The network code in brief

Adopted on 11 March 2024 as Commission Delegated Regulation (EU) 2024/1366 and in force since 13 June 2024, the Network Code on Cybersecurity (NCCS) establishes a risk-based framework for the cybersecurity aspects of cross-border electricity flows, aligned with NIS2. It was drafted by ENTSO-E and the EU DSO Entity with the support of ACER, following public consultation. Its core elements: a recurring risk assessment cycle combining a top-down Union-wide assessment with a bottom-up assessment from entities to national and regional level; the classification of entities into critical-impact, high-impact and small or micro entities with graduated controls; cybersecurity management systems verified through certification or national verification schemes; harmonised cybersecurity procurement requirements compatible with Union certification schemes such as EUCS and ICCS; SOC capabilities and reporting of critical or high-gravity cyber-attacks to CSIRTs within four hours; crisis management plans, an early warning system and exercises at entity, national and regional level; protection of exchanged information; and supply chain security reaching suppliers and equipment manufacturers. Implementation is ongoing: ACER has established a European Stakeholder Committee on electricity cybersecurity, and consultations are running on the cyber-attack classification scale and procurement recommendations for substation gateways.

What GISAD welcomes

A common risk assessment cycle, uniform minimum requirements, reporting through the existing CSIRT structures instead of new parallel bureaucracy, exercises, and supply chain security – this is structure, not paperwork. The alignment with NIS2 and the delegation to the network operator associations under ACER supervision is the right division of roles: those who operate the grid lead the process. Whoever bears responsibility in daily operation must have the information.

Five points GISAD recommends for the implementation phase

1. The network code secures the interconnected grid – what must also be measured is what works without it. The risk assessment cycle evaluates threats to the grid. It should be complemented by an autonomy indicator: how long can an entity keep operating without central control and communication systems – islanding capability, decentralised generation, micro-grids? Decentralised structure reduces the catastrophic effect of every outage. Autonomy is a measurable risk reduction, not a romantic ideal.

2. Exercises without the grid. The exercise framework is right – but scenarios must include the failure of the entities‘ own communication and coordination, not only rehearse the reporting chain. An exercise that presupposes functioning systems tests administration, not resilience. Measuring outside the manipulable area applies here as well.

3. Origin measurement in the procurement requirements. Harmonised procurement requirements compatible with EUCS and ICCS are the right lever – but a certificate that does not measure origin certifies dependence. The requirements should include a measurable operator and legal-order criterion: no US hyperscalers in critical infrastructure. Control and switching technology whose manufacturers and operations lie in third countries carries the attack risk into the grid.

4. Concept fidelity in operation instead of the certificate state of a single day. Verification schemes are point-in-time checks. GISAD recommends sample-based verification in operation with event-based triggers and recertification upon substantial change – consistent with its positions on EUCS and the Cybersecurity Act revision.

5. Do not leave small entities alone. Basic hygiene for small and micro entities is proportionate, but the code must not create two classes of resilience: shared SOC offerings, open standards and model documentation – also for aggregators and demand-response providers of small size but high impact – enable participation instead of thresholds. Sanitised and anonymised information sharing is the right approach; withholding information must not become a gatekeeper instrument of individual CSIRTs.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: EU electricity supply – sector-specific rules on cybersecurity (network code) · Commission Delegated Regulation (EU) 2024/1366 (EUR-Lex) · European Commission – New network code on cybersecurity for EU electricity sector · GISAD study “2039 – Resilience through decentralised networking” – publication scheduled for calendar week 48/2026 at www.finders.de