The ninth European Cybersecurity Energy Forum brought together energy and cybersecurity stakeholders to examine how Europe’s increasingly distributed electricity networks can remain resilient during and after cyber incidents. The forum was held under the theme “Holding together in a changing world: Grid Cyber Resilience and Preparedness”. Digital Watch reported on the event.
The event was jointly organized by the Association of European Distribution System Operators (E.DSO), the European Energy Information Sharing & Analysis Centre (EE-ISAC), the European Network for Cyber Security (ENCS) and the European Union Agency for Cybersecurity (ENISA). The program addressed practical solutions, cooperation across the energy ecosystem and the relationship between regulation and innovation.
Europe’s electricity system is moving beyond a model based primarily on centralized generation. Distributed energy resources, demand response and flexibility services are becoming more prominent. Their operation depends on smart technologies, connected devices, digital management platforms and communications networks that link more participants to grid functions.
That structure broadens the cybersecurity challenge. Risk is distributed across utilities, technology providers, connected products, software, telecommunications and other third parties. Operational technology and information technology may also be connected across systems that were developed at different times and under different security assumptions. A weakness in one component may therefore affect other services or organizations, depending on the system’s connections and operating role.
The European Commission’s energy cybersecurity information identifies several characteristics that shape the sector’s risk profile. Electricity systems often require real-time responses, disruptions can have cascading effects across borders, and legacy infrastructure must operate alongside newer digital technologies. The Commission also notes that digitalization can improve energy services while increasing exposure to cyberattacks and cybersecurity incidents.
The EU Network Code on Cybersecurity establishes sector-specific rules for cybersecurity aspects of cross-border electricity flows. The framework covers common minimum requirements, planning, monitoring, reporting and crisis management. It also provides for recurring cybersecurity risk assessments and identifies responsibilities for high-impact and critical-impact entities, national authorities and other participants in the electricity system.
The NIS2 Directive separately places energy among the sectors subject to cybersecurity risk-management and incident-reporting obligations. These requirements apply within a wider EU framework that also addresses the resilience of critical entities. For organizations operating across borders, the resulting compliance picture can involve EU-level rules, national implementation and sector-specific oversight.
The forum’s organizers said the changing grid model means cybersecurity cannot be managed by utilities acting alone. Their event description called for stronger cooperation, coordination and information sharing among stakeholders, including those involved in regulation, technology, operations and supply chains.
The forum did not announce a new EU cybersecurity law or a new compliance deadline. Its agenda instead focused on applying existing requirements to a changing electricity system and on converting broad resilience goals into operational practices. Areas under discussion included incident response, risk assessment, supply-chain security and the ability to maintain essential services during an attack.
Energy companies and suppliers will continue to monitor national implementation of EU cybersecurity rules, the work of competent authorities, sector risk assessments and the development of supply-chain controls.