The European Union (EU) has a high level of energy security, enabled by oil and gas reserve stocks,
and one of the most reliable electricity grids in the world. However, a number of established and
emerging trends pose new challenges to the security of energy supply, notably in the electricity
sector. The production, distribution and use of energy is becoming increasingly digitalised and
automated, a trend which will further increase with the transformation towards a distributed
carbon-neutral energy system and the growth of the 'internet of things', which means that more
and more networked devices will be connected to the electricity grid. This provides increased
opportunities for malicious actors to carry out attacks on the energy system, notably cyber-attacks,
possibly in combination with physical damage and social engineering. It also increases the risk of
inadvertent disruption. Hackers are becoming increasingly capable, and are already probing and
exploiting vulnerabilities in the energy system, as a number of incidents outside the EU have
demonstrated.
The 2008 Directive on European critical infrastructures has been the basis of the EU approach. The
EU has recently reinforced its approach to cybersecurity, through legislation, standards and
reinforcement of the European Agency for Network and Information Security, which will take on
new coordinating and operational roles in cybersecurity. A recent European Commission
communication on cybersecurity in the energy system provides guidance, and binding rules for
energy system operators are under development in the form of a new network code on
cybersecurity.
The April 2019 European Commission recommendation underlines that the cybersecurity of the
energy system, and notably the electricity grid, needs a dedicated sectoral approach because of realtime requirements, a mix of advanced and legacy technologies, and the cascading effects of
disruptions. Experts see a growing need for improved exchange of knowledge and information,
standardisation and certification, development of cybersecurity skills, and regulation.