Composition, functioning and review of the common electricity cybersecurity framework
1. The common electricity cybersecurity framework shall be composed of the following controls and cybersecurity management system:
(a)
the minimum cybersecurity controls, developed in accordance with Article 29;
(b)
the advanced cybersecurity controls, developed in accordance with Article 29;
(c)
the mapping matrix, developed in accordance with Article 34, that maps the controls referred to in points (a) and (b) against selected European and international standards and national legislative or regulatory frameworks;
(d)
the cybersecurity management system established pursuant to Article 32.
2. All high-impact entities shall apply the minimum cybersecurity controls pursuant to paragraph 1 point (a) within their high-impact perimeter.
3. All critical-impact entities shall apply the advanced cybersecurity controls pursuant to paragraph 1 point (b) within their critical-impact perimeter.
4. Within 7 months after submitting the first draft Union-wide cybersecurity risk assessment report pursuant to Article 19(4), the common electricity cybersecurity framework referred to in paragraph 1 shall be supplemented by the minimum and advanced cybersecurity controls in the supply chain developed pursuant to Article 33.
Minimum and advanced cybersecurity controls
1. Within 7 months after submitting the first draft Union-wide cybersecurity risk assessment report pursuant to Article 19(4), the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO Entity, shall develop a proposal for minimum and advanced cybersecurity controls.
2. Within 6 months after drawing up each regional cybersecurity risk assessment report pursuant to Article 21(2) the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO Entity, shall propose an amendment to the competent authority for the minimum and advanced cybersecurity controls. The proposal will be done in accordance with Article 8(10) and will take into account the risks identified in the regional risk assessment.
3. The minimum and advanced cybersecurity controls shall be verifiable by taking part in a national verification scheme in accordance with the procedure set out in Article 31 or by undergoing independent third-party security audits performed according to the requirements listed in Article 25(2).
4. The initial minimum and advanced cybersecurity controls developed pursuant to paragraph (1) shall be based on the risks that are identified in the Union-wide cybersecurity risk assessment report referred to in Article 19(5). The amended minimum and advanced cybersecurity controls developed pursuant to paragraph (2) shall be based on the regional cybersecurity risk assessment report referred to in Article 21(2).
5. The minimum cybersecurity controls shall include controls to protect the information exchanged pursuant to Article 46.
6. Within 12 months after the approval of the minimum and advanced cybersecurity controls pursuant to Article 8(5), or after each update pursuant to Article 8(10), the entities listed in Article 2(1) and identified as critical-impact and high-impact entities pursuant to Article 24 shall, during the establishment of the entity-level risk mitigation plan pursuant to Article 26(5), apply the minimum cybersecurity controls within the high-impact perimeter and advanced cybersecurity controls within the critical-impact perimeter.
Derogations from the minimum and advanced cybersecurity controls
1. The entities listed in Article 2(1) may request the respective competent authority to grant a derogation from their obligation to apply the minimum and advanced cybersecurity controls referred to in Article 29(6). The competent authority may grant such a derogation on one of the following grounds:
(a)
in exceptional circumstances, where the entity can demonstrate that the costs of implementing the appropriate cybersecurity controls significantly exceed the benefits. ACER and the ENTSO for Electricity in cooperation with the DSO entity may jointly develop a guidance for estimating the costs of cybersecurity controls to help the entities;
(b)
where the entity provides an entity-level risk treatment plan that mitigates the cybersecurity risks using alternative controls to a level that is acceptable in accordance with to the risk acceptance criteria referred to Article 26(3), point (b).
2. Within three months from the receipt of the request referred to in paragraph 1, each competent authority shall decide whether a derogation from the minimum and advanced cybersecurity controls is to be granted. Derogations from the minimum or advanced cybersecurity controls shall be granted for a maximum of three years, with the possibility of renewal.
3. Aggregated and anonymised information for the derogations granted shall be included as an annex to the comprehensive cross-border electricity cybersecurity risk assessment report referred to in Article 23. The ENTSO for Electricity and the EU DSO entity shall jointly update the list, where necessary.
Verification of the common electricity cybersecurity framework
1. No later than 24 months after the adoption of the controls referred to in points (a), (b) and (c) of Article 28(1) and the establishment of the cybersecurity management system referred to in point (d) of that Article, each critical-impact entity identified in accordance with Article 24(1) shall be able to demonstrate its compliance with the cybersecurity management system and the minimum or advanced cybersecurity controls at the request of the competent authority.
2. Each critical-impact entity shall fulfil the obligation referred to in paragraph 1 by undergoing independent third-party security audits in accordance with the requirements listed in Article 25(2) or by taking part in a national verification scheme in accordance with Article 25(1).
3. The verification that a critical-impact entity complies with the cybersecurity management system and the minimum or advanced cybersecurity controls shall cover all assets within the critical-impact perimeter of the critical-impact entity.
4. The verification that a critical-impact entity complies with the cybersecurity management system and the minimum or advanced cybersecurity controls shall be regularly repeated at the latest 36 months after the end of the first verification, and every 3 years thereafter.
5. Each critical-impact entity defined in accordance with Article 24 shall demonstrate its compliance with the controls referred to in points (a), (b) and (c) of Article 28(1) and the establishment of the cybersecurity management system referred to in point (d) of that Article by reporting on the outcome of the compliance verification to the competent authority.
Cybersecurity management system
1. Within 24 months after being notified by the competent authority that they have been identified as a high-impact or critical-impact entity in accordance with Article 24(6), each high-impact and critical-impact entity shall establish a cybersecurity management system, and review it every three years thereafter, to:
(a)
determine the scope of the cybersecurity management system considering interfaces and dependencies with other entities;
(b)
ensure that all its senior management is informed of relevant legal obligations and actively contributes to the implementation of the cybersecurity management system through timely decisions and prompt reactions;
(c)
ensure that the resources needed for the cybersecurity management system are available;
(d)
establish a cybersecurity policy that shall be documented and communicated within the entity and to parties affected by the security risks;
(e)
assign and communicate responsibilities for roles relevant to cybersecurity;
(f)
perform cybersecurity risk management at entity level as defined in Article 26;
(g)
determine and provide the resources required for the implementation, maintenance and continual improvement of the cybersecurity management system, taking into account the necessary competence and awareness of cybersecurity resources;
(h)
determine the internal and external communication that is relevant to cybersecurity;
(i)
create, update and control documented information related to the cybersecurity management system;
(j)
evaluate the performance and effectiveness of the cybersecurity management system;
(k)
conduct internal audits at planned intervals to ensure that the cybersecurity management system is effectively implemented and maintained;
(l)
review the implementation of the cybersecurity management system at planned intervals; and control and correct non-compliance of the resources and activities with the policies, procedures, guidelines in the cybersecurity management system.
2. The scope of the cybersecurity management system shall include all assets within the high-impact and critical-impact perimeter of the high-impact and critical-impact entity.
3. The competent authorities shall, without imposing or discriminating in favour of the use of a particular type of technology, encourage the use of European or international standards and specifications related to management systems and relevant to the security of network and information systems.
Minimum and advanced cybersecurity controls in the supply chain
1. Within 7 months after submitting the first draft Union-wide cybersecurity risk assessment report pursuant to Article 19(4), the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity, shall develop a proposal for minimum and advanced cybersecurity controls in the supply chain that mitigate the supply chain risks identified in the Union-wide cybersecurity risk assessments, supplementing the minimum and advanced cybersecurity controls developed pursuant to Article 29. The minimum and advanced cybersecurity controls in the supply chain shall be developed together with the minimum and advanced cybersecurity controls pursuant to Article 29. The minimum and advanced cybersecurity controls in the supply chain shall cover the entire lifecycle of all ICT products, ICT services and ICT processes inside the high-impact or critical-impact perimeters of a high-impact or critical-impact entity. The NIS Cooperation Group shall be consulted when developing the proposal for minimum and advanced cybersecurity controls in the supply chain.
2. The minimum cybersecurity controls in the supply chain shall consist of controls for high-impact and critical-impact entities that:
(a)
include recommendations for the procurement of ICT products, ICT services, and ICT processes referring to cybersecurity specifications, covering at least:
(i)
the background verification checks of the staff of the supplier involved in the supply chain and dealing with sensitive information or with access to the high-impact or critical-impact assets of the entity. Background verification check may include a verification of the identity and background of staff or contractors of an entity in accordance with national law and procedures and relevant and applicable Union law, including Regulation (EU) 2016/679 and Directive (EU) 2016/680 of the European Parliament and of the Council ( 18 ) . Background checks shall be proportionate and strictly limited to what is necessary. They shall be carried out for the sole purpose of evaluating a potential security risk to the entity concerned. They need to be proportional to business requirements, the classification of the information to be accessed and the perceived risks, and may be performed by the entity itself, by an external company performing a screening, or through a government clearing;
(ii)
the processes for secure and controlled design, development and production of ICT products, ICT services and ICT processes, promoting the design and development of ICT products, ICT services, and ICT processes, which include appropriate technical measures to ensure cybersecurity;
(iii)
design of network and information systems in which devices are not trusted even when they are within a secure perimeter, require verification of all requests they receive and apply the least privilege principle;
(iv)
the access of the supplier to the assets of the entity;
(v)
the contractual obligations on the supplier to protect and restrict access to the entity’s sensitive information;
(vi)
the underpinning cybersecurity procurement specifications to subcontractors of the supplier;
(vii)
the traceability of the application of the cybersecurity specifications from the development through production until delivery of ICT products, ICT services or ICT processes;
(viii)
the support for security updates throughout the entire lifetime of ICT products, ICT services or ICT processes;
(ix)
the right to audit cybersecurity in the design, development and production processes of the supplier; and
(x)
the assessment of the risk profile of the supplier;
(b)
require such entities to take into account the procurement recommendations referred to in subparagraph (a) when concluding contracts with suppliers, collaboration partners and other parties in the supply chain, covering ordinary deliveries of ICT products, ICT services and ICT processes as well as unsolicited events and circumstances like termination and transition of contracts in cases of negligence of the contractual partner;
(c)
require such entities to take into account the results of relevant coordinated security risk assessments of critical supply chains carried out in accordance with Article 22(1) of Directive (EU) 2022/2555;
(d)
include criteria to select and contract suppliers that can meet the cybersecurity specifications as stated in paragraph (a) and that possess a level of cybersecurity appropriate to the cybersecurity risks of the ICT product, ICT service, or ICT processes that the supplier delivers;
(e)
include criteria to diversify sources of supply for ICT products, ICT services and ICT processes and reduce the risk of a vendor lock-in;
(f)
include criteria to monitor, review or audit the cybersecurity specifications for supplier internal operational processes throughout the entire lifecycle of each ICT product, ICT service and ICT process on a regular basis.
3. For the cybersecurity specifications in the cybersecurity procurement recommendation referred to in paragraph 2, point (a), high-impact or critical-impact entities shall use the principles of procurement pursuant to Directive 2014/24/EU of the European Parliament and of the Council ( 19 ) , in accordance with Article 35(4), or define their own specifications based on the results of the cybersecurity risk assessment at entity level.
4. The advanced cybersecurity controls in the supply chain shall include controls for critical-impact entities to verify, during procurement, that ICT products, ICT services and ICT processes that will be used as critical-impact assets satisfy the cybersecurity specifications. The ICT product, ICT service or ICT process shall be verified either through a European cybersecurity certification scheme referred to in Article 31 or through verification activities selected and organised by the entity. The depth and coverage of the verification activities shall be sufficient to provide assurance that the ICT product, ICT service or ICT process can be used to mitigate the risks identified in the risk assessment at entity level. The critical-impact entity shall document the steps taken to reduce the risks identified.
5. The minimum and advanced cybersecurity controls in the supply chain shall apply to the procurement of relevant ICT product, ICT services and ICT processes. The minimum and advanced cybersecurity controls of the supply chain will apply to procurement processes in the entities identified as critical-impact and high-impact entities pursuant to Article 24 that starts six months after the adoption or update of the minimum and advanced cybersecurity controls referred to in Article 29.
6. Within 6 months after drawing up each regional cybersecurity risk assessment report pursuant to Article 21(2) the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO Entity, shall propose an amendment to the competent authority for the minimum and advanced cybersecurity controls in the supply chain. The proposal will be done in accordance with Article 8(10) and will take into account the risks identified in the regional risk assessment.
Mapping matrix for electricity cybersecurity controls against standards
1. Within 7 months after submitting the first draft Union-wide cybersecurity risk assessment report pursuant to Article 19(4), the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity and in consultation with ENISA, shall develop a proposal for a matrix to map the controls set out in Article 28(1), points (a) and (b) against selected European and international standards as well as relevant technical specifications (‘the mapping matrix’). The ENTSO for Electricity and the EU DSO entity shall document the equivalence of the different controls with the controls set out in Article 28(1), points (a) and (b).
2. The competent authorities may provide to the ENTSO for Electricity and the EU DSO entity a mapping of the controls set out in Article 28(1), points (a) and (b) with a reference to the related national legislative or regulatory frameworks, including relevant national standards of Member States pursuant to Article 25 of Directive (EU) 2022/2555. If the competent authority of a Member State provides such a mapping, the ENTSO for Electricity and the EU DSO entity shall integrate this national mapping into the mapping-matrix.
3. Within 6 months after drawing up each regional cybersecurity risk assessment report pursuant to Article 21(2), the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO Entity and in consultation with ENISA, shall propose an amendment to the competent authority for mapping matrix. The proposal will be done in accordance with Article 8(10) and will take into account the risks identified in the regional risk assessment.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
