LEGAL AND REGULATORY FRAMEWORK FOR ENSURING CYBERSECURITY IN THE ENERGY SECTOR

Abstract

The article conducts a comprehensive study of modern regulatory and technical approaches to ensuring cybersecurity in the energy sector amidst large-scale digitalization and the rise of hybrid threats. The relevance of the research is driven by the active convergence of information technology (IT) and operational technology (OT), which opens new attack vectors against industrial automation and control systems (IACS), such as SCADA, DCS, and PLCs. Special attention is paid to the specifics of protecting Ukraine's critical infrastructure, whose power grids have already been targets of sophisticated attacks, such as CrashOverride/Industroyer, necessitating immediate system hardening in line with international standards.
The study provides a detailed overview of key international standards, including the ISA/IEC 62443 series, which implements the concept of zones, conduits, and security levels (SL 1–4) to minimize the risks of sabotage and interference in energy facility operations. The impact of the NIS2 Directive is analyzed, as it establishes mandatory requirements for risk management, supply chain security, and leadership accountability for entities of high criticality. The role of NERC CIP standards in ensuring the reliability of the bulk electric system and the flexible approach of NIST CSF 2.0 combined with the C2M2 maturity model are examined separately.
Significant attention is devoted to the protection of nuclear energy based on IAEA NSS-17-T and IEC 62645 standards, where the priority of integrity and availability over confidentiality is critical to preventing radiation incidents. The article analyzes the graded approach to protecting sensitive digital assets (SDA) and the deterministic isolation of critical systems as per the NEI 08-09 model.
The research results highlight future challenges, particularly the "quantum threat" and the "harvest now, decrypt later" (HNDL) adversary strategy, which requires a transition to post-quantum cryptography (PQC). The potential of artificial intelligence (tools like SecureAI) for automated anomaly detection in industrial protocols such as Modbus/TCP and OPC UA is highlighted, along with the need to integrate AI risk management through the NIST AI RMF. The conclusions emphasize that for Ukraine, the harmonization of national DSTU standards with European norms is a necessary condition for the cross-border synchronization of power grids and ensuring national resilience.