Operational Technology resilience in the 2023 draft delegated act on cybersecurity for the power sector—An EU policy process analysis

Abstract

The EU’s 2020 Cybersecurity Strategy promotes cybersecurity as essential for building a resilient, green, and digital Europe. Cleaner energy sources such as wind and solar are more volatile and thus need digital integration with Industrial Control Systems (ICS) for grid balancing. However, the digitization and the properties of cyberspace provide the ability to coordinate disruptive cyberattacks against power grid infrastructures. Digital weapons may be launched against ICS to start multiple cascading outages with a keystroke, causing large-scale blackouts we have never seen before. To reduce risk, the EU’s Strategy describes three objectives for ICS: Secure-by-design, resilient, and timely patched. In the strategy, the European Commission suggests a ”network code,” i.e. a delegated act for the electric power sector, setting rules for cybersecurity in cross-border electricity flows. The draft delegated act of November 2023 presents security requirements for Information and Communication Technology (ICT) and Network and Information Systems (NIS). Although ICS systems are used directly to manage electricity flows, ICS is only mentioned in one of the delegated act’s recitals as a subcategory of ICT products. Suppose Information Technology (IT) rather than Operational Technology (OT) is the focus of the delegated act. In that case, policymakers may not fulfill the EU cybersecurity strategy’s ICS objectives, thus failing to improve the resilience of power grid infrastructures and cross-border electricity flows. This study is a policy process analysis, and its contribution is threefold. First, a literature review is conducted to understand the extent to which the delegated act covers OT. Second, a framework condition analysis is applied to understand why the delegated act lacks OT-specific security requirements. Third, the analysis is extended to understand whether OT is sufficiently covered to achieve the EU strategy’s ICS objectives. In conclusion, our analysis shows a strong intention to include OT-specific security in the preparatory work of the delegated act, but that a stronger position of the IT communities forced OT onto the sideline. Further, the study shows weak fulfillment of general secure-by-design principles and security patch management. These results indicate that OT coverage in the delegated act is not in line with the expectations of the EU’s cybersecurity strategy and the delegated act’s early preparatory work. Therefore, we have suggested three measures to increase OT resilience focus in the act: (a) Define the expressions NIS, ICT services, ICT processes, and ICT in general as umbrella terms that include OT, (b) The foreseen minimum and advanced cybersecurity controls should require OT-specific measures, including holistic secure-by-design principles and patch management covering all patching phases, (c) Develop an OT implementation guide for the delegated act. Our work can be used by policymakers to optimize cybersecurity policy processes and by researchers studying socio-technical gaps in the cybersecurity domain.