f97.beERIK SCHMIDT’S WORKSHOP
← All terms

Glossary · Energy industry & energy transition

Cybersecurity

Cybersecurity IT security OT security critical infrastructure NIS2 resilience power system control technology

Cybersecurity refers to the protection of digital systems, data, networks, communication channels and control functions against unauthorised access, manipulation, disruption and failure. In the power system, this involves far more than office computers or corporate data. It also covers control technology, telecontrol technology, grid protection devices, metering systems, inverters, storage controllers, charging infrastructure, trading platforms, cloud services, remote maintenance access and the IT of operators of critical infrastructure.

The technical particularity of the power system is that digital processes can have physical consequences. A changed setpoint, blocked remote access, a manipulated measurement or a communication failure can affect real installations. In the energy sector, cybersecurity is therefore more than information security. It is also a prerequisite for secure grid operation, reliable market processes and orderly restoration after disruptions.

Protection goals: availability, integrity, confidentiality

The classic protection goals are availability, integrity and confidentiality. Availability means that systems and data can be used when they are needed. Integrity means that data, programs and control commands remain unaltered and traceable. Confidentiality means that only authorised persons and systems can access information. The Bundesnetzagentur (Federal Network Agency) also names these three goals as the purpose of its forthcoming IT security catalogue for the electricity and gas sector. In many areas of business, confidentiality is the priority. In the power system, by contrast, availability often weighs more heavily, because control, protection and communication systems must function during ongoing operation. Integrity is just as critical: a measured value that is available but manipulated can be more dangerous than a clearly recognisable failure, because personnel and automatic systems trust it.

Distinctions: IT, OT and data protection

Cybersecurity is often equated with IT security. In doing so, the differences between IT and OT are overlooked. IT stands for information technology systems such as servers, workstations, databases, e-mail, billing and enterprise software. OT stands for operational technology, i.e. systems that monitor and control physical processes. These include control systems, programmable logic controllers, protection devices, sensors, actuators and telecontrol systems. Different priorities apply in OT than in office IT. An update cannot simply be installed during operation if restarting the controller can take a plant off the grid. A security mechanism must not delay a protection function. A firewall rule that would merely be annoying in an office can become operationally relevant in a substation. Long service lives are added to this: field devices often remain in use for many years, longer than manufacturers supply security updates for standard software.

Data protection must also be distinguished from cybersecurity. Data protection safeguards personal data and ensures its lawful processing. Cybersecurity protects systems and information against technical and organisational attacks or disruptions. The two areas overlap, for example in the case of smart meter data, customer portals or charging contracts, but pursue different goals. A system can be designed in compliance with data protection law and still be poorly protected against attacks. Conversely, a heavily secured system can process personal data in ways that are problematic under data protection law.

Relationship to security of supply

In the power system, cybersecurity is closely linked to security of supply, but they are not the same. Security of supply describes the ability to provide electricity reliably. Cybersecurity protects the digital prerequisites for this. A cyberattack does not automatically lead to a large-scale power outage. Many installations have local protection functions, redundant communication paths or manual operating procedures. A successful attack can nevertheless make operational management more difficult, interrupt market processes, prolong restoration or trigger coordinated erroneous control actions. The consequences depend on which systems are affected, which fallback procedures exist and how well operators, service providers and authorities cooperate. At EU level, the network code on cybersecurity expressly assumes that a cyberattack can cause an electricity supply crisis, contribute to one or coincide with one.

Digitalisation and decentralised installations

With the digitalisation of the energy system, the concept is becoming more important. In the past, the power system was largely organised centrally: a few large power plants, hierarchical grids and comparatively few controllable installations. Today, millions of decentralised installations and devices with digital interfaces are being added. Photovoltaic systems, battery storage, heat pumps, wallboxes, flexible industrial plants and smart metering systems are to be measured, forecast, controlled or integrated into the market. This interconnection opens up new possibilities for flexibility. At the same time, it makes the system more dependent on software, data quality and secure communication.

With electrification, these dependencies continue to grow. Heat pumps, electric vehicles, electrolysers, battery storage and flexible industrial loads are to respond more strongly to grid signals, prices or control commands. This controllability can help limit peak loads and better integrate renewable generation. However, it creates new attack surfaces when large groups of devices react in the same way or are managed centrally. A single compromised device is usually not a systemic problem. Many identically configured devices controlled via the same platform, by contrast, can become operationally relevant. An example: if an attacker switches tens of thousands of inverters or charging points off or on simultaneously via a shared manufacturer portal, many small outputs add up to a step change that grid operation must compensate for. What matters is therefore not only the output of the individual device, but simultaneity, repeatability and central controllability. The fact that German law has, since December 2025, also included aggregators and digital energy services in the energy-sector IT security supervision reflects this idea.

Typical misconceptions

First misconception: that cybersecurity is a technical specialist problem that can be solved with better firewalls, antivirus programs or encryption. Such measures are necessary but not sufficient. Attacks often exploit organisational weaknesses: overly broad access rights, missing logging, unclear responsibilities, outdated asset inventories, unsecured remote maintenance or poorly controlled service provider access. Such gaps rarely arise from negligence alone. They are often rooted in incentives: an operator minimises maintenance costs, suppliers have long update cycles, and regulatory requirements take effect only late.

Second misconception: the notion of a completely isolated system. Many energy installations were planned as largely isolated operational networks. In pure form, this separation exists less and less. Remote maintenance, data exports, cloud connections, central control centres, virtual power plants, direct marketing and smart meter gateways connect operational technology with other digital environments. Even segmented networks have transitions. In addition to individual devices, cybersecurity must therefore also consider communication paths, authorisation models and dependence on service providers.

Third misconception: the pursuit of absolute security. No complex digital system can be fully safeguarded against errors, misconfigurations and attacks. Cybersecurity therefore encompasses protection, detection, response and recovery. Protective measures are meant to make attacks more difficult. Intrusion detection systems are meant to make anomalies visible. Response processes are meant to prevent a local incident from turning into greater damage. Recovery means rebuilding systems from secured states, checking data stocks and continuing operation in a controlled manner. Here, cybersecurity touches on the concept of resilience: resilience does not mean that no disruptions occur. It denotes the ability to remain capable of action during a disruption and to return to normal operation in an orderly way.

Legal framework in the EU and in Germany (as of November 2026)

At European level, the NIS2 Directive (EU) 2022/2555 is the central framework. It obliges essential and important entities, including energy-sector undertakings, to take risk management measures under Article 21. These expressly include incident handling, business continuity and supply chain security. Article 20 places responsibility for these measures with the management bodies. Article 23 provides for a staged reporting procedure for significant incidents: an early warning without undue delay and in any event within 24 hours, a notification within 72 hours and, as a rule, a final report no later than one month after that notification.

For the electricity sector, Delegated Regulation (EU) 2024/1366 is added, a network code on cybersecurity aspects of cross-border electricity flows. It supplements NIS2 for the electricity sector and sets out common minimum requirements, risk assessments at Union, regional and entity level, as well as monitoring, reporting and crisis management. It applies primarily to entities whose processes have a significant or critical impact on cross-border electricity flows. It therefore does not apply across the board to small installations.

In Germany, NIS2 is implemented by the NIS-2 Implementation Act, which entered into force on 6 December 2025. It recast the BSI Act and transferred the previous energy-specific rules in Section 11(1a) to (1g) EnWG into the new Sections 5c to 5e EnWG. Under Section 5c EnWG, all operators of energy supply networks must ensure adequate protection against threats, regardless of size and voltage level. Operators of energy installations and providers of digital energy services are covered if they qualify as an essential or important entity under Section 28 BSIG and the installation is connected to an energy supply network. Whether a company is affected therefore depends on its role (network, installation, digital service) and its classification under the BSIG, not on installation capacity alone. The Bundesnetzagentur specifies the requirements in agreement with the BSI in an IT security catalogue. Until the new catalogue, oriented towards ISO/IEC 27001, is published, the previous catalogues for network operators (version 2015) and for operators of energy installations (version 2018) continue to apply to their previous addressees. Existing intrusion detection systems must continue to be operated. For aggregators that were previously subject to BSI supervision, the sector-specific security standard B3S Aggregatoren continues to apply. In addition, there are separate security requirements for intelligent metering systems under the Metering Point Operation Act (Messstellenbetriebsgesetz) as well as rules for critical infrastructure.

For operators, this means: cybersecurity is no longer a purely internal IT task but part of corporate governance. Management cannot simply delegate these risks to the IT department. Investments, personnel, procurement, the management of service providers and emergency organisation require strategic decisions.

Supply chain and service providers

The supply chain carries particular weight. Network operators, energy suppliers, direct marketers and installation operators use software, hardware and services from numerous providers. Security vulnerabilities can lie in components that the operator did not develop itself. Remote maintenance access, update servers, cloud platforms or identity services can become entry points. The task thus shifts from securing individual sites to managing dependencies. Contracts must contain security requirements, updates must be available and verifiable, and incidents at service providers must be able to be reported and handled. NIS2 expressly names supply chain security, including relationships with direct suppliers and service providers, as a mandatory component of risk management. Even a technically well-secured installation remains vulnerable if the associated service provider access is poorly controlled.

Economic aspect

Security measures cost money, tie up personnel and can slow down operational processes. Too little security, however, can become more expensive: through downtime, recovery, contractual penalties, reporting effort, loss of trust, replacement procurement or damage from erroneous control. Costs and benefits often arise in different places. An individual installation operator saves effort if it keeps remote access simple. If many similar installations are reachable via the same vulnerability, however, the risk can also affect network operators, aggregators, customers or other market participants. Cybersecurity is therefore also a question of cost distribution and binding minimum standards.

Market processes as a protected area

Market processes also fall within the protected area. Balancing group settlement, schedule notifications, redispatch communication, direct marketing and meter data transmission rely on digital data flows, that is, on market communication. Erroneous or delayed data can have financial consequences and distort operational decisions. An attack on market communication is not the same as an attack on control technology, but it can indirectly influence grid operation and procurement. The boundary between market and technology becomes practically relevant where economic signals are automatically translated into control commands for installations.

Conclusion

Cybersecurity is not a single measure and not a state that is achieved once and then maintained. It is a permanent capability: recognising digital dependencies, designing protective measures appropriately, noticing disruptions early, clarifying responsibilities and keeping operation manageable even during an attack or failure. In the power system, this is particularly demanding because software errors, organisational weaknesses and attacks need not stay in the digital realm. They can affect measured values, switching decisions, market processes and the availability of real infrastructure. Used precisely, the concept makes clear: an electrified and networked energy system needs digital security as an operating condition, not as a subsequent addition.

Sources

Related glossary entries

Edited by eCMS on 11.11.2026 18:25

© 2026 Erik Schmidt. All rights reserved. Quotations with a link to the source are welcome.