Spain’s National Commission on Markets and Competition (CNMC) has approved two European methodologies for assessing cybersecurity risks and classifying cyberattacks in the electricity system, under the European network code on cybersecurity for cross-border electricity flows.

The methodologies establish common criteria for identifying, analyzing and assessing cybersecurity risks, as well as determining the severity and impact of incidents. They were developed under Commission Delegated Regulation (EU) 2024/1366 of March 11, 2024, which establishes cybersecurity rules for cross-border electricity flows.

The risk assessment methodology will serve as the basis for cybersecurity assessments at national, regional and EU levels. The assessments will identify existing threats and evaluate their potential impact on the operational security of the electricity system and cross-border electricity exchanges.

The methodology will also establish indicators and thresholds to identify entities that could have a high or critical impact on the electricity system in the event of a cybersecurity incident. These could include system and market operators, transmission system operators, distribution companies, electricity producers, suppliers and aggregators.

Competent authorities will designate entities classified as having a high or critical impact, which will be subject to specific cybersecurity obligations based on their classification.

The second methodology establishes a common framework for classifying cyberattacks according to their severity and impact, and determining which incidents must be reported. It aims to facilitate information sharing and coordination among operators and national authorities.

The harmonized classification is particularly relevant for incidents with potential cross-border impacts, allowing common criteria to be applied to their detection, reporting and management.

Source link