Enhancing cyber resilience

Enhancing cyber resilience

Digitalisation offers many benefits for electricity systems and clean energy transitions. At the same time, the rapid growth of connected energy resources and devices is expanding the potential cyberattack surface, while increased connectivity and automation throughout the system is raising risks to cybersecurity.

The threat of cyberattacks on electricity systems is substantial and growing. Threat actors are becoming increasingly sophisticated at carrying out attacks. A successful cyberattack could trigger the loss of control over devices and processes, in turn causing physical damage and widespread service disruption.

While the full prevention of cyberattacks is not possible, electricity systems can become more cyber resilient – to withstand, adapt to and rapidly recover from incidents and attacks while preserving the continuity of critical infrastructure operations. Policy makers, regulators, utilities and equipment providers must play key roles to ensure cyber resilience of the entire electricity value chain.

Governments around the world can enhance cyber resilience through a range of policy and regulatory approaches, ranging from highly prescriptive approaches to framework-oriented, performance-based approaches. Approaches that are more prescriptive have the advantage of allowing for more streamlined compliance monitoring, but they could face challenges in keeping pace with evolving cyber risks. Less prescriptive, framework-based approaches allow for different approaches and implementation speeds across jurisdictions, but they raise questions around how to establish a coherent and robust cross-country approach to cybersecurity with tangible and effective impact. Implementation strategies should be tailored to national contexts while considering the global nature of risks.

Framework for action

The three areas above require different security responses. The following overarching principles should be applicable: 1) Institutionalise: establish clear responsibilities, incentives and rules; 2) Identify risks: undertake regular system-wide risk analyses; 3) Manage and mitigate risk: improve preparedness across the electricity supply chain; 4) Monitor progress: keep track, record and share experiences ; and 5) Respond and recover: cope with outages or attacks and capture the lessons learned.  

Co-operation for secure energy transitions

Electricity security matters more than ever if we are to have successful clean energy transitions. In addition to identifying best practices and innovations already underway around the world, new and updated responses from governments and other stakeholders to ensure security, build off existing frameworks and develop methodologies will enable much needed changes to electricity systems.

Enhancing climate resilience

Many of us are facing similar challenges. Policy makers, regulators and operators can learn from the experience of other countries and regions. 

The IEA will be at the heart of such co‑operation.

The electricity system is witnessing increasing pressure from climate change. Rising global temperatures, more extreme and variable precipitation patterns, rising sea levels and more extreme weather events already pose a significant challenge to electricity security, increasing the likelihood of climate-driven disruption.

While there is a general recognition of these trends and associated risks, only 17 “IEA family” countries have incorporated concrete actions for climate resilience of electricity systems into their national adaptation strategies to date. Of those, only six cover the entire electricity value chain.

Enhancing the resilience of electricity systems to climate change brings multiple benefits. More resilient electricity systems reduce damage and loss from climate impacts and bring greater benefits than costs. Moreover, deployment of climate-resilient electricity systems helps developing countries address immediate threats from climate hazards and ensure reliable electricity access. Climate resilience also facilitates clean energy transitions, enabling more electrification solutions and accelerating the transition to renewable energy technologies, which are often sensitive to a changing climate.

Effective policy measures play a significant role in building climate resilience. The benefits of climate resilience and the costs of climate impacts tend to be distributed unevenly across the electricity value chain. This inevitably raises the question of who should be responsible for delivering resilience measures and paying for them. Policy measures for climate resilience can encourage businesses to adopt resilience measures, thus preventing a potential “market failure”.

A higher priority should be given to climate resilience in electricity security policies. In many countries, the level of commitment and progress towards climate resilience in the electricity sector still lags behind. Mainstreaming climate resilience in energy and climate policies can send a strong signal to the private sector, inspiring businesses to consider climate resilience in their planning and operation.