Competition Law and Self-Regulating Market Ecosystems

Cybersecurity standards for digital energy systems are rules, practices and technical measures used to protect modern energy systems from cyberattacks. Today, electricity systems depend on computers, smart meters, digital substations, SCADA systems, cloud platforms and communication networks.

These systems make electricity supply more efficient, but they also create new risks. A hacker may steal energy data, change electricity information, damage control systems or interrupt electricity services. Therefore, cybersecurity is now an important part of energy law and energy regulation.

2. Meaning of Digital Energy Systems

Digital energy systems include:

smart meters;

smart grids;

SCADA systems;

digital substations;

battery-storage systems;

renewable-energy control systems;

electric-vehicle charging systems;

energy-management software; and

electricity-market platforms.

These systems collect and exchange large amounts of information. Cybersecurity standards aim to protect this information and the physical energy infrastructure controlled by it.

3. Main Objectives

Cybersecurity standards mainly protect three things:

Confidentiality

Only authorised people should see sensitive energy information.

Integrity

Energy data and control instructions should not be changed illegally.

Availability

Important energy systems should continue working when required.

There is also a fourth important objective:

Resilience

The system should be able to recover after a cyberattack.

Therefore, cybersecurity can be explained simply as:

Protect → Detect → Respond → Recover.

4. NIS Regulations

In the UK, the Network and Information Systems Regulations 2018 (NIS Regulations) provide an important cybersecurity framework for operators of essential services.

Energy operators covered by the regime must take appropriate and proportionate technical and organisational measures to manage cybersecurity risks.

This means that a large electricity operator facing serious cyber risks should have stronger security arrangements than an organisation with much lower risks.

The NIS approach is therefore based on risk and proportionality.

5. NIS2 Framework

In the European Union, the NIS2 Directive 2022/2555 provides an updated cybersecurity framework.

It covers important areas such as:

risk assessment;

incident management;

business continuity;

backup systems;

disaster recovery;

supply-chain security;

access control; and

secure communication.

Energy is an important sector under NIS2.

The purpose is to make energy organisations more prepared for serious cyber incidents.

6. ISO 27001

ISO/IEC 27001 is an international standard for information-security management.

It helps organisations create an Information Security Management System (ISMS).

It covers areas such as:

identifying risks;

controlling access;

protecting information;

managing incidents;

training employees;

managing suppliers; and

improving security continuously.

Energy companies can use ISO 27001 to organise their cybersecurity programme.

However, ISO certification by itself does not automatically prove compliance with every legal requirement.

7. IEC 62443

IEC 62443 is especially useful for industrial-control systems.

It is relevant to energy infrastructure because electricity generation, transmission and distribution often use industrial control technology.

The standard supports:

secure system design;

access control;

network protection;

security zones;

secure software;

vulnerability management; and

protection of industrial systems.

It is therefore useful for protecting SCADA and other operational technology.

8. NIST Cybersecurity Framework

The NIST Cybersecurity Framework provides a simple approach to cybersecurity.

Its main functions are:

Identify → Protect → Detect → Respond → Recover

For example:

Identify: find important energy systems and risks.

Protect: install security controls.

Detect: identify suspicious activity.

Respond: control the cyberattack.

Recover: restore normal operations.

This approach is useful for electricity companies because cybersecurity is a continuous process.

9. Smart Grid Security

Smart grids connect many devices, including:

smart meters;

solar systems;

batteries;

sensors;

electric vehicles; and

automated switches.

Each connected device may create a cybersecurity risk.

Therefore, smart-grid security should include:

strong passwords;

authentication;

encryption;

secure software updates;

access controls;

network monitoring; and

regular security testing.

A weakness in one device should not easily allow an attacker to enter the entire electricity system.

10. Access Control

Only authorised persons should access critical energy systems.

Important measures include:

multi-factor authentication;

strong passwords;

role-based access;

limited administrator access;

secure remote access; and

access logs.

For example, an employee who only needs billing information should not automatically receive access to a power-station control system.

This is called the least-privilege principle.

11. Network Segmentation

Network segmentation means separating different parts of an energy system.

For example:

Office Network → Security Barrier → Operational Network → Critical Control System

If an attacker enters the office network, segmentation can make it more difficult to reach critical electricity-control systems.

This is particularly important for SCADA and industrial-control systems.

12. Data Protection

Digital energy systems collect large amounts of information.

Smart meters may show detailed electricity-use patterns of consumers.

Where this information is personal data, the GDPR requires appropriate security measures. Article 32 includes measures such as encryption, confidentiality, system resilience and regular security testing.

Therefore, energy companies must protect both:

Energy infrastructure + Consumer information

13. Supply-Chain Security

Energy companies often depend on outside companies for:

software;

smart meters;

cloud services;

telecommunications;

SCADA equipment; and

maintenance.

A supplier's cybersecurity weakness can create a risk for the energy company.

Therefore, contracts should contain cybersecurity requirements, incident-reporting duties and rules for secure software updates.

NIS2 specifically recognises supply-chain security as an important part of cybersecurity risk management.

14. Incident Response

A cybersecurity standard should also explain what happens after an attack.

The basic process is:

Detect → Report → Contain → Recover → Investigate

Energy companies should have emergency plans for:

ransomware;

malware;

stolen passwords;

system manipulation;

data breaches; and

control-system attacks.

Regular cybersecurity exercises can help employees understand their responsibilities.

15. Relevant Case Laws

Direct court cases specifically dealing with cybersecurity standards in electricity systems are still limited. However, several cases provide useful principles.

Warren v DSG Retail Ltd [2021] EWHC 2168 (QB)

The UK High Court considered legal claims following a cyberattack.

The case shows that simply suffering a cyberattack does not automatically establish every possible legal claim. The particular legal duty and its breach must be established.

This is important for energy companies because cybersecurity responsibilities should be clearly identified.

Various Claimants v WM Morrison Supermarkets plc [2020] UKSC 12

The UK Supreme Court considered whether an organisation could be responsible for an employee's misuse of personal data.

The case is useful for understanding organisational responsibility when employees have access to sensitive information.

Digital Rights Ireland, Joined Cases C-293/12 and C-594/12

The Court of Justice considered large-scale data retention.

The case highlights the importance of necessity and proportionality when large amounts of information are collected and stored.

This principle is relevant to energy companies collecting large quantities of consumer and operational data.

Schrems II, Case C-311/18

The Court of Justice examined international transfers of personal data.

The case is relevant where energy companies use international cloud services to store or process consumer information.

16. Importance of Cybersecurity Standards

Cybersecurity standards are important because modern energy systems are highly dependent on digital technology.

A cyberattack can potentially affect:

electricity supply;

consumer information;

electricity markets;

grid stability;

financial transactions; and

public confidence.

Therefore, cybersecurity should be treated as part of energy security, not merely as an IT issue.

17. Conclusion

Cybersecurity standards provide a structured way to protect digital energy systems.

The main approach is:

Identify risks → Protect systems → Monitor networks → Detect attacks → Respond quickly → Recover safely.

The NIS Regulations provide important UK legal requirements for relevant essential-service operators, while NIS2 provides a wider EU cybersecurity framework. Standards such as ISO 27001, IEC 62443 and the NIST Cybersecurity Framework provide practical methods for improving cybersecurity.

The cases Warren v DSG Retail, Morrisons, Digital Rights Ireland and Schrems II provide useful legal principles concerning cybersecurity responsibility, organisational liability, proportionality and data protection.

In simple terms, the purpose of cybersecurity standards is to ensure that energy systems remain safe, private, reliable and available even when cyber threats occur.