Technical study to develop good practice guidance on securing electricity substations against cyber risks.

Notice summary: The Department of Energy and Climate Change wishes to commission a project to develop guidance on securing electricity substations against cyber risks.

Developing guidance on how best to secure substations would assist industry by providing guidance on how best to ensure specific risks are mitigated across the sector.

Description: Substations are critical in maintaining a stable and secure supply of electricity and the loss of one or more substations would result in widespread disruption to consumers and extensive financial losses.

Indeed the targeted cyber-attack in Ukraine in December 2015, which led to up to 225,000 people having electricity cut off for several hours, was highlighted in the Department of Homeland Security incident report to have been achieved by hackers installing malware within substations that allowed them remote access.

Due to the number of critical sub-stations it would not be possible to undertake a cyber risk assessment at each substation; but developing good practice guidance on how best to secure current substations and how to procure and deploy secure substations (from a cyber risk perspective), including next generation smart substations and associated smart assets, would assist industry by providing guidance on how best to ensure specific risks are mitigated across the sector.

The supplier, via background research and industry engagement, and using their own relevant technical and sector expertise, will produce sector-specific guidance on securing substations, including the transmission and distribution aspects, covering current and future designs (including next generation smart substations).

This will include a review by the supplier of: • Existing (if any) security standards/guidance for securing substations, • the Ukrainian cyber-attack in December 2015, specifically relating to the method employed and lessons identified.

Following this, engagement with industry through a series of company or site-specific visits including interviews with employees will: • help to understand the different cyber risks to the transmission and distribution segments of existing electrical substations, • identify designs for future substations (including next generation smart substations) where guidance could be utilised.