a contract boundary.
The phased pathway
The assessment exposed intermediate migration steps that added cost and complexity without creating genuine independence. Watchmen replaced them with an evidence-led phased pathway: sequence the dependencies, establish operational control early, separate only where separation produced a measurable reduction in risk, and make every transitional arrangement carry a credible exit.
The resulting route reduced projected transition expenditure by more than 20% compared with the accelerated option while giving regulatory leadership a clearer line of sight from policy intent to technical evidence. The outcome was not merely a more economical programme. It was a plan capable of showing where control sat, when it would move and how independence would be demonstrated rather than declared.
What Watchmen did
- Established a unified Technology Business Management taxonomy across applications, platforms and infrastructure to eliminate ambiguity in reporting.
- Conducted independent architectural and delivery assessments across all three separation options.
- Evaluated the options using a 10-point framework spanning cyber posture, operational control, commercial independence and transition risk.
- Identified hidden critical-path dependencies in hosting exits and rejected artificial intermediate migration steps.
- Formulated an evidence-backed phased transition pathway reducing projected capital expenditure by more than 20%.
- Equipped regulatory leadership with the technical challenge framework needed to enforce genuine accountability.
Call Watchmen when complex corporate separation, carve-out mandates or regulatory unbundling demand independent technical scrutiny that cuts through optimistic roadmaps to deliver real operational control.