Spain Approves New Cybersecurity Measures for Electricity Networks

Key Takeaways

• Spain Approves Cybersecurity Methodologies: The CNMC has approved two methodologies establishing common criteria for assessing cybersecurity risks and classifying cyberattacks affecting Europe's electricity system.
• High-Impact Operators Face Additional Requirements: EU-level risk assessments will help establish the thresholds used to identify electricity companies subject to heightened cybersecurity obligations.
• Cyberattack Reporting to Follow Common Criteria: The classification methodology establishes a harmonized approach to assessing attack severity and determining which incidents require notification.
• Cybersecurity Management Requirements: Companies designated as high- or critical-impact entities will face obligations covering risk assessments, security controls, cybersecurity management systems, information sharing and crisis preparedness.
• Company Designations Still to Come: The CNMC has not identified individual operators as high- or critical-impact entities. Those classifications will follow the applicable assessment and designation processes.

Deep Dive

Spain's National Commission on Markets and Competition (CNMC) has approved two methodologies for assessing cybersecurity risks and classifying attacks on electricity networks, a step toward identifying the companies that will face additional security requirements under European Union rules.

The decision concerns a European electricity system in which national borders offer little protection against the consequences of a cyberattack. Electricity networks are increasingly interconnected, and a disruption in one country can have implications for power flows elsewhere.

The methodologies establish common criteria for identifying cybersecurity threats, assessing their potential consequences and determining the severity of cyberattacks. They form part of the EU's cybersecurity network code for cross-border electricity flows, established under Commission Delegated Regulation (EU) 2024/1366.

One methodology covers risk assessments at national, regional and EU levels. The other establishes a common approach to classifying cyberattacks and determining which incidents must be reported to competent authorities.

The proposals were developed by the European Network of Transmission System Operators for Electricity (ENTSO-E) in cooperation with the European Distribution System Operators Entity (DSO Entity). They underwent consultation and cooperation among competent authorities across EU member states before receiving approval in Spain.

The CNMC is acting as Spain's competent authority under the network code because the authority formally designated for that responsibility has not yet been appointed.

Which Electricity Companies Will Face Additional Requirements?

The risk assessment methodology will provide the basis for examining threats to the operational security of electricity networks, including the potential consequences for cross-border electricity flows. At the EU level, those assessments will help establish the indices and thresholds used to identify electricity operators considered to have high or critical impact under the network code.

The classification could affect companies across Spain's electricity industry. The CNMC identified system and market operators, transmission and distribution companies, electricity producers, suppliers and aggregators among the businesses that could fall within its scope.

The requirements will depend on how individual entities are classified. Companies designated as high- or critical-impact entities will have to assess their cybersecurity risks, implement controls and establish cybersecurity management systems. They will also face obligations concerning information sharing and preparation for and management of cybersecurity crises.

The network code establishes the conditions and deadlines for compliance, with competent authorities responsible for designating the entities that meet the relevant criteria.

No individual companies were identified in the CNMC's announcement. The approval of the methodology does not itself classify electricity operators as high- or critical-impact entities. Those designations will follow the assessment process and the establishment of the relevant thresholds.

The distinction matters for companies trying to determine what the regulation will require of them. The framework is taking shape, but the assessment that will determine which operators face particular obligations remains a separate part of the process.

Common Criteria for Reporting Cyberattacks

The second methodology addresses how authorities and electricity operators assess cyberattacks once they occur. It establishes common criteria for evaluating their severity and impact, including determining which attacks are subject to notification requirements.

The approach is intended to improve coordination between electricity companies and competent authorities across member states. A common classification method should allow incidents to be assessed against consistent criteria, particularly where an attack could affect electricity operations beyond the country in which it occurs.

The CNMC's decision forms part of the wider implementation of the European cybersecurity network code, which sets specific requirements for protecting electricity systems and strengthening cooperation between member states.

The regulation also addresses cybersecurity risk management and crisis preparedness for operators whose activities have a sufficiently significant effect on cross-border electricity flows.

The October 30 approval does not establish that a particular cyberattack has occurred or that any Spanish electricity company has failed to meet its cybersecurity obligations. It concerns the methods authorities will use to assess risks and incidents under the European framework.

Further work will determine the indices and thresholds for classifying high- and critical-impact entities. Competent authorities will then identify the operators subject to the corresponding requirements, which will apply according to the terms and deadlines established by the network code.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey