Data security in the power system · Glossary

Definition and scope

Data security in the power system refers to the protection of data, communication paths and digital control processes against unauthorised access, manipulation, loss, incorrect processing or failure. It does not mean only office IT with its billing systems. The term also covers control technology, telecontrol technology, protection technology, smart meter gateways and market communication. Grid operation, power plants, storage, charging infrastructure and decentralised generation plants are equally affected. As soon as measured values, switching commands, schedules or grid state data are digitally recorded, transmitted or processed, a security-relevant data relationship arises.

The classic protection goals are confidentiality, integrity and availability. German regulations often add authenticity, that is, the assurance that data or commands really originate from the stated source. Confidentiality means that only authorised parties can view information. Integrity means that data remain complete, unaltered and traceable. Availability means that data, systems and communication paths can be used when they are needed. In the power system, a stolen password, a falsified measured value or a failed communication channel is therefore more than an IT problem. It can result in incorrect switching actions, undetected grid congestion, faulty balancing or delayed fault management.

Data security must be distinguished from data protection. Data protection safeguards personal data and the rights of the people concerned. Data security protects data and systems regardless of whether the data relate to individuals. A household's load profile is relevant under data protection law because it allows conclusions about the behaviour of the residents. A measured value from a substation, by contrast, hardly matters for data protection, but it can be very important for safe grid operation. The two areas overlap but pursue different purposes.

IT security and cyber security also do not mean exactly the same as data security. IT security protects all information technology, that is, hardware, software, networks, identities and operating environments. Cyber security focuses mainly on attacks via digital networking. Data security relates more narrowly to the data themselves, their processing and their communication paths. In the power system these areas cannot be cleanly separated in practice, because data, devices and processes are closely interlinked. The distinction is still useful: a secure server room does not by itself guarantee unfalsified grid state data. An encrypted connection does not replace proper management of access rights.

Information technology meets operational technology

What is special about the power system is the combination of information technology and operational technology, often called Operational Technology (OT). Operational technology monitors and controls physical processes in switchgear, transformers, power plant controls, protection devices and control systems. Many of these systems run for decades, use manufacturer-specific protocols and must react very quickly. A software update that is routine in the office may be installed in a control room only during coordinated maintenance windows. An unplanned outage there would create operational risks.

In grid operation, data integrity is of immediate importance. Grid operators make decisions on the basis of measured values for voltage, current, frequency, switching states and plant availability. If these data are falsified, delayed or incomplete, grid control misjudges the actual state of the grid. This no longer concerns only the transmission grids. In the distribution grids too, photovoltaic systems, heat pumps, battery storage and charging points change the load flows. The more decentralised the system becomes, the more reliable state data are needed. Without data security, digitalisation itself becomes a source of new uncertainty.

Availability, too, must be assessed differently in the power system than for many online services. If a web service is down for a few minutes, there is usually no physical damage. If, however, control technology, protection technology or important market communication fail, operations may be delayed, a disturbance may last longer, or fallback processes may have to be used. Not every communication failure immediately endangers security of supply, because power grids have protection mechanisms, redundancies and manual procedures. However, digital systems are increasingly needed to observe the grid state, coordinate actors and react quickly. The more grid control, congestion management and decentralised control rely on data, the more valuable robust communication and processing chains become.

Typical risks and misconceptions

A common error is to reduce data security to hacker attacks on large power plants. Such attacks are possible and must be taken seriously, but they make up only part of the risk. Disruptions can equally arise from:

faulty software or poorly tested data formats,
incorrectly configured interfaces and insecure remote maintenance access,
compromised service providers or supply chains,
overly broad role and access rights.

Many risks arise at the transitions between parties: between grid operator and metering point operator, between plant operator and direct marketer, between control room and telecontrol technology, and between market communication and physical operating processes. As a rule of thumb: the more actors exchange data and exercise control rights, the more important clear responsibilities, protocols, checks and liability rules become.

Data security also does not mean complete isolation. In the past, many control systems were hardly networked. This gave rise to the notion that a power system is secure as long as it remains separate from public networks. That fits only to a limited extent a system with decentralised plants, direct marketing, redispatch processes, smart metering systems, communication platforms and external service providers. Isolation can be one building block. But it does not replace dividing networks into separate zones (segmentation), verifying identities (authentication), logging, security updates, emergency drills and clear access concepts. Many vulnerabilities arise not from networking as such, but from uncontrolled networking.

Another misconception is that more data automatically lead to better operation. Additional measuring points can indeed show what is happening in the grid. At the same time, however, the requirements for data quality, plausibility checks and processing increase. Unchecked volumes of data can overload control rooms, faulty algorithms can set wrong priorities, and automated control with poor input data can increase damage. Data security therefore also includes the question of whether data sources are reliable, whether commands remain traceable and whether people remain able to act in the event of a disturbance. Carefully prepared incident response, that is, the planned reaction to security incidents, is an important prerequisite for this.

Example: smart meter gateway

The smart meter gateway shows the connection particularly clearly. It is the communication unit of the smart metering system and mediates measurement data, control commands and further applications in a controlled manner. In Germany, the BSI sets the security requirements in a Common Criteria protection profile (BSI-CC-PP-0073) and the requirements for the function and interworking of the devices in the Technical Guideline BSI TR-03109. A dedicated security module serves as protected storage for cryptographic keys. In addition there is a dedicated infrastructure for digital certificates (Smart Metering PKI) and requirements for operation by the gateway administrator. For the power system, it is not only billing that counts. What is also decisive is whether controllable consumption devices such as heat pumps and charging points, feed-in plants or storage can be controlled reliably and securely. Data security helps decide here whether flexibility can actually be used or exists only on paper.

Legal framework in Germany and the EU

In Germany there are separate rules for the energy sector. Under section 11(1a) of the Energy Industry Act (Energiewirtschaftsgesetz, EnWG), the safe operation of an energy supply network includes adequate protection of the telecommunications and data processing systems that are necessary for grid operation. In consultation with the BSI, the Federal Network Agency (Bundesnetzagentur) has published an IT security catalogue for electricity and gas network operators, the first version in August 2015. It applies as a minimum standard and essentially requires a certified information security management system. For certain energy installations there is a separate catalogue under section 11(1b) EnWG. The Bundesnetzagentur has initiated a procedure to revise both catalogues in a joint determination. This is to cover installations for networks and for plants.

The BSI Act (BSIG) also applies. It was recast by the NIS-2 Implementation Act, which entered into force on 6 December 2025. The Act now speaks of particularly important and important entities and of operators of critical installations instead of critical infrastructures. Operators of critical installations always count as particularly important entities. They must register, report significant security incidents and implement risk management measures that go beyond the general level in their critical area. They must now demonstrate implementation to the BSI every three years instead of every two as before. For energy installations, the Bundesnetzagentur partly assumes supervision, for example for installations for controlling or pooling electrical capacity. Which obligations apply in an individual case depends on the type of installation, thresholds and company size.

At EU level, Delegated Regulation (EU) 2024/1366 supplements the NIS 2 Directive for the electricity sector. It contains a network code on cybersecurity aspects of cross-border electricity flows with common minimum requirements and rules on risk assessment, monitoring, reporting and crisis management. The obligations mainly affect entities whose processes have significant or critical effects on cross-border electricity flows.

Costs, governance and shared responsibility

The costs of data security are easily underestimated. Secure systems need certifications, tests, redundant infrastructure, trained staff, monitoring, emergency organisation, supplier checks and ongoing maintenance. These costs arise not just once during set-up but over many years of operation. In regulated grids, the question is which security measures are recognised, financed and audited. For market actors, the issue is which obligations are reasonable and how to prevent one weak link in a data chain from endangering others.

The power system is characterised by shared responsibility. Transmission system operators and distribution system operators, metering point operators, suppliers, direct marketers, balance responsible parties, plant operators, manufacturers and IT service providers have different tasks. Technical products alone therefore do not create data security. Binding processes, coordinated interfaces and verifiable roles are needed. A certificate for a single device says little about whether the entire process chain is secure. An encrypted channel does not protect against wrong authorisations. And a secure control room does not automatically prevent an external service provider with overly extensive remote access from creating a risk. Data security is therefore also a question of governance: who may see data, who may control, who must report incidents, who checks minimum standards and who bears the costs of an outage?

Significance and limits of the term

In political debates, the digitalisation of the power system is often described as a purely functional modernisation. Digital measurement, automated control and networked flexibility are meant to limit grid expansion, integrate renewable generation and involve consumers better. These goals depend on secure data relationships. If data security is neglected, new attack surfaces and dependencies arise. If it is regarded only as an obstacle, useful digital functions are needlessly delayed. At its core, the point is an appropriate security architecture for the respective process, not a blanket yes or no to networking.

Data security is thus not an add-on at the margins of the energy sector but a prerequisite for operating a more decentralised, more digital and more flexible power system. The term shows that measured values, control commands and communication rights are now part of the technical infrastructure. By itself, however, it does not explain how stable a grid is or how secure supply remains overall. For that, grid planning, equipment, protection concepts, market rules, personnel, fallback processes and physical resilience must also be considered.

Sources

Kritische Infrastrukturen (KRITIS) – Änderungen für KRITIS-Betreiber im neuen BSI-Gesetz — Bundesamt für Sicherheit in der Informationstechnik (BSI); 2026-06-24 (letzte Aktualisierung). Abschnitte Gesetzliche Pflichten, Änderungen durch das NIS-2-Umsetzungsgesetz, Pflichten für Betreiber kritischer Anlagen, Sektorspezifische Änderungen Energie
IT-Sicherheitskatalog gemäß § 11 Absatz 1a Energiewirtschaftsgesetz — Bundesnetzagentur; 2015-08. Abschnitte B bis E
Festlegung – Erstellung eines IT-Sicherheitskatalogs nach § 11 Abs. 1a und 1b EnWG — Bundesnetzagentur; unbekannt (Konsultation 2025). Verfahrenseinleitung und Konsultationen
Delegierte Verordnung (EU) 2024/1366 – Netzkodex mit sektorspezifischen Vorschriften für Cybersicherheitsaspekte grenzüberschreitender Stromflüsse — Europäische Kommission / EUR-Lex; 2024-03-11 (Amtsblatt 2024-05-24). Erwägungsgründe 5 und 8, Artikel 1
BSI-TR-03109 – Dachdokument Technische Richtlinie, Version 2.0.1 — Bundesamt für Sicherheit in der Informationstechnik (BSI); unbekannt. Abschnitte zu TR-03109-1 und TR-03109-2

Related glossary entries

Edited by eCMS on 11.11.2026 18:32