Network Code on Cybersecurity

Security in cross-border electricity

EU NCCS entered into force in 2024 and is directly applicable across the EU with binding cybersecurity rules for entities in the EU electricity sector.

NCCS application depends on the national transposition of EU NIS2 and EU NCCS builds on NIS2 by specifying sector-specific obligations and relies on key elements of NIS2 (designation of entities, supervisory authorities, risk management frameworks) that must exist in national law.

Specifically, NCCS establishes binding sector-specific cybersecurity rules for the EU electricity sector. It mandates risk-based security measures, coordinated threat responses, and regulatory oversight across borders to enhance the resilience of critical energy infrastructure:

• Entities: Applies to electricity TSOs (Transmission System Operator), DSOs ( Distribution System Operator), significant generation assets, and ICT service providers with high or critical impact.
• Cybersecurity: Energy entities must implement comprehensive cybersecurity measures, including risk management, incident response, supply chain controls, compliance verification, and information sharing.
• Controls: Minimum and advanced cybersecurity controls must be implemented depending on entity impact level, including for ICT supply chains.
• Timeline: Gradual rollout through 2025–2026, starting with provisional designations and risk assessments, followed by compliance deadlines (12–24 months).
• Supervision: Compliance monitored by national competent authorities, supported by ENTSO-E, EU DSO Entity, and CSIRTs.

NCCS establishes a national and coordinated oversight structure for the EU electricity sector.

• Member States must designate a competent regulatory or energy authority by 2024. Art. 4
• That authority coordinates with national CSIRTs and cybersecurity agencies. Art. 5
• Compliance with NCCS may serve as evidence of NIS2 compliance, and vice versa. Recital 15

EU NCCS imposes a broad set of obligations on designated high-impact and critical-impact entities to strengthen cybersecurity across the electricity sector.

Energy entities

NCCS applies to entities that are designated by authorities as high-impact or critical-impact. Art. 24

National competent authorities are responsible for designating high-impact and critical-impact entities based on ECII criteria. Art. 24(1) Criteria take into account the entity’s relevance for the security of cross-border electricity flows, the potential impact of a disruption, and system stability.

While these entity types are listed in the NCCS, they are not automatically covered. Only those entities explicitly designated by national authorities fall under its binding cybersecurity obligations.

The classification of electricity entities as high or critical-impact under NCCS is based on their potential to disrupt cross-border electricity flows in the event of a cyber incident. Determination of criticality is made by national authorities using ECII, Electricity Cybersecurity Impact Index. Art. 24

NCCS and NIS2

Entities in both regulations

Several entities in the electricity sector are subject to both the NCCS and the NIS2 Directive. While NIS2 sets general cybersecurity obligations for essential and important entities, NCCS introduces sector-specific requirements for high- and critical-impact actors. In cases of overlap, Recital 15 clarifies that compliance with one regulation may serve as evidence of compliance with the other.

NCCS-specific obligations include a classification based on the Electricity Cybersecurity Impact Index (ECII) Art. 24, implementation of minimum and advanced cybersecurity controls, including supply chain measures Art. 29, 33 and the development of a sector-specific Cybersecurity Management System and a mapping matrix aligned with international standards .Art. 32, 34

Deepened requirements

NCCS complements and, in some areas, deepens NIS2 requirements, affecting primarily TSOs, DSOs, and ICT service providers that operate critical systems in the electricity sector. These fall under the scope of both NIS2 and the NCCS due to their essential role in cross-border electricity flows and their designation as high- or critical-impact entities under Art. 2(1) NCCS and Annex I of NIS2.

NCCS obligations

The binding obligations introudced by the NCCS include risk-based security management, detailed reporting requirements, independent audits, and mandatory controls (many of which go beyond NIS2 in scope and specificity).

Designated entities must submit a comprehensive report to their national authority (e.g. BNetzA in Germany) within twelve months of classification. Art. 27

• Selected and implemented mitigation controls Art. 26(5)
• Risk estimates for all Union-wide critical-impact processes, based on the Art. 19(2) matrix
• A list of critical ICT providers for critical-impact processes

Critical-impact entities must demonstrate compliance with cybersecurity controls and management systems within 24 months via either national verification schemes or third-party audits. Art. 31 NCCS obligations may be recognised as equivalent to NIS2 compliance where applicable. Recital 15 Art. 17

Cybersecurity Management System (CSMS)

All high-impact and critical-impact entities must implement a cybersecurity management system (CSMS) aligned with European and international standards. This system serves as the NCCS equivalent of an ISMS and forms the core of each entity’s risk mitigation obligations. Art. 28

TSOs are required to develop harmonised cybersecurity risk assessment frameworks at EU, regional, and national level by March 2025. Risks need to include supply chains, legacy systems, cascading effects and single supplier dependencies, and apply a common EU risk impact matrix to evaluate impact and likelihood. Art. 18

Although many national authorities have not yet designated entities or initiated formal compliance processes, the obligation under Art. 18 remains binding.

Responsibilities for cybersecurity risk assessments under Art. 19–21 and Art. 26 are divided across EU, national, and entity level. The table below outlines who is responsible at each level, the legal basis, and how each assessment feeds into the broader regulatory framework.

Security requirements

The NCCS defines detailed compliance obligations for high- and critical-impact entities. These include the implementation of technical controls, the setup of a cybersecurity management system, and structured risk management processes. Obligations follow a regular cycle and are aligned with thresholds and responsibilities. Art. 24–34

Entities must perform regular structured risk management, consisting of context establishment, risk assessment, treatment, and acceptance. These processes must be based on a risk impact matrix developed at EU level and include supply chain and legacy system considerations. Art. 26

The selected risk mitigation controls must be reported to the competent authority within twelve months of designation and every three years thereafter. Compliance with the CSMS and associated controls must be demonstrated through independent audits or national verification schemes. Art. 27, 31

Assets and impact

High-impact and critical-impact assets

NCCS defines a critical asset as any asset essential to the operation of the electricity system, including ICT systems, data, and services. Art. 3(2) At the entity level these form the foundation of cybersecurity risk management. NCCS distinguishes between high-impact and critical-impact assets based on the severity of potential disruption to cross-border electricity flows.

A high-impact asset is required for executing a high-impact process, defined as process exceeding the high-impact threshold. Art. 19(3)(b), 3(25), 3(26) These assets are located within a high-impact perimeter, which defines the area where minimum cybersecurity controls apply. Art. 3(27)

A critical-impact asset is necessary for a critical-impact process. Art. 2(4), 2(7) These assets are included in a critical-impact perimeter, subject to advanced cybersecurity controls. Art. 2(6) Entities identified as high- or critical-impact by national authorities must conduct risk management for all assets in these perimeters. Art. 26(2)

Asset classifications are based on the electricity cybersecurity impact indices and thresholds defined in Art. 19 and referenced in Art. 3. These thresholds determine whether a process qualifies as high-impact or critical-impact, guiding the identification of corresponding assets and the application of minimum or advanced cybersecurity controls.

Critical processes

Critical-impact processes are defined as business operations whose ECII scores exceed the critical threshold. Art. 2(7), 19(3), 24(1) They will be identified in the EU cybersecurity risk assessment, the first step of the NCCS risk cycle that functions as EU-level business impact assessment. Art. 19

The supporting document by ENTSO-E and the EU DSO Entity provides methodological guidance with impact metrics related to frequency, voltage, generation capacity, and restoration capability. However, it does not establish a formal list of critical processes as this list will be adopted as part of the Union-wide cybersecurity risk assessment report. Art. 19(3)

According to the NCCS, the list of Union-wide critical-impact processes will be the basis for designating critical-impact entities Art. 24(1), defining the scope of entity-level risk assessments Art. 26(3) and reporting of risk levels. Art. 27 (2) It also plays a role in crisis management planning Art. 41(9) and a provisional version may be issued to guide voluntary early compliance. Art. 48 (4)

Implications for upstream suppliers

While the NCCS formally applies only to designated entities, its implications extend to upstream suppliers, including manufacturers of ICT components, software vendors, and service providers due to the comprehensive security measures required by operators across the full lifecycle of ICT products, services, and processes. Art. 33(2)

Responsibility for compliance with Art. 33 requirements lies with the operator, not the supplier. Operators must translate NCCS obligations into their procurement and supplier management.

Consequently, suppliers in the energy sector may be required to meet compliance expectations, such as providing technical assurances, undergoing security certifications, or disclosing development procedures even though they are not directly regulated under the NCCS.

Incident reporting

Reporting obligations

EU NCCS aligns with the reporting obligations under Art. 23 EU NIS2 and introduces additional requirements for high-impact and critical-impact entities. Where a significant incident is reported under Art. 23 EU NIS2 and the notification includes the relevant information required by the NCCS, this satisfies NCCS reporting obligations. Art. 38

Additionally, each high-impact and critical-impact entity must, within twelve months after its identification and then every three years, submit a report to the competent authorities. Art. 24(6) Art. 27

Incident notifications submitted under Art. 23 EU NIS2 are considered sufficient for NCCS purposes, provided they include all information required under Art. 27 and 38 of NCCS.

Risk report

Beyond the incident reporting, each designated high- or critical-impact entity must submit a cybersecurity risk report to the competent authority. This report must contain:

• a list of the selected mitigation controls and their implementation status Art. 26(5)
• an estimate of residual risks to confidentiality, integrity, and availability using the risk impact matrix defined in Art. 19(2)
• a list of critical ICT service providers involved in the operation of critical-impact processes. Art. 27

The first risk report must be submitted within twelve months of the entity’s designation (by the national competent authority) and must be updated every three years thereafter. Art. 24(6), 27

Supply chain

NCCS requires high-impact and critical-impact entities to address ICT supply chain risks in their cybersecurity risk assessments. Art. 18(2) Based on these assessments, binding minimum and advanced cybersecurity controls must be developed and implemented. Art. 33

Security in the supply chain

Minimum and advanced cybersecurity controls must be implemented across the entire lifecycle of ICT products, services, and processes. The supply chain controls must be developed by the TSOs, with the assistance of ENTSO-E and in cooperation with the EU DSO Entity: Art. 33(1)

• Background checks on supplier personnel (if permitted), secure-by-design development principles, enforcement of zero-trust architectures, access restrictions, contractual safeguards, audit rights, and traceability of security requirements across the supply chain lifecycle. Art. 33(2)(a)
• Entities must also consider lock-in risks, ensure supplier diversification, and incorporate results from EU-wide coordinated risk assessments into procurement decisions. Art. 33(2)(b)–(f)
• All requirements must be applied in accordance with public procurement principles or based on tailored specifications derived from entity-level risk assessments. Art. 33(3)
• All supply chain controls become binding for procurement processes launched six months after the controls’ adoption or update Art. 33(5)
• Supply chain controls must be revised regularly based on regional risk assessments. Art. 33(6)

Critical-impact entities are additionally required to verify that critical ICT components meet the defined cybersecurity specifications through either EU certification schemes or internal assurance measures, with sufficient depth to mitigate identified risks. Art. 33(4)

Authorities

Each Member State is required to designate a National Competent Authority (NCCS‑NCA) responsible for overseeing high‑ and critical‑impact entities bound to the NCCS. The designation must occur no later than six months after the regulation enters into force, with the authority’s name and contact details notified to the Commission, ACER, and the Electricity Coordination Group. Art. 5

National competent authorities are responsible for designating high-impact and critical-impact entities based on ECII criteria. Art. 24(1) This designation process begins once the EU-wide ECII thresholds are adopted. Member States may provisionally notify candidate entities based on provisional ECII thresholds published by ENTSO-E and the EU DSO Entity. Art. 48(3)

Supervision

NCCS obliges Member States to ensure that national competent authorities have comprehensive supervisory powers over high-impact and critical-impact entities in the electricity sector: on-site inspections and off-site supervision, random checks, regular or risk-based security audits, and targeted assessments. Entities must provide all necessary documentation and evidence.

National authorities may establish a national verification scheme to verify compliance by critical-impact entities. This scheme may involve inspections, independent audits, or peer reviews, and must be supervised by the competent authority. All audits must follow strict procedural and expertise-related requirements to ensure independence, sectoral knowledge, and confidentiality. Art. 25

National authorities for NCCS may also establish a national verification scheme to assess compliance with minimum and advanced cybersecurity controls. Art. 33

Audits

Compliance with cybersecurity must be verified through regular audits, reviews or inspections. Each high- or critical-impact entity must ensure that the entire verification scope is covered at least once every three years, with partial audits taking place annually. Art. 25(2)

Entities can choose to demonstrate compliance either by participating in a national verification scheme or by undergoing an independent third-party audit. Art. 25(1), 25(2), 29(3), 31(2) Where a national verification scheme is used, the authority must report annually to ACER on the frequency of inspections conducted. Art. 25(3)

In addition, critical-impact entities are required to demonstrate compliance with the relevant cybersecurity controls within 24 months of their adoption or update. Art. 31(1)

EU Monitoring

EU ACER, the Agency for the Cooperation of Energy Regulators, is responsible for monitoring the implementation of the NCCS in cooperation with ENISA, ENTSO-E, and the EU DSO entity, and must publish a report at least every three years reviewing implementation status, identifying gaps, and recommending improvements. Art. 12(2)

Entities must submit relevant data to ACER, which may issue guidance on the process and indicators used for monitoring. Art. 12(3,5,6)

NCCS obligates ACER, in cooperation with ENISA, to publish a non-binding cybersecurity benchmarking guide by June 2025. Within twelve months, NRAs must assess whether cybersecurity investments are effective, efficient, and integrated into procurement processes. Art. 13(1, 2) Results are confidential but shared with competent authorities, ACER, ENISA, and the European Commission. Art. 13(5)

ECII thresholds

Provisional ECII thresholds have been developed and published by ENTSO-E and the EU DSO Entity, allowing Member States to identify and notify candidate entities. Formal designations will follow once the final ECII is adopted on the basis of a Union-wide risk assessment.

Literature

1. European System of Financial Supervision, European Central Bank, 2024.
2. ESAs publish first set of rules under DORA for ICT and third-party risk management and incident classification, European Securities and Markets Authority, 17.01.2024.
3. Cybersecurity benchmarking guide, EU ACER, 13 June 2025
4. Regulation (EU) 2019/943 on XXXTITLEXXX, 5 June 2019

Sources

1. Regulation (EU) 2024/1366 on XXXTITLEXXX, 11 March 2024