欧洲电力行业联盟-跨境电力流动网络安全方面的网络规范（英）

Networkcodeon

cybersecurity

aspectsofcross-

borderelectricity

lows

AEurelectricresponsepaper

November2023

EurelectricrepresentstheinterestsoftheelectricityindustryinEurope.Ourworkcoversallmajorissuesaffectingoursector.Ourmembersrepresenttheelectricityindustryinover30Europeancountries.

Wecovertheentireindustryfromelectricitygenerationandmarketstodistributionnetworksandcustomerissues.Wealsohaveaffiliatesactiveonseveralothercontinentsandbusinessassociatesfromawidevarietyofsectorswithadirectinterestintheelectricityindustry.

Westandfor

ThevisionoftheEuropeanpowersectoristoenableandsustain:

-AvibrantcompetitiveEuropeaneconomy,reliablypoweredbyclean,carbon-neutralenergy

-Asmart,energyefficientandtrulysustainablesocietyforallcitizensofEurope

Wearecommittedtoleadacost-effectiveenergytransitionby:

investingincleanpowergenerationandtransition-enablingsolutions,toreduceemissionsandactivelypursueeffortstobecomecarbon-neutralwellbeforemid-century,takingintoaccountdifferentstartingpointsandcommercialavailabilityofkeytransitiontechnologies;

transformingtheenergysystemtomakeitmoreresponsive,resilientandefficient.Thisincludesincreaseduseofrenewableenergy,digitalisation,demandsideresponseandreinforcementofgridssotheycanfunctionasplatformsandenablersforcustomers,citiesandcommunities;

acceleratingtheenergytransitioninothereconomicsectorsbyofferingcompetitiveelectricityasatransformationtoolfortransport,heatingandindustry;

embeddingsustainabilityinallpartsofourvaluechainandtakemeasurestosupportthetransformationofexistingassetstowardsazerocarbonsociety;

innovatingtodiscoverthecutting-edgebusinessmodelsanddevelopthebreakthroughtechnologiesthatareindispensabletoallowourindustrytoleadthistransition.

Dépôtlégal:D/2023/12.105/46

WGTechnology

WGThermal&Nuclear

SecretariatGroupDistributedFlexibilityandDatamanagement

WGMarketIntegration&NetworkCodes

WGRetailMarketDesign

WGCustomers&NewServices

Contact:

JessicaGARCIA,Advisor-Distribution&MarketFacilitationtit–

jgarcia@

1

Summaryforconsultation

EurelectricwelcomestheongoingeffortstoenhancecybersecurityandappreciatesthisopportunitytorespondtothedelegatedregulationoftheEuropeanCommission.

Implementationtimescales:

Overall,wefindtheimplementationhorizontoolong.Initscurrentversion,theNCCScouldtakebetween7to10yearsuntilitisfullyimplemented,leavingtheEuropeanelectricitygridmorevulnerabletocyber-attacksinthemeantime.Forinstance,inthescenariowherealldeadlinesaremet,acritical-impactentitywillonlybeobligedtodemonstratecompliancewiththecommonelectricitycybersecurityframework10yearsaftertheentryintoforceoftheNCCS.

.WewelcomeArticle33creatingamappingmatrixtoprovidetheinformationofwhichcontrolsinEuropeanandinternationalstandardswouldbeequivalenttothecontrolsproposedinArticle27.However,Itisunnecessarytowait36monthsfortheresultsanditshouldbechangesto6months.Inaddition,weproposeinArticle47toalsocreateaprovisionalmappingmatrixfortheprovisionalcybersecuritycontrols,insteadofonlyalistofEuropeanandinternationalstandardstoprovideguidance.

.Thetimelineincoherencebetweentwointerdependentrequirementsshouldberectified.Thefirstrequirementisfornationalentitiestocreatealistofnationallegislationforcybersecuritypurposes.ThesecondrequirementisforENTSO-EandEUDSOtodevelopaprovisionallistofEuropeanandinternationalstandardsandcontrolsneededfornationallegislation.Thesecondrequirementhasashorterdeadline,eventhoughitissecondarytothefirstrequirement.

Informationsharing:

.Article37(3)statesthat“Eachcritical-impactandhigh-impactentityshallsharerelevantinformationrelatedtoareportablecybersecurityincidentwithitsCSIRTanditscompetentauthority...”,whichstipulatesdoublereporting.CommunicationbetweenCSIRTsandnationalauthoritiesshouldbecoordinated,butthereportingatentitylevelshouldbeconcentratedinonecommonmechanismorreportingplatform.

.Article37(8)alsostipulatesthatthenotificationofasignificantincidentwithinthescopeofNIS2Directive“shallconstitutereportingofinformationunderparagraph3ofthisArticle.”,whichcontributestotheargumentthattheexistingreportinglinesshouldbeconsideredandavoidduplicationinthereportingprocess.

.ThereferencestotheNIS2Directiveareproblematicsincethedirectivehasnotbeenimplementedyetinthememberstateswhichcouldcauseseveraloverlaps.Therefore,NCCSshouldstressnationalcompetentauthoritiesandCSIRTStostreamlinetheregulatoryframeworks.Additionally,Tomanagecontrol,andcomplywithnewcybersecurityrequirements,coordinationmusttakeplacebetweenboththeEUandthenationalauthoritiesbyrequirementssuchastheupcomingNIS-2andCERDirectives,aswellasthisnewregulatoryframework.Wefeardoubleregulationandmorebureaucracy.

Cybersecurityriskassessmentmethodologies:

.InArticle17(2)thereisanobligationtoincludethreatscenarioslinkedtoattacksonthesupplychainintheriskmethodologyatUnionlevel.Perhapsothertypeofthreat,potentiallymoreserious,shouldalsobehighlighted.

2

.Therearenoreferencestointernationalstandardsintheareaofriskmanagement(e.g.ISO27005,ISO31000,NISTCSF,ENISArequirements).Itwouldbeusefultomakeitclearwhichguidelines,intermsofestablishedgoodpractices,youhavebasedyourriskmanagementproposalson.

Scope:

.ThereisanincoherencebetweentheArticle31(2)and25(3.a)andthereferralto“otherprocesses”isquitegenericandshouldbeeliminated.Entitiesshouldclearlyunderstandwhattheminimumscopeoftheircybersecuritymanagementsystemshallincludeandreferencestootherarticlesshouldbelimited.Moreover,thescopedependsonfurtherworkdeterminingthethresholds.

3

Consultationresponse

EurelectricwelcomestheongoingeffortstoenhancecybersecurityandappreciatesthisopportunitytorespondtothedelegatedregulationoftheEuropeanCommission.

Implementationtimescales:

.ForallentitiesinscopeofthenetworkcodeitwouldbeveryusefultoknowwhichcontrolsinEuropeanandinternationalstandardswouldbeequivalenttothecontrolsproposedinarticle27.Wethereforewelcomearticle33thatcreatesamappingmatrixtoprovidethisinformation.However,itcomesonlywithin36monthsafterthenotificationofthehigh-andcritical-impactentities.Itisunnecessarytowaitthreeyearsfortheresultsofanexercisethatcouldbecompletedin6months.Therefore,wewouldproposetwochanges:inarticle33wewouldproposetobringthe36monthstocreatethemappingmatrixbackto6months.Inaddition,tohelpentitiesevenmore,wewouldproposeinarticle47toalsocreateaprovisionalmappingmatrixfortheprovisionalcybersecuritycontrols,insteadofonlyalistofEuropeanandinternationalstandardstoprovideguidance.

.Thereisatimelineincoherenceregardingtwointerdependentrequirements:therequirementimposeduponthenationalentitiestodevelopalistofrelevantnationallegislationforthepurposesofcybersecurityaspectsofcross-borderelectricityflows,andthesubsidiaryrequirementimposeduponENTSO-EandEUDSOentitytodevelopaprovisionallistofEuropeanandInternationalstandardsandcontrolsrequiredbynationallegislation.Thelatterissecondarytotheformerandyet,ithasashorterdeadline.Oncedesignated,thecompetentnationalentitiesaregiven6monthstoproducethelistofrelevantlegislation,whichmeans9monthsaftertheRegulationhasenteredintoforce.However,thesecondrequirementaccordingisexpectedtobefulfilled6monthsaftertheRegulationhasenteredintoforce,whichamountstoanincoherence.

Scope:

.ThereisanincoherencebetweentheArticle31(2)and25(3.a)andthereferralto“otherprocesses”isquitegenericandshouldbeeliminated.Entitiesshouldclearlyunderstandwhattheminimumscopeoftheircybersecuritymanagementsystemshallincludeandreferencestootherarticlesshouldbelimited.

.Itwouldbemoreappropriatetoexplainthedefinitionsproperlyinsteadofgivingreferencestoalotofdifferentarticles.Moreover,thescopedependsonfurtherworkdeterminingthethresholds.

Informationsharing:

.AccordingArticle37(5),entitiesarenotobligedtoreportunpatchedactivelyexploitedvulnerabilities,which,bydefinition,alreadyconstitutecyber-attacks.Wenotonlydisagreewiththisvoluntary/non-mandatoryrequirement,butevenwiththisreactiveapproach.Cybersecuritydemandsamoreproactiveapproach,andthereforewesuggestthatanyunpatched0-dayvulnerabilitymustbeimmediatelyreported,evenbeforebeingexploited,toensuretheyaretimelyaddressed,avoidingexploitationofsaidvulnerabilitiesandtheconsequentoccurrenceofcyber-attacks.

.Article37(3)statesthat“Eachcritical-impactandhigh-impactentityshallsharerelevantinformationrelatedtoareportablecybersecurityincidentwithitsCSIRTanditscompetentauthority...”,whichstipulatesdoublereporting.CommunicationbetweenCSIRTsandnationalauthoritiesshouldbecoordinatedandstipulatedwithintheproposednetwork

4

code,butthereportingatentitylevelshouldbeconcentratedinonecommonmechanismorreportingplatform.

.Tomanagecontrol,andcomplywithnewcybersecurityrequirements,coordinationmusttakeplacebetweenboththeEUandthenationalauthoritiesbyrequirementssuchastheupcomingNIS-2andCERDirectives,aswellasthisnewregulatoryframework.Article37(8)alsostipulatesthatthenotificationofasignificantincidentwithinthescopeofNIS2Directive“shallconstitutereportingofinformationunderparagraph3ofthisArticle.”,whichcontributestotheargumentthattheexistingreportinglinesshouldbetakenintoaccountandavoidduplicationinthereportingprocess.Intheregulations,itisstatedthat“thegeneralrulesonthesecurityofnetworkandinformationsystemslaiddowninDirective(EU)2022/255511(NIS2Directive)arecomplementedbythenetworkcode.”NIS2hasnotbeenimplementedyetintheEUmemberstates.Thismayleadtoseveraloverlaps,andthisshouldbeconsideredintheimplementations.Therefore,NCCSshouldstressnationalcompetentauthoritiesandCSIRTstostreamlinetheregulatoryframeworks.

.Afinalremarkregardingbothofthesearticlesistheincoherencebetweenthereportingdeadlines–itisunclearhowthereportingofanentityunderNIS2DirectivecanconstituteareportingofinformationunderArticle37(3),ifArticle23(4.a)oftheNIS2Directivestipulatesa24-hourinitialreportdeadlinewhereasArticle37(3)oftheNCCSstipulatesa4-hourinitialreportdeadline.IftheNCCSintendstobemoredemandingthantheNIS2Directive,duetothecriticalityoftheelectricitysector,Article37(8)shouldincludethecaveatoftheNCCSmoredemandingdeadline.

.EurelectricalsosuggeststoprovideguidanceonInformationSharingproceduresregardingCyberThreats(whatkindofinformationaboutCyberThreats,whenismandatorynotify,howtonotify,etc.).

Cybersecurityriskassessmentmethodologies:

.InArticle17(2)thereisanobligationtoincludethreatscenarioslinkedtoattacksonthesupplychainintheriskmethodologyatUnionlevel.Perhapsothertypeofthreat,potentiallymoreserious,shouldalsobehighlighted.

.Therearenoreferencestointernationalstandardsintheareaofriskmanagement(e.g.ISO27005,ISO31000,NISTCSF,ENISArequirements).Itwouldbeusefultomakeitclearwhichguidelines,intermsofestablishedgoodpractices,youhavebasedyourriskmanagementproposalson.

.Itisnotveryclearwhattherolesandresponsibilitiesofthedifferententitiesinvolvedintheriskassessmentwere,includingtheoperators,theentitiesinvolvedintheriskassessmentandtheentitiesinvolvedintheriskassessment.

.Article17isveryimportantandthedevelopmentandimplementationofamethodologyforriskassessment.DefiningtheElectricityCybersecurityRiskIndex(ECRI)forhigh-impactandcritical-impactthresholdsiscrucial.AswellasdefiningalistofUnion-widehigh-impactandcritical-impactprocesses.Weareconcernedaboutthefulfillmentofrequirementsoftimelineshere,asthisworkmusthaveatoppriorityinordernottoplaceuncertaindemandsontheentities.

.Amethodforcybersecurityriskassessmentsmustbedevelopedbasedonclearinputvaluesandriskanalysisscenariostopromoteanappropriatelevelofanalysis.Thedemand

5

forincreasedresiliencehasshiftedtoarisk-basedapproachthatallowsresiliencetobeadjustedbasedontheactualriskprofile.Differentdevicesfacedifferentthreats,requiringtailoredlevelsofprotectiontopreventeitherover-orunder-protectionofcriticalsystems.Therefore,weseeadvantagesinthisadaptabilitytoconsidermethodologiesatdifferentlevelsdependingonthedegreeofimpactofcross-borderelectricityflows.

.Atthecurrentversion,theNetworkCodeisnotfullyharmonizedwiththeframeworkofEUandnationalregulationsinthefieldofCyberRiskmanagementontheelectricitysector.Toprovidesomeconcreteexamples,thereareNetworkCodemeasuresforentities,suchas(i)thoserelatedtotheimplementationoftheCyberRiskManagementprogram(art.33),(ii)ofminimumandadvancedmeasures(art.28),(iii)ofmeasuresonthesupplychain(art.32)and(iv)thedevelopmentofacybersecuritymanagementsystem(art.31)whichsignificantlyoverlapwithEU(NIS2.0inparticular)andNationalRegulations.TheriskistogeneratedifferentapproachestomitigatesimilarCyberRisksbycreatinganoverloadofcompliancetomanageforinvolvedentities,primarilyDSOandTSO.

Recoveryofcosts:

.WewelcometherecognitionthatthecostsincurredbyDSOswhichstemfromtheobligationsintheNCCSshouldbefullyrecoveredthroughnetworktariffsorotherappropriatemechanisms.

CommonApproach:

.InRecital18,asneighbourcountriesevolveatdifferentratesintheuseofcybersecurityrisksassessmentsystems,amentiontotheBenchmarking(Article13)shouldappearhere,settingareferenceforcomparisonandsystemsevolvementovertime.

Monitoring:

.Recital23ismissingthereferencetoforensicanalysisthatcanimprovethepreparednessofothergridoperatorsregardingsamecontextawareness.

Cooperationbetweenrelevantauthoritiesandbodiesatnationallevel:

.ConcerningArticle5,PublicandprivateR&Dentities,withexpertisein(cyber)securitysubject,shouldbeinvitedtoparticipateasobservers,helpingindebriefingsessionsandfurthergettinginsightsfortheirresearchandinnovationwork/activities.

Specificcomments

Legalelementsofthedelegatedact

Intheregulations,itisstatedthat“thegeneralrulesonthesecurityofnetworkandinformationsystemslaiddowninDirective(EU)2022/255511(NIS2Directive)arecomplementedbythenetworkcode.”NIS2hasnotbeenimplementedyetintheEU.Therefore,itishardtofollowandverifythereferralstoNIS2.Furthermore,inmanycountries,theprocessofnationalimplementationisongoingandmaypresentstricterimplementationsthanintheDirective.Thismayleadtoseveraloverlaps,andthisshouldbeconsideredintheimplementations.Therefore,NCCSshouldstressnationalcompetentauthoritiesandCSIRTStostreamlinetheregulatoryframeworks.Duetoredundancyandinsufficientdifferentiationfromongoinglegislativeprojects,e.g.theNIS2Directiveimplementation,thereisalsoaconsiderableriskofdoubleregulationandconsequently,bureaucraticoverburdening.

ThecycleforupdatingNIS2andCERDirectiveis4years,thereforethistimehorizonpreferablybeusedinNCCS.

Article38Detectionofcybersecurityincidentsandhandlingofrelatedinformation

6

Multinationalelectricitygridentitiesshouldnothavetoreporttoseveralnationalauthorities,andCSIRTs,toavoidduplicationsofobligationsastheproposaloverlapswithseveralexistingregulations.

Ascyberthreatsbecamemoresophisticatedandwidespreadmultinationaldistributionsystemoperators(DSOs)facedasignificantchallenge.Itisextremelyimportanttoensuremethodology,butaboveallthefeasibilityofreportingaswellasfollow-upandreport