Large Load Controllers: Tier 1 Cyber Assessment Framework and Associated Guidance

Overview

The consultation will primarily be of interest to operators in the electricity sector, specifically organisations engaged in remote load control of electricity, and their trade associations. 

Our policy intent has been set out in a number of consultations to date under the Smart Secure Electricity Systems Programme, and links to clauses in the Cyber Security and Resilience Bill, currently going through the House of Lord's Committee Stage, which will bring load controllers in scope of the Network and Information Systems Regulations 2018. This means load controllers in scope will need to manage cyber risks in their organisations for all networks and systems that are essential for delivering their load control service. The idea is to improve the cyber resilience of these organisations given the critical role they play in the energy system, and the potential for electricity grid disruption if they are compromised by cyber attack. There will be a grace period for industry to familiarise themselves with requirements and scale up, but then they will be formally assured against these requirements by Ofgem. In practice this will involve yearly self assessments and inspections by Ofgem. This will probably entail some cost and some upskilling to improve their level of cyber maturity. However these impacts are being assessed/have been consulted on as part of the Bill itself and the legislative changes.

The consultation will set out:

1. The proposed Cyber Assessment Framework profile that Ofgem will use to assure organisations, with relevant outcomes and attainment levels, for testing with industry stakeholders

2. Relevant accompanying guidance drafts to support industry in applying the new requirements

The consultation will ask for views on proportionality, feasibility and cost to ensure we establish a sensible approach.