High Security Control and Protection System

Completed

Other Cross-Cutting Technologies or Research
Other Power and Storage Technologies(Electricity transmission and distribution)

Applied Research and Development

PHYSICAL SCIENCES AND MATHEMATICS (Computer Science and Informatics)
ENGINEERING AND TECHNOLOGY (Electrical and Electronic Engineering)

Not Cross-cutting

Project Contact
National Grid Electricity Transmission

Network Innovation Allowance

Ofgem

01 July 2024

31 January 2026

ENA months

£1,100,000

Power

London

Network Innovation Allowance

Project Contact, National Grid Electricity Transmission

Work Pack 1 (part of this project):National Grid will provide a Conceptual Cybersecurity Requirements Specification to support design works. The selection process will include submissions detailing bills of material, conceptual cyber security design specifications including conceptual system architecture, budgetary cost and schedule estimates, relevant certifications and how vendors propose to meet each of the National Grid specified controls with evidence of previous implementations and current and future cost implications. Key deliverables for the project are:Producing a refined view of National Grid defined controls, including proposed vendor design, implementation approach, proposed costs, support model and previous examples. Noting where implementations conflict with existing Transmission Standards or exceptions must be made against security requirements. In achieving this, there will be enhanced confidence in the robustness and adherence to standards of the control systems being developed, ensuring the systems are designed and implemented with consideration for industry best practices, minimising the risk of vulnerabilities and potential disruptions to services.Developing a Functional Design Specification which should additionally include highlighting the impact of implementing the security controls on the control systems operational functionality. The Functional Design Specification will ensure the implementation of security controls do not compromise the operational functionality of the control system. This means that consumers can continue to rely on the systems performance and functionality while enjoying the added protection and security measures in place. Inform proportionate decision making on the specification and assurance of new control systems and their lifecycle.Enhance OEM product offerings by providing higher security alternatives.Gain a better understanding of the risk and threat environment facing National Grids substation control systems. Risk scenarios will be tested during the commissioning of the control systems to demonstrate resilience and make iterative improvements.Determine the complexities of implementing a high security control system and challenges in scaling to the wider estate. If organisational change is required, we will be able to uncover this and begin the process of closing those gaps.Develop National Grids internal skills and capabilities to build increasingly secure control systems.Collaborate with partners to modify existing policies and standards.Gain wider recognition as an industry-leading Security function in the energy sector.Protecting the confidentiality, integrity, and availability of control systems, reducing the risk of costly security breaches and downtime.Enhancing incident response and incident recovery processes by testing forensics tools and developing comprehensive documentation.

To ensure energy systems of the future continue to be resilient to evolving threats, it is important we develop increasingly secure control systems. Working with vendors, the goal is to innovate and develop efficient, deliverable, and secure protection and control systems capable of mitigating advanced cyber threats using secure by design practices. Lessons learned from this innovation project will enable National Grid to make decisions on the proportionality and appropriateness of security controls for both new and existing sites. This must be achieved while still maintaining the current user experience and meeting control/protection functionality specifications, all in a system designed to match the lifecycle of current systems of approximately 20 years.

02/04/25