Λαμβάνοντας υπόψιν τον Κανονισμό (ΕΕ) 2019/943 του Ευρωπαϊκού Κοινοβουλίου και του Συμβουλίου, της 5ης Ιουνίου 2019, σχετικά με την εσωτερική αγορά ηλεκτρικής ενέργειας, και ιδίως το άρθρο 59(2)(ε), ε

Article 4

of the present methodology; (b) assess the possible consequences of a cyber-attack compromising the confidentiality, integrity or availability of the information used in them,

Article 5

of the present methodology; (c) identify the Union-wide high-impact and critical-impact processes,

Article 6

of the present methodology; anddevelop the Electricity Cybersecurity Impact Indices (ECII) and highimpact and critical-impact thresholds,

Article 7of the present methodology.

ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 Article 4 Identification of electricity sector processes At the start of the Union-wide cybersecurity risk assessment, ENTSO-E in cooperation with the EU DSO entity shall create a list of potential Union-wide high-impact and critical-impact processes. The list shall contain all processes that may affect the operational security of the electricity system. The processes may involve any of the entities in Article 2

Article 4

of the present methodology, ENTSO-E in cooperation with the EU DSO entity shall analyse the possible consequences if the confidentiality, integrity, or availability of the information used is compromised by a cyber-attack using the impact metrics in Annex I.

Article 4

of the present methodology, ENTSO-E, in cooperation with the EU DSO entity, shall evaluate if the consequences are above the high-impact and critical-impact thresholds in Annex II.

Article 19

of the NCCS Regulation, shall include a list of Union-wide high-impact and critical-impact processes identified according to Article 6 of the present Methodology. For each of these processes, the report shall include: (a) an assessment of the possible consequences of a cyber-attack compromising the confidentiality, integrity, or availability of information used in the process, as assessed

Article 5

Article 7

Article 7

Article 19(2)(b) of the NCCS Regulation.

TITLE 3 Regional cybersecurity risk assessment and mitigation ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 Article 9 Objective of the regional cybersecurity risk assessment

Article 10

of the present methodology; (b) evaluate the risks analysed in point (a)

Article 11

of the present methodology; (c) determine the cybersecurity threats that lead to high and critical risks

Article 12of the present methodology. Article 10 Aggregating the Member State risk assessment results

Article 15

Article 17(1).

Article 11 Evaluating the risks ENTSO-E, in cooperation with the EU DSO entity, shall evaluate the cybersecurity risks analysed

Article 10

of the present methodology using the risk impact matrix that will be defined in the Union-wide cybersecurity risk assessment report. Article 12 Determining cyber threats ENTSO-E, in cooperation with the EU DSO entity, shall determine the cyber threats in accordance with Annex III which may lead to the high and critical risks identified in Article 11 of the present methodology. They shall take into account the information on cyber threats provided in the Member State cybersecurity risk assessment reports. Article 13 Cross-border cybersecurity risk assessment report ENTSO-E, in cooperation with the EU DSO entity, shall report the results of the regional cybersecurity risk assessment in the Comprehensive Cross-border electricity cybersecurity risk assessment report

Article 23of the NCCS Regulation. TITLE 4 Member state cybersecurity risk assessment Article 14 Objective of the member state cybersecurity risk assessment

Article 15

of the present methodology; (

1. b)aggregate the risk analysis results from the risk assessments at entity level to determine the consequences and likelihood of a compromise of the confidentiality, integrity or availability of the information used in them; (
2. c)summarize the information on cyber-attacks and cyber threats gathered

Article 38

Article 31of the NCCS Regulation or request additional information from the high-impact and critical-impact entities.

Article 26

Article 26

Article 32

of the NCCS Regulation; (d) the CSOC capabilities

Article 38

Article 39

Article 41

of the NCCS Regulation; (g) the entity- or Member-State level cybersecurity exercises

Article 43

of the NCCS Regulation; and ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 (h) the participation in regional cybersecurity exercises

Article 44of the NCCS Regulation.

Article 27

Article 27

Article 38

Article 38

Article 20(2) of the NCCS Regulation.

The competent authority may report the risks according to the template provided in Annex V(A). TITLE 5 Final provisions Article 20 Implementation timeline

Article 19of the NCCS Regulation; b.

the Comprehensive cross-border cybersecurity risk assessment report

Article 23of the NCCS Regulation; c.

the regional cybersecurity risk mitigation plans

Article 22of the NCCS Regulation; and d.

the Member State cybersecurity risk assessment reports

Article 20of the NCCS Regulation.

Article 21 Language The reference language for this cybersecurity risk assessment methodology Proposal shall be English. For the avoidance of doubt, where TSOs and DSOs need to translate this cybersecurity risk assessment methodology Proposal into their national language(s), in the event of inconsistencies between the English version published by TSOs and DSOs in accordance with Article 5

Article 7

of the present methodology; ECII thresholds are determined during the Union-wide cybersecurity risk assessment. Union-wide cybersecurity risk assessment The table below gives the thresholds for determining when the impact of a cybersecurity risk should be considered high-impact or critical-impact for the Union-wide cybersecurity risk assessment. Table 1: High-impact and critical-impact thresholds for the Unionwide cybersecurity risk assessment. Impact metric High-impact threshold Critical-impact threshold Loss of load 250 MW 3,000 MW Reduction of power generation 250 MW 3,000 MW Frequency degradation >50 mHz for > 15 min >200 mHz for >30 sec OR >100 mHz for >5 min. Violation of standards on voltage <0,85 pu, for >30 seconds OR Same as high-impact but with consequences on at least one neighbouring TSO ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 <= 0,90 pu for >60 min. OR >1,05 pu for >60 min. OR >1,10 pu, for >30 seconds No consequences on neighbouring TSO Reduction of capacity in the primary frequency reserve More than 20 % reduction, with a duration of more than 30 minutes Reserve capacity unavailable more than 30 minutes Reduction of capacity in the other frequency reserves More than 20 % reduction, with a duration of more than 30 minutes Reserve capacity unavailable more than 30 minutes Loss of capacity for a black start Loss of any tools, means and facilities needed for a black start with consequences for neighbouring TSOs for more than 30 minutes Loss of all tools, means and facilities needed for a black start within a TSOs control area, for more than 30 minutes OR The unplanned evacuation to the back up control room The expected duration of outage affecting customers in combination with the scale of the outage in customer numbers 50,000,000 customer outage minutes 100,000,000 customer outage minutes Regional cybersecurity risk assessment The table below gives the thresholds for determining when the impact of a cybersecurity risk should be considered high-impact or critical-impact for regional cybersecurity risk assessment. Table 2: Thresholds for the loss of load and reduction of power generation impact metrics for the regional cybersecurity risk assessment. Central Europe High-impact threshold Critical-impact threshold SEE SWE Nordic Baltic 250 MW 250 MW 250 MW 500 MW 500 MW 3,000 MW 3,000 MW 3,000 MW 3,000 MW 900 MW ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 Table 3: Thresholds for frequency degradation impact metric for different system operation regions. Central Europe Nordic Baltic >50 mHz for > 15 min >100 mHz for > 15 min >50 mHz for > 15 min OR OR OR >100 mHz for >5 min. >200 mHz for >30 sec >250 mHz for >5 min. >500 mHz for >1 min >200 mHz for >10 min. >400 mHz for >1 min SEE SWE High-impact threshold Critical-impact threshold OR >1 Hz Table 4: Thresholds for the voltage impact metric at the connection point between >110 kV and ≤300 kV for different system operation regions. (Here pu stand for per-unit.) Central Europe Nordic Baltic SEE SWE High-impact threshold <0,85 pu, for >30 seconds <0,90 pu, for >30 seconds <0,85 pu, for >30 seconds OR OR OR >1,05 pu for >60 min. <= 0,90 pu for >60 min. OR OR >1,10 pu, for >30 seconds >1,118 pu for >60 min. <= 90 pu for >30 min. OR >1,118 pu for >20 min. OR OR >1,15 pu, for >30 seconds Critical-impact threshold >1,15 pu, for >30 seconds No consequences on neighbouring TSO Same as high-impact but with consequences on at least one neighbouring TSO. ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 Table 5: Thresholds for the voltage impact metric at the connection point above 300 kV for different synchronous areas. Central Europe Nordic Baltic SEE SWE High-impact threshold <0,85 pu, for >30 seconds <0,90 pu, for >30 seconds <0,88 pu, for >30 seconds OR OR OR >1,05 pu for >60 min. <= 0,90 pu for >60 min. <= 90 pu for >30 min. OR OR >1,10 pu, for >30 seconds OR >1,05 pu for >60 min. >1,097 pu for >20 min. OR OR >1,10 pu, for >30 seconds >1,15 pu, for >30 seconds No consequences on neighbouring TSO Same as high-impact but with consequences on at least one neighbouring TSO. Critical-impact threshold Table 6: Thresholds for the reduction of capacity in the primary frequency reserve impact metric for different system operation regions. Central Europe Nordic Baltic SEE SWE High-impact threshold Critical-impact threshold More than 20 % reduction, with a duration of more than 30 minutes Reserve capacity unavailable more than 30 minutes Table 7: Thresholds for the reduction of capacity in the other frequency reserves impact metric for different system operation regions. Central Europe Nordic Baltic SEE SWE High-impact threshold More than 20 % reduction, with a duration of more than 30 minutes ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 Critical-impact threshold Reserve capacity unavailable more than 30 minutes Table 8: Thresholds for the loss of capacity for a black start impact metric for different system operation regions. Central Europe Nordic Baltic SEE SWE High-impact threshold Loss of any tools, means and facilities needed for a black start with consequences for neighbouring TSOs for more than 30 minutes OR Critical-impact threshold The unplanned evacuation to the back up control room Loss of all tools, means and facilities needed for a black start for more than 30 minutes. Table 9: Thresholds for the expected duration of outage affecting customers in combination with the scale of the outage in customer numbers impact metric for different synchronous areas. Central Europe Nordic Baltic SEE SWE High-impact threshold 50,000,000 customer outage minutes Critical-impact threshold 100,000,000 customer outage minutes Member state cybersecurity risk assessment The thresholds for the member state cybersecurity risk assessment are the same as for the regional cybersecurity risk assessment. Member states use the thresholds of their system operation region. The only exception is for the loss of load and reduction of power generation impact metrics. For those metrics, member states use the thresholds in Table 10. Table 10: Thresholds for the loss of load and reduction of power generation impact metrics for the member state cybersecurity risk assessment. Member state High-impact threshold Critical-impact threshold Austria 500 MW 3,000 MW Belgium 1,500 MW 3,000 MW Bulgaria 250 MW 3,000 MW Croatia 250 MW 3,000 MW Cyprus 250 MW 800 MW ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 Czech Republic 500 MW 3,000 MW Denmark 1,000 MW 3,000 MW Estonia 500 MW 900 MW Finland 500 MW 3,000 MW France 1,500 MW 3,000 MW Germany 1,500 MW 3,000 MW Greece 500 MW 3,000 MW Hungary 500 MW 3,000 MW Ireland 500 MW 800 MW Italy 1,500 MW 3,000 MW Latvia 500 MW 900 MW Lithuania 500 MW 900 MW Luxembourg 1,500 MW 3,000 MW Malta 250 MW 500 MW Netherlands 1,500 MW 3,000 MW Poland 1,000 MW 3,000 MW Portugal 250 MW 3,000 MW Romania 1,000 MW 3,000 MW Slovakia 500 MW 3,000 MW Slovenia 1,000 MW 3,000 MW Spain 1,000 MW 3,000 MW Sweden 1,500 MW 3,000 MW Annex III: List of cyber threats The table below gives a list of cyber threats that shall be considered during the regional cybersecurity risk assessment. Cyber threat Description Severe and unexpected corruption of the supply chain The supply chain of a high-impact and critical-impact entity is severely and unexpectedly corrupted through a cyber-attack. ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 The unavailability of ICT products, ICT services, or ICT processes from the supply chain Because of a cyber-attack, products, services, or processes in the supply chain are not available. This includes for instance network services not being available. Cyber-attacks initiated through actors in the supply chain Cyber-attacks are initiated through actors in the supply chain of a high-impact or critical-impact entity. This includes the abuse of remote access rights of service providers, malware infections of laptops used by contractors, and failures in separating resources (memory, storage, routing) between different tenants of shared (cloud) infrastructure. Leaking of sensitive information through the supply chain, including supply chain tracking The confidentiality of high-impact or critical-impact information assets is compromised through service providers or other actors in the supply chain that have access to the assets. The introduction of weaknesses or backdoors into ICT products, ICT services, or ICT processes through actors in the supply chain Weaknesses or backdoors are deliberately inserted into ICT products, ICT services, or ICT processes used in the highimpact or critical-impact perimeters through actors in the supply chain. This includes the inclusion of software backdoors by developers, in third party software, or in open-source software, and the inclusion of hardware backdoors during design and production. Attacks through communication networks The confidentiality, integrity or availability of high-impact or critical-impact assets are compromised when they are sent over a communication network. This includes eavesdropping, manipulation of data in transit, man-in-themiddle attacks, DDoS attacks, or failure in telecommunication equipment due to cyber-attacks. When analysing this threat, entities should in particular analyse the risks of disrupting communication for systems with real-time requirements. Attacks through removable media The confidentiality, integrity or availability of high-impact or critical-impact assets are compromised when they are stored on removable media. This includes theft of media, and retrieval of recycled or discarded media. When analysing this cyber threat, entities should in particular analyse the cyber threat of removable media to legacy system. Unauthorized system access Threat actors gain unauthorized access to network and information systems within the high-impact or criticalimpact perimeter. This includes unauthorized remote access with compromised credentials or by exploiting software vulnerabilities. When analysing this cyber threat, entities should in particular analyse the risks of unauthorized access to legacy systems. Malware intrusion Malware is introduced into the high-impact or criticalimpact perimeter. This includes worms, viruses, remote ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 access toolkits, wipers, and ransomware. Both targeted and untargeted malware should be considered. When analysing this cyber threat, entities should in particular analyse the cyber threat of malware being introduced into legacy systems. Social engineering Social engineering attacks are performed on staff or contractors involved in the high-impact and critical-impact processes to compromise the information used in them. This includes phishing and spear-phishing. Physical attacks Attackers physically attack assets in the high-impact or critical-impact perimeter to compromise the confidentiality, integrity or availability of the high-impact or critical-impact information assets. This includes breaking in on locations with high-impact or critical-impact information assets, or physically tampering or destroying hardware components that process high-impact or criticalimpact information assets. Insider threats Employees at the high-impact or critical-impact entities intentionally compromise the confidentiality, integrity or availability of the high-impact or critical-impact assets. ENTSO-E asbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e EU DSO Entity | Rue du Luxembourg, 3 | 1000 Brussels | info@eudsoentity.eu | www.eudsoentity.eu | Annex IV: Entity reporting template The table below provides a template for high- and critical-impact entities to report the results of cybersecurity risk assessment at entity level according to Article 27 of the NCCS Regulation. Not all information in the template is required by the NCCS Regulation. Competent authorities may have to request additional information according to Article 16 of the present methodology. Process Art 27 NCCS Property compromised Art 27 NCCS Current risk Art 27 NCCS Likelihood <Process 1> Impact Cyber threats causing risk Art 16