Cyber incidents and attacks can disrupt energy related essential services e.g. causing electricity blackouts or causing damages to existing infrastructure. A reliable energy system is the backbone of the economy. Energy supply powers industry and is essential to our daily lives (home, work, movement and entertainment).
The harmful effects of cyber incidents and attacks can be widespread on individuals, organisations and communities. A cyberattack or a cyberincident in one country can affect the EU energy digitalised system in more than a single geographical area, also causing cascade effects.
Cybersecurity is so critical in energy that Europe's legislators have adopted a sector-specific approach to reinforce cyber security in electricity which applies in addition to the general cyber laws.
See ACER's Cybersecurity Glossary.
How realistic are cyber threats in energy?
Cyber threats in energy are very real and cyber incidents increase in frequency and in their impact. In Ukraine, 225,000 people lost power in a cyberattack in 2015 on the electricity grid infrastructure. For electricity systems, the threat of cyberattack is substantial and growing.
With heightened cyber threats, increasingly digitalised critical energy infrastructure is vulnerable to attacks. The very interconnectedness of assets across the energy system, if not cyber secure, makes them vulnerable to threats.
How does ACER contribute to cybersecurity?
ACER contributes to strengthening the cybersecurity of Europe's energy system in three main ways:
1. Advising on EU legislation and rules
ACER and national regulators provide expert advice on EU legislation and cyber rules relating to the energy sector.
In 2021, at the request of the European Commission, ACER is developing Framework Guidelines (under the Electricity Regulation) which will help shape a legally binding EU-wide Cybersecurity Network Code for Cross-Border Electricity.
ACER and regulators are actively engaged in European Commission Expert Groups.
2. Sharing information among energy regulators and capacity building
Since 2015, ACER and the national energy regulators cooperate and share information in a dedicated cybersecurity task force co-chaired by ACER and CEER:
Such collaboration covers issues such cybersecurity preparedness, response, recovery planning, and regulatory approaches to drive prudent risk reduction effort
Outputs include shared resources, reports and recommendations
This task force (and CEER training courses) help ongoing capacity building with the aim to prevent, detect, respond, and recover from cyberattacks
Prepare and distribute factsheets, reports and papers with the aim to explain and explorer complex and emerging cybersecurity topic of interest for the energy community, as well as to provide the position of regulators in respect to the adoption of such principles and technologies
3. ACER's leading cyber experts contribute to EU and international collaboration
ACER's cyber specialists are leading global cyber security experts who fosters best practices globally:
ACER and energy regulators engage with fellow international experts (e.g. NERC, EPRI and NARUC in the US) to share expertise and experience on issues such as standards, strategy and the prudency of investment
ACER engages with network operators and the EU Institutions and Agencies (e.g. ENISA, DG ENER and the Joint Research Centre), participating in the Commission's expert groups in developing European-wide cyber approaches
ACER engages with the standardisation community with the purpose to use already existing standards, where those exist, or to strive future standardisation efforts that may be needed for the efficient implementation of the Regulation
