Yes CPNI is technically part of MI5 but they're not full on spooks per se (and MI5 don't do CPNI's job). They receive intelligence from other departments and are responsible for certain elements of gov.uk security, although the primary source for information assurance/security is CESG based at GCHQ (which is more MI6 than 5).<p>CPNI also handle liaison what's called the Critical National Infrastructure. That is to say things that are not government owned but would cause problems if affected (like power companies, transport firms etc.).<p>As an analogy CESG are probably closer to NIST and the standards part of the NSA, whereas CPNI are closer to the FBI. Note that in the US model something like that type of tactic would be a CIA or military operation, not NSA - MI5 and MI6 would be the same, offensive security if anywhere would have fallen in the remit of the armed forces, at least until the recent cybersecurity strategy came out which establishes the structure of the UK's offensive function.