The National Commission on Markets and Competition (CNMC) has given its approval to the methodologies for risk assessment and the classification of cyberattacks in the sphere of the electric system.
With this decision, the Spanish regulatory body applies the provisions set out in Commission Delegated Regulation (EU) 2024/1366, which establishes the sectoral network code intended to safeguard cross-border electricity exchanges against possible cyberthreats.
The new procedures have been drawn up by the Transmission System Operators (TSOs) -including Red Eléctrica de España (REE)- with the support of Entsoe-E and in coordination with the entity that brings together the distribution system operators (EU DSO Entity).
These methodologies establish harmonized criteria to identify, analyze and assess cybersecurity risks, as well as to classify cyberattacks according to their severity and the effects they may cause. All of this is framed within the European cybersecurity network code relating to cross-border electricity flows.
The proposals have gone through a process of consultation and cooperation between the competent authorities of the different Member States. In the Spanish case, the CNMC acts as the competent authority by default, since the formal designation provided for in the network code has not yet taken place, as the regulator itself has pointed out.
After that process at the European level, the CNMC has proceeded to approve, in its capacity as the authority responsible for the application of the cybersecurity network code, both the risk assessment methodologies and the cyberattack classification methodology.
Indices and thresholds for high-impact entities
The risk assessment at European Union level will make it possible, among other aspects, to define the indices and thresholds that will serve to determine, among the companies operating in the Spanish electric system (such as the system operator, market operator, transmission operator, distributors, producers, marketers, aggregators, etc.), which will be considered high- and critical-impact entities within the framework of the network code.
These entities will be designated by the competent authorities and must comply, within the deadlines and conditions set by the network code, with different obligations depending on the category assigned to them. Among them are the periodic assessment of their risks, the implementation of controls and of a cybersecurity management system, as well as compliance with information exchange requirements and with preparation and management of possible cybersecurity crises.
According to the CNMC, these methodologies represent a step forward in the protection of the European electricity system, which is becoming increasingly digitalized and interconnected and in which cyberthreats can generate transnational impacts. In addition, they lay the foundations for strengthening the resilience of the grid, the security of supply and the capacity for prevention, detection and response to cyberattacks.