Standards with cybersecurity controls for smart grid—A systematic analysis

Abstract

Summary In recent years, numerous standards related to the cybersecurity of smart grids have been published, which led to the challenge for operators in obtaining indications that match their specific objectives and contexts. Although several studies approached this problem by providing more or less comprehensive surveys and overviews of smart grid cybersecurity standards, none of them was dedicated to the actual and important subject of cybersecurity controls. This paper aims at filling this gap. A systematic literature analysis was conducted which resulted in the identification of 19 broadly recognised standards that specify cybersecurity controls applicable to the smart grid infrastructure. The publications are described in respect to the controls they define and referred to evaluation criteria. In result, this paper constitutes a guideline on standardised cybersecurity controls for smart grids, where (criteria‐based) indications help to select standards for a particular smart grid area or specific goals. The method of the research as well as the standards' selection and evaluation criteria are presented.

Blockchain Technology on Smart Grid, Energy Trading, and Big Data: Security Issues, Challenges, and Recommendations

“…Using the existing security protocol in BC architecture became more secure [93]. The existing SG standards and protocols are as follows: AMI-SER [94], CEN-CENELEC-ETSI SG Coordination Group [95], IEC 62351 [96,97], NERC-CIP [98], IST [99,100], ISO/IEC 27001 and 27002 [101,102], GB/T 22239 [103], ISO/IEC 15408 and 18045 [104], IEC Strategic Group 3 SG [105], IEC 62443 (ISA99) [106], IEC 62443 (ISA99) [107], IEEE Std 2030-2011 [108], IEEE 1686 [105], DHS catalog [109], German Standardization Roadmap E-Energy/SG [108,110], NIST SP 800-82 [99], NRC RG 5.71 [107], NIST SP 800-53 & 800-64 [110], NIST SP 800-115 [108], Open SG Security Working Group [108], ITU-T SG Focus Group [107], SG Interoperability Panel [108,109], The State Grid Corporation of China (SGCC) Framework [111], European Commission SG Mandate Standardization M/490 [112], and Japanese Industrial Standards Committee (JISC) Roadmap to International Standardization for SG [107].…”

The ISO/IEC 27001 information security management standard: literature review and theory-based research agenda

“…The issues addressed in these studies are diverse. Tarn et al (2009), Rezakhani et al (2011), Tsohou et al (2010), Pardo et al (2012), Leszczyna (2019) and Al-Karaki et al (2020) present a framework for the categorization of various ISS standards; along the same lines, Mesquida et al (2014) and Pardo et al (2013, 2016) approach ISO standards related to software quality, IT service management and ISS. Seven papers (Susanto et al , 2011; Montesino et al , 2012; Sheikhpour and Modiri, 2012a, b; Mukhtar and Ahmad, 2014; Bettaieb et al , 2019; Faruq et al , 2020) focus specifically on the alignment between the security controls recommended by ISO/IEC 27001 with other standards.…”

“…Seven papers (Susanto et al , 2011; Montesino et al , 2012; Sheikhpour and Modiri, 2012a, b; Mukhtar and Ahmad, 2014; Bettaieb et al , 2019; Faruq et al , 2020) focus specifically on the alignment between the security controls recommended by ISO/IEC 27001 with other standards. Beckers et al (2016), Bounagui et al (2019), Leszczyna (2019) and Ganji et al (2019) explore integration issues. An interesting perspective is provided by Simić-Draws et al (2013), which defines a method for law-compatible technology design.…”

“…Being ISO/IEC 27001 process-driven seems better suited to meet these challenges than more document-oriented standards (Beckers et al , 2013). However, ISO/IEC 27001 alone seems not sufficient to guarantee both IS security and safety (Park and Lee, 2014), but it may represent the backbone on which more specific standards are integrated (Leszczyna, 2019).…”

“…Tarn et al (2009),Rezakhani et al (2011,Pardo et al (2012),Leszczyna (2019) and Al-Karaki et al (2020) present a framework for the categorization of various ISS standards; along the same lines, Mesquida et al (2014) and Pardo et al…”