Δημόσια Διαβούλευση της ΡΑΑΕΥ επί της κοινής πρόταση όλων των ΔΣΜ της Ένωσης σχετικά με τη μεθοδολογία της κλίμακας ταξινόμησης κυβερνοεπιθέσεων σύμφω

(2)(ε), εξεδόθη από την Επιτροπή ο υπ’ αριθμ. 2024/1366 Κανονισμός (ΕΕ) της 11ης Μαρτίου 2024 (εφεξής ο «Κανονισμός)» με τον οποίο θεσπίζονται ειδικοί τομεακοί κανόνες για τις πτυχές της κυβερνοασφάλειας στις διασυνοριακές ροές ηλεκτρικής ενέργειας. Σύμφωνα με τα προβλεπόμενα στο άρθρο 6 του Κανονισμού: «

1. Οι ΔΣΜ καταρτίζουν, σε συνεργασία με τον φορέα ΔΣΔ της ΕΕ, προτάσεις για τους όρους και τις προϋποθέσεις ή τις μεθοδολογίες σύμφωνα με την παράγραφο 2, ή για σχέδια σύμφωνα με την παράγραφο
2. Οι παρακάτω όροι και προϋποθέσεις ή μεθοδολογίες και τυχόν τροποποιήσεις αυτών υπόκεινται σε έγκριση από όλες τις αρμόδιες αρχές: […] ε) η μεθοδολογία της κλίμακας ταξινόμησης κυβερνοεπιθέσεων σύμφωνα με το άρθρο 37 παράγραφος 8.» Σύμφωνα με τα προβλεπόμενα στο άρθρο 37 του Κανονισμού: «[…]
3. Οι ΔΣΜ, με τη συνδρομή του ΕΔΔΣΜ ηλεκτρικής ενέργειας και σε συνεργασία με τον φορέα ΔΣΔ της ΕΕ, αναπτύσσουν μεθοδολογία κλίμακας ταξινόμησης κυβερνοεπιθέσεων έως τις 13 Ιουνίου
4. […] Η μεθοδολογία καθορίζει την ταξινόμηση της σοβαρότητας μιας κυβερνοεπίθεσης σύμφωνα με 5 επίπεδα, εκ των οποίων τα δύο υψηλότερα είναι το «υψηλό» και το «κρίσιμο». Η ταξινόμηση βασίζεται στην αξιολόγηση των ακόλουθων παραμέτρων: α) του δυνητικού αντικτύπου, λαμβανομένων υπόψη των περιουσιακών στοιχείων και των περιμέτρων που εκτίθενται, όπως προσδιορίζονται σύμφωνα με το άρθρο 26 παράγραφος 4 στοιχείο γ)· και β) της σοβαρότητας της κυβερνοεπίθεσης. » Η ΡΑΑΕΥ, εκτελώντας τα καθήκοντα της αρμόδιας αρχής σύμφωνα με το άρθρο 4

(1)του Κανονισμού, θέτει σήμερα σε δημόσια διαβούλευση την κοινή πρόταση όλων των ΔΣΜ σχετικά με τη μεθοδολογία της κλίμακας ταξινόμησης κυβερνοεπιθέσεων σύμφωνα με τα οριζόμενα στο άρθρο 37

(8)του Κανονισμού, η οποία υποβλήθηκε στην Αρχή από την ΑΔΜΗΕ Α.Ε με το υπ’ αριθμ. πρωτ. ΡΑΑΕΥ Ι-397097/17.06.2025 έγγραφο. Οι ενδιαφερόμενοι μπορούν να συμμετέχουν στη διαβούλευση υποβάλλοντας τις απόψεις τους επί του ως άνω κειμένου ηλεκτρονικά στη διεύθυνση info@raaey.gr ή εγγράφως, έως και τη Δευτέρα 28 Ιουλίου 2025. Η ΡΑΑΕΥ, με την επιφύλαξη των διατάξεων της παρ. 3 του άρθρου 5 του Κώδικα Διοικητικής Διαδικασίας (ν.2690/1999, ΦΕΚ Α’ 45), θα δημοσιοποιήσει κατάλογο των συμμετεχόντων στη διαβούλευση καθώς και το περιεχόμενο των σχετικών εγγράφων, με εξαίρεση την περίπτωση κατά την οποία ο συμμετέχων αιτείται τη μη δημοσιοποίηση των στοιχείων του και/ή των απόψεών του. Συνημμένο αρχείο: Cyber-attack classification scale methodology (Αγγλικό κείμενο) ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 CYBER-ATTACK CLASSIFICATION SCALE METHODOLOGY Proposal of the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity, for a cyberattack classification scale methodology in accordance with Article 37

(8)of the Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024 supplementing Regulation (EU) 2019/943 of the European Parliament and of the Council by establishing a network code on sector-specific rules for cybersecurity aspects of crossborder electricity flows ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 1 ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 Table of Contents TITLE 1 General provisions ........................................................................................................... 4 Article 1 Subject matter and scope ......................................................................................................... 4 Article 2 Definitions .............................................................................................................................. 4 Article 3 Principles for cyber-attack classification .................................................................................. 5 TITLE 2 Identification of a reportable cyber-attack ........................................................................ 6 Article 4 Estimation of the root cause ..................................................................................................... 6 Article 5 Determination of the potential impact of the cyber-attack......................................................... 6 Article 6 Estimation of the severity of the cyber-attack ........................................................................... 6 Article 7 Cyber-attack gravity classification ........................................................................................... 8 TITLE 3 Final provisions ................................................................................................................ 9 Article 8 Implementation timeline .......................................................................................................... 9 Article 9 Language................................................................................................................................. 9 Annex I 10 ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 2 ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 TSOS, WITH THE ASSISTANCE OF ENTSO FOR ELECTRICITY AND IN COOPERATION WITH THE EU DSO ENTITY, TAKING INTO ACCOUNT THE FOLLOWING: Whereas

(1)This document sets out the methodology for identifying and classifying reportable cyber-attacks (hereafter referred to as 'Cyber-Attack Classification Scale Methodology’) in accordance with Article 37

(8)of Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024 supplementing Regulation (EU) 2019/943 of the European Parliament and of the Council by establishing a network code on sectorspecific rules for cybersecurity aspects of cross-border electricity flows (hereinafter referred to as ‘NCCS Regulation’).

(2)The Cyber-Attack Classification Scale Methodology takes into account the general principles and goals set out in the:

1. a)NCCS Regulation;
2. b)Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (hereafter referred to as ‘NIS 2 Directive’);
3. c)Regulation (EU) 2019/941 of the European Parliament and of Council of 5 June 2019 on riskpreparedness in the electricity sector and repealing Directive 2005/89/EC (hereafter referred to as ‘Risk Preparedness Regulation’); and
4. d)Regulation (EU) 2019/943 of the European Parliament and of Council of 5 June 2019 on the internal market for electricity (recast) (hereafter referred to as the ‘Electricity Regulation’).

(3)According to Article 37

(8)of the NCCS Regulation, the TSOs, with the assistance of the ENTSO for Electricity, and in cooperation with the EU DSO entity shall develop a Cyber-Attack Classification Scale Methodology by 13 June 2025. For the purposes of this methodology, the term ‘criticality’ in Article 38

(4)of the NCCS Regulation shall be considered equivalent to the term ‘gravity’ in Article 37

(8)of the NCCS Regulation.

(4)For the purpose of identifying cyber-attacks and ensuring compliance with the reporting requirements under Article 38

(4)of the NCCS Regulation and in the absence of a clear definition of "malicious" under the Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (hereinafter referred to as ‘Regulation 2022/2554’), the distinction between "malicious root cause" and "not malicious root cause" is established. The distinction provides essential guidance for entities in determining whether an event qualifies as a ‘cyberattack’ as defined in Article 3

(14)of Regulation 2022/2554. Furthermore, it is crucial in determining the reportability of a cyber-attack, ensuring that events with “not malicious root cause” are excluded from the regulatory definition of a ‘cyber-attack’. The distinction is solely intended for the purpose of affirming the interpretation of the definition of a ‘cyber-attack’ and shall not be extended outside the scope of this methodology. ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 3 ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097

(5)According to Article 19 of the NCCS Regulation, the Union-wide risk assessment report identifies a list of Union-wide high-impact processes and Union-wide critical-impact processes. At the entity level, this Union-wide list serves as the foundation for classifying all assets that support Union-wide high-impact and critical-impact processes in the high-impact or critical-impact perimeters, following the criteria set in Article 26

(4)(c) of the NCCS Regulation. This classification is based on the identified Union-wide high-impact and critical-impact processes that could potentially affect cross-border electricity flows if the asset is compromised according to Article 26

(4)(a)(i) of the NCCS Regulation. SUBMIT THE FOLLOWING PROPOSAL FOR THE CYBER-ATTACK CLASSIFICATION SCALE METHODOLOGY TO ALL NCCS-NCAs TITLE 1 General provisions Article 1 Subject matter and scope

(1)This Cyber-Attack Classification Scale Methodology provides the rules for classifying the gravity of a cyber-attack according to five levels, the two highest levels being ‘high’ and ‘critical’.

(2)It sets out criteria for affected high-impact or critical-impact entities identified according to Article 24 of the NCCS Regulation, to assess whether a cyber-attack at entity level is considered reportable according to Article 38

(4)of the NCCS Regulation. Article 2 Definitions

(1)For the purposes of this Cyber-attack Classification Scale Methodology, the terms and definitions in Article 3 of the NCCS Regulation, Article 6 of the NIS 2 Directive, Article 2 of the Risk Preparedness Regulation and Article 2 of the Electricity Regulation shall apply.

(2)In addition, the following definitions shall apply: (

1. a)‘attacker’ means the threat actor who attempts to perform or perpetuate a cyber-attack. (
2. b)‘estimation’ means the opinion of the affected entity based on internal and external information and findings gathered and available at a given time. The estimation reflects a subjective point of view of the entity and is estimated for the sole purpose of scaling the cyber-attack and shall not be interpreted as binding or infringing any agency of any national authority or jurisdiction. ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 4 ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 (
3. c)‘tactics’ means the reason for an attacker to perform an action, the goal they want to achieve in a certain stage of an attack.

(3)In this Cyber-Attack Classification Scale Methodology, unless the context clearly indicates otherwise, the singular also includes the plural and vice versa. Article 3 Principles for cyber-attack classification

(1)This Cyber-Attack Classification Scale Methodology serves to assess the gravity of a cyber-attack according to five levels specified in Article 7 and Annex I of this Methodology.

(2)This Cyber-Attack Classification Scale Methodology sets out the rules for classification of the gravity of a cyber-attack in accordance with the following parameters: a. the potential impact considering the assets and perimeters exposed pursuant to Article 5 that are determined in accordance with Article 26

(4), point (c) of NCCS Regulation; and b. the root cause estimation of the cyber-attack pursuant to Article 4 of this Methodology; and c. the severity of the cyber-attack pursuant to Article 6 of this Methodology. ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 5 ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 TITLE 2 Identification of a reportable cyber-attack Article 4 Estimation of the root cause

(1)Entities shall provide an estimation of the root cause of the event, taking into account that: • A malicious root cause means that the origin of the event is any human intention to deliberately cause harm or damage. • A not malicious root cause means that the origin of the event is without any human intention to deliberately cause harm or damage. • An uncertain root cause means that the origin is not clear or cannot yet be categorised.

(2)The event shall be considered a cyber-attack by the entity when it is estimated to have a malicious or an uncertain root cause.

(3)In case the root cause is estimated as uncertain, the entity shall continue to evaluate the root cause.

(4)In the case where a “not malicious” root cause is assessed without any doubt, the entity shall not consider the event as reportable according to article 38

(4)of the NCCS Regulation. Article 5 Determination of the potential impact of the cyber-attack

(1)The entity shall determine the potential impact of the cyber-attack as follows:

1. a)Low potential impact: Any asset affected by the cyber-attack belongs to neither high-impact nor critical-impact perimeter and cannot directly reach any assets in a high-impact or critical-impact perimeter.
2. b)High potential impact: i. At least one asset affected by the cyber-attack belongs to the high-impact perimeter and none of them belongs to the critical-impact perimeter; or ii. at least one asset affected by the cyber-attack can directly reach an asset belonging to the high-impact perimeter and not the critical-impact perimeter.
3. c)Critical potential impact: i. At least one asset affected by the cyber-attack belongs to the critical-impact perimeter; or ii. at least one asset affected by the cyber-attack can directly reach an asset belonging to the critical-impact perimeter. Article 6 Estimation of the severity of the cyber-attack

(1)The entity shall estimate the severity of the cyber-attack:

1. a)A cyber-attack with low severity means that the attacker is trying to get access to one or more assets;
2. b)A cyber-attack with a high severity means that the attacker has at least limited access to one or more assets; ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 6 ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097
3. c)A cyber-attack with a critical severity means that more than one asset is impacted by lateral movement, or the attacker is able to interrupt the process or perpetuate actions on one or multiple assets to destabilise the entity. In order to perform this estimation, entities may use paragraph

(2).

(2)The entity can evaluate the position of the attacker within the tactics for the ICS and Enterprise MITRE ATT&CK framework1, based on the worst-case scenario and their forecast of the upcoming situation:

1. a)Low severity: detection of an attempt to perform Reconnaissance, obtain Resource Development, gain Initial access.
2. b)High severity: detection of an attempt to perform Execution, Persistence, Privilege escalation, Defence evasion, Credential access, Discovery.
3. c)Critical severity: detection of an attempt to perform Lateral Movement, Collection, Command and control, Exfiltration, Inhibit Response Function, Impair Process Control, or Impact. 1 MITRE | ATT&CK Enterprise Tactics (https://attack.mitre.org/tactics/enterprise/) MITRE | ATT&CK ICS Tactics (https://attack.mitre.org/tactics/ics/) ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 7 ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 Article 7 Cyber-attack gravity classification

(1)The entity shall assess the gravity of the cyber-attack by combining: (

1. a)the result of the determination of the potential impact of the cyber-attack pursuant to Article 5 of this Methodology; and (
2. b)the result of the estimation of the severity of the cyber-attack pursuant to Article 6 of this Methodology.

(2)The level of gravity shall be considered as: (

1. a)“critical” if the potential impact is determined to “critical” and the severity is estimated as “critical”; or (
2. b)“high” if: i. the potential impact is determined to “critical”, and the severity is estimated as “high”; or, ii. the potential impact is determined to “high”, and the severity is estimated as “critical” or “high”; or (
3. c)“important”, “medium” and “to follow” according to the criteria set out in Annex I of this Methodology.

(3)Every time one of the following parameters change, the entity shall repeat the steps to assess the gravity of the cyber-attack pursuant to TITLE 2: (

1. a)a change in the estimation of the root cause pursuant to Article 4 of this Methodology; or (
2. b)a change in the determination of the potential impact pursuant to Article 5 of this Methodology; or (
3. c)a change in the estimation of the severity pursuant to Article 6.1 of this Methodology. ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 8 ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 TITLE 3 Final provisions Article 8 Implementation timeline

(1)This methodology shall be implemented according to the timeline set out in the NCCS Regulation.

(2)Entities pursuant to Article 24

(6)of the NCCS Regulation must use this methodology to discern whether a cyber-attack is reportable under the NCCS Regulation. Article 9 Language The reference language for this Cyber-attacks Classification Scale Methodology Proposal shall be English. For the avoidance of doubt, where required by relevant national competent authorities for the NCCS Regulation, the TSOs and DSOs of the relevant Member State, in cooperation, shall translate this Cyberattacks Classification Scale Methodology Proposal into their national language(s). In the event of inconsistencies between the English version published by TSOs, with assistance of ENTSOE, and in cooperation with EU DSO Entity, pursuant to Article 8

(9)of the NCCS Regulation and any translated version in another language, the relevant TSOs and DSOs shall, in accordance with national legislation, provide the relevant national competent authorities for the NCCS Regulation with an updated translation of the Cyber-attacks Classification Scale Methodology Proposal. ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 9 ΣΥΝΗΜΜΕΝΟ Ρυθµιστική Αρχή Αποβλήτων Ενέργειας και Υδάτων 17/06/2025 Α. Π.: I-397097 Annex I Low PI High PI Critical PI Low Severity To follow gravity Medium gravity Important gravity High Severity Medium gravity High gravity High gravity Critical Severity Severity of the Attack Potential Impact Important gravity High gravity Critical gravity ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 10 Position in the kill chain Event Art.4 Malicious Yes or Not sure No Cyberattack Outlook / worst case scenario Art.5 Potential Impact High or Critical Low Art.6 Severity High or Critical Low Art.7 Incident Gravity To follow Medium or Important High or Critical Reportable Cyber-Attack Not reportable To be repeated - every change (Art. 7.3) Low PI High PI Critical PI Low Severity the attackers are trying to get access to one or more asset. To follow gravity Medium gravity Important gravity High Severity the attackers have at least limited access to one or more assets Medium gravity High gravity High gravity Critical Severity Reconnaissance Ressource Development Initial acces Execution Persistence Privilege escalation Defense Evasion Credential access Discovery Lateral Movement Collection Command and control Exfiltration Inhibit Response Function Impair Process Control Impact Severity of the Attack Tactics / Trying to Potential Impact more than one assets are impacted by lateral movement, or [the attackers] appear to be able to interrupt the process or perpetuate actions on one or multiple assets to destabilize the entity Important gravity High gravity Critical gravity ENTSO-E aisbl | Rue de Spa, 8 | 1000 Brussels | info@entsoe.eu | www.entsoe.eu | @entso_e 11