WindEurope provided feedback on the public consultation organized by ENTSO-E regarding the Cyber- attack Classification Scale Methodology on Network Code on Cybersecurity (NCCS).
Under Article 37(8) of the Network Code for Cybersecurity (NCCS), the European Network of Transmission System Operators for Electricity (ENTSO-E) in cooperation with the EU DSO entity (DSO Entity) has developed a proposal for methodology for the cyber-attack classification scale.
The document will help high-impact and critical-impact entities to assess whether a cyber-attack is reportable according to the NCCS by understanding the gravity level of a cyber-attack. The gravity of a cyber-attack is based on the potential impact and the severity of the cyber-attack. The potential impact is determined by the types of assets affected. The severity of the cyber-attack is estimated according to the position of an attacker in the attack chain.
When high-impact and critical-impact entities assess the gravity of the cyber-attack as critical or high, they must share relevant information with their CSIRTs and competent authorities no later than four hours after assessing that the cyber-attack is reportable.