Electronics Guide

Consequence Is Physical and Sometimes Irreversible

Most information security reasoning ranks confidentiality first. In the power system the ranking inverts: availability and integrity dominate, and confidentiality matters mainly because reconnaissance data assists a later attack. A relay that trips when it should not trip removes load. A relay that fails to trip when it should leaves a fault energized. Both outcomes follow from an integrity failure rather than a disclosure.

Some failures do not reverse. Closing a generator breaker onto a grid that is out of phase with the machine applies a torque impulse to the shaft and a current surge to the windings; the Idaho National Laboratory demonstrated in 2007 that repeated out-of-phase reclosing driven through the control system could destroy a diesel generator, an experiment now generally known by its Aurora code name. Large power transformers have manufacturing lead times now measured in years rather than months, so an attack that damages one converts a cyber incident into a capacity problem that persists long after the network has been cleaned.

The timescales of the physical system also constrain the defense. A distance relay must decide within a few electrical cycles. There is no room in that budget for an operator to review an alert, and little room for cryptographic negotiation, which is why authentication for protection traffic takes a different form from authentication for supervisory traffic.

An Installed Base That Outlives Its Software Support

Substation equipment is specified for service lives of twenty to forty years. Firmware support rarely lasts that long, and the operational cost of a change is high: modifying a protective relay generally requires a settings review, coordination checks against neighboring devices, and in many utilities a witnessed test. The result is a population of devices running old firmware for defensible engineering reasons rather than through neglect.

Compensating controls therefore carry more weight in this sector than patching does. Where a vulnerable device cannot be updated, the practical answer is to remove its exposure: place it behind an access control point, restrict which hosts may originate a session to it, and monitor the traffic that does reach it. That approach is standard practice across operational technology generally and is treated in more depth under industrial control security.

Two Regulatory Worlds Meeting at the Substation Fence

North American regulation divides the grid in a way that shapes the whole security picture. The NERC Critical Infrastructure Protection standards are mandatory and enforceable under Federal Energy Regulatory Commission oversight, but they apply to the bulk electric system, which is broadly the transmission network at 100 kV and above together with generation above defined thresholds. Distribution feeders, advanced metering infrastructure, and the overwhelming majority of distributed energy resources fall outside that scope.

The consequence is a sharp asymmetry. A transmission substation operates under audited, penalty-backed obligations with documented evidence for every configuration change. A rooftop inverter a few kilometers away, connected to a vendor cloud service over a residential internet connection, operates under no comparable regime. Aggregate enough of the second category and it becomes capable of the kind of disturbance the first category exists to prevent. That gap, rather than any single vulnerability, is the structural weakness of the modern distribution system.

NERC Critical Infrastructure Protection

The CIP standards operate on a classification and control model. CIP-002 categorizes bulk electric system cyber systems as high, medium, or low impact, and that categorization determines which of the remaining standards apply and how stringently. A control center performing real-time operations inherits the full obligation; a small substation may fall under a substantially reduced baseline. The remaining standards address security management controls, personnel and training, electronic security perimeters and interactive remote access, physical security of cyber systems, system security management such as port and patch control, incident reporting, recovery planning, configuration change management and vulnerability assessment, information protection, protection of the real-time data exchanged between control centers, and supply chain risk.

Low-impact systems are governed almost entirely by CIP-003, whose Attachment 1 sets a short baseline of required policies and controls. That baseline is no longer trivial. CIP-003-9 became enforceable on April 1, 2026 and adds vendor electronic remote access security controls at low-impact assets, obliging the entity to be able to determine when such access is occurring, to disable it, and to detect malicious communications carried over it. The change matters disproportionately for utility-scale solar, wind, and storage sites, which are commonly categorized as low impact and commonly maintained through a manufacturer's remote connection.

Two later additions matter particularly for equipment selection. CIP-013 obliges utilities to address vendor security within procurement, including assurance of software integrity and authenticity and control of vendor-initiated remote access, which pushes security requirements into the purchase specification rather than leaving them to commissioning. CIP-015-1, approved by FERC in Order No. 907 on June 26, 2025, requires internal network security monitoring of traffic within the protected network rather than only at its boundary. It applies to high-impact bulk electric system cyber systems and to medium-impact systems with external routable connectivity, and compliance is due thirty-six months after the effective date at control centers and sixty months after it elsewhere. FERC also directed NERC to extend the requirement to electronic access control or monitoring systems and physical access control systems located outside the electronic security perimeter; the revision drafted for that purpose, CIP-015-2, cleared its final industry ballot in March 2026. The requirement converts network visibility hardware, such as taps and span-capable switches, from an optional refinement into a compliance artifact. The hardware implications are treated further under industry-specific requirements.

Physical security appears in the same framework. CIP-014 requires transmission owners to identify stations whose loss could cause instability or cascading outages and to develop physical security plans for them, a standard adopted after the 2013 rifle attack on the Metcalf substation in California. Grid security in practice is rarely purely cyber or purely physical, because an attacker with physical access to a substation yard also has access to the ports on the devices inside it.

Guidance Beyond the Mandatory Scope

Because the mandatory standards stop at the bulk system, distribution-side and distributed-resource security is driven by guidance, state regulators, and utility procurement policy. NIST Interagency Report 7628, Guidelines for Smart Grid Cybersecurity, remains the reference architecture for the domain, organizing the grid into logical interface categories and assigning confidentiality, integrity, and availability requirements to each. The Department of Energy's Cybersecurity Capability Maturity Model gives utilities a self-assessment structure for measuring program maturity rather than compliance with a control list.

In Europe the picture changed with the NIS2 Directive, which broadened the set of regulated entities and tightened incident reporting obligations across essential sectors including electricity. A sector-specific network code on cybersecurity for cross-border electricity flows, adopted by the European Commission in 2024, adds requirements aimed at the entities whose failure would propagate across borders. Sector information sharing runs through the Electricity Information Sharing and Analysis Center in North America and equivalent bodies elsewhere, which distribute indicators and advisories faster than formal reporting channels do. Broader regulatory context appears under cybersecurity regulations.

Why Power System Protocols Carry No Native Security

DNP3, IEC 60870-5-101 and its network variant 60870-5-104, Modbus, and the IEC 61850 services were all designed for networks assumed to be private. None of them authenticates the sender in its base form. On a serial link between a control center and a remote terminal unit that assumption was defensible, because compromising the link required physical access to it. Once the same protocol runs over a routable network, any host able to reach the device can issue a command that the device will execute, because the device has no means of distinguishing one source from another.

Replacing these protocols is not practical. They are embedded in millions of devices, in engineering tools, and in decades of utility practice. The IEC 62351 series therefore takes the retrofit approach: it defines security services that wrap or extend the existing protocols rather than substituting new ones.

Structure of the Series

The parts divide along protocol and function. Part 3 secures profiles that run over TCP/IP by specifying the use of transport layer security, which covers 60870-5-104 and the network variants of DNP3. Part 4 addresses profiles that include the manufacturing message specification, which is the client-server layer of IEC 61850. Part 5 defines application-layer authentication for the 60870-5 family and its derivatives, the mechanism that appears in DNP3 as secure authentication. Part 6 covers the IEC 61850 peer-to-peer profiles. Part 7 defines network and system management data objects so that the security state of the equipment can itself be monitored through the same information model as the power system. Part 8 specifies role-based access control, and part 9 addresses key management and the certificate infrastructure without which the other parts cannot be operated at scale.

Part 9 deserves emphasis, because key management is where retrofitted security programs most often stall. A utility with tens of thousands of field devices, each needing an identity certificate with a defined lifetime, needs enrollment, renewal, and revocation processes that work on equipment installed in unattended locations with intermittent connectivity. The cryptography is settled; the lifecycle logistics are the difficult part.

The Latency Constraint on Protection Traffic

IEC 61850 defines a generic object oriented substation event service, universally called GOOSE, for peer-to-peer protection signaling, and a sampled values service for digitized instrument transformer data. The performance class for a protection trip allows a transfer time of about three milliseconds. That budget forbids session negotiation and leaves very little room for asymmetric cryptography on the message path.

Part 6 responds by prioritizing authentication over confidentiality. A GOOSE message that carries a trip signal does not need to be secret, since an adversary who can read it has already reached the station bus; it needs to be provably from the relay that claims to have sent it, and provably not a replay. Message authentication codes computed with symmetric keys satisfy that requirement within the timing budget in a way that encryption with per-session negotiation does not. The design decision illustrates a general rule for the sector: security measures that violate the protection timing budget will be disabled in the field, so the standards accommodate the physics rather than the reverse.

DNP3 Secure Authentication

DNP3, published as IEEE 1815, incorporates secure authentication directly. The mechanism is a challenge-response exchange: when an outstation receives a message belonging to a critical function, such as a control operation, it challenges the master, which must reply with a message authentication code computed over the challenge and the original request using a shared session key. An aggressive mode allows the authentication data to accompany the request, avoiding the extra round trip where latency matters, at some cost in replay resistance that the design mitigates with sequence numbers.

Secure authentication protects integrity and origin, not confidentiality; where confidentiality is also needed, it is layered with transport security. Deployment has been uneven, largely because enabling it requires key management across the outstation population and coordinated configuration on both ends, which returns to the same lifecycle problem that part 9 of IEC 62351 addresses.

How Digitalization Changes the Attack Surface

A conventional substation carries analog signals on copper from instrument transformers to relays and hardwired contacts from relays to breakers. A digital substation replaces much of that copper with Ethernet. Merging units digitize current and voltage at the primary plant and publish sampled values onto a process bus; relays subscribe to those streams, and trip commands travel back as GOOSE messages rather than as contact closures. The benefits are real, including reduced copper, simplified testing, and freedom from current transformer saturation on long leads.

The security consequence is that measurement and tripping now depend on a shared network. An adversary with a foothold on the process bus is positioned to inject sampled values that misrepresent the primary current, or to publish GOOSE frames with a higher state number than the legitimate publisher so that subscribers accept them in preference. Neither manipulation requires access to the primary plant. The mitigation combines authentication under IEC 62351-6, strict separation of the process bus from the station bus and from any routable network, port security and disabled unused ports on the substation switches, and monitoring for anomalies in publisher identity and message counters.

Time synchronization becomes a second dependency. Sampled values are only comparable across merging units if the units share a time reference, typically distributed by precision time protocol under the IEC 61850-9-3 power utility profile. Manipulating the time reference corrupts the phase relationship between measurements without altering any individual sample, which makes it a subtle and effective attack. Redundant time sources, holdover oscillators with sufficient stability, and monitoring for step changes in the offset are the usual defenses.

Perimeters, Remote Access, and the Vendor Path

The electronic security perimeter is the organizing concept of substation network defense: a defined boundary through which all routable communication into the protected devices must pass, with the access points enumerated and controlled. Interactive remote access is required to traverse an intermediate system so that no external session terminates directly on a control device, with encryption of the session and multi-factor authentication of the user.

Vendor access is the recurring difficulty. Protective relays, inverters, and station controllers are complex products whose manufacturers provide commissioning and diagnostic support, and the commercial pressure to grant a persistent connection is considerable. Persistent vendor tunnels are a well-documented initial access route in operational technology incidents generally. The defensible pattern grants access on request rather than standing, brokers it through the utility's own intermediate system, restricts it to the specific device and time window required, and records the session.

Legacy conversion equipment deserves separate attention. Serial-to-Ethernet gateways and protocol converters exist precisely to expose old devices to new networks, and they frequently run minimal embedded operating systems with weak or absent authentication. They are among the most consequential devices in a substation and among the least examined.

Protection Settings as a Target

The most sensitive data in a substation is not measurement data. It is the settings file. A protective relay's behavior is entirely determined by its pickup thresholds, time-current characteristics, and coordination settings, and those settings are the product of a system study that considered the whole feeder or transmission corridor. An adversary who can alter settings does not need to send a single trip command: desensitizing a relay leaves a future fault uncleared, and oversensitizing one causes it to trip on normal load or on a fault that should have been cleared by a downstream device.

This is a slow attack with a long latent period, and it is difficult to detect by network monitoring because a settings change looks like ordinary engineering traffic. The defenses are configuration management and integrity verification: a baseline of every device's settings, digital signature or hash verification of settings files, change control that requires the same review as the original study, and periodic comparison of the device's live configuration against the recorded baseline. Configuration change management under CIP-010 exists for exactly this reason, and the practice is worth adopting whether or not a given substation falls within the mandatory scope.

The Mandated Communication Interface

IEEE 1547-2018 changed the security posture of distributed energy resources as a side effect of a reliability decision. The standard requires each resource to provide a local communication interface supporting at least one of three protocols: SunSpec Modbus, IEEE 1815, or IEEE 2030.5. The purpose is to let the interconnecting utility read status and adjust the smart inverter functions the standard requires, including volt-var and volt-watt response and the applicable ride-through settings. The effect is that every new interconnection is now, by design, a remotely readable and remotely configurable device.

The three protocols differ substantially in what they offer. IEEE 2030.5 was specified with mutual transport layer security and certificate-based device identity, and the Common Smart Inverter Profile developed for California's Rule 21 defines the supporting public key infrastructure, which makes it the strongest of the three when implemented as written. SunSpec Modbus, by contrast, inherits Modbus's complete absence of authentication and depends entirely on the security of the local network it runs on. Since the standard permits any of the three, the security of a given interconnection depends on a choice made for commercial reasons at the time of installation. Interconnection requirements themselves are covered under grid integration standards.

Aggregation Concentrates What Regulation Disperses

Individually, a residential inverter is insignificant to the grid. The security question is created by aggregation. A distributed energy resource management system or a commercial aggregator may hold dispatch authority over hundreds of megawatts spread across tens of thousands of sites, and FERC Order No. 2222 deliberately opened wholesale markets to such aggregations. The aggregate is a bulk-scale resource. The control path to it is a cloud platform whose individual endpoints fall below every regulatory threshold.

An adversary who compromises the aggregation platform does not need to reach any inverter directly. The platform will reach them all, using credentials the inverters are configured to trust, over an authenticated and encrypted channel functioning exactly as designed. Simultaneous curtailment of a large aggregation is a generation loss event; simultaneous manipulation of reactive power commands is a voltage event. Both are ordinary uses of the platform's legitimate functionality.

The mitigations are architectural rather than cryptographic. Rate limiting on the number of devices any single command may address, staggered execution so that a dispatch cannot become instantaneous across a fleet, independent verification of large aggregate commands against expected system conditions, and device-side bounds that refuse commands outside a locally configured envelope regardless of who signed them all reduce the blast radius. The principle is that a device should decline to do something physically unreasonable even when instructed by an authenticated party.

Settings, Firmware, and Coordinated Response

Ride-through and trip settings are the inverter equivalent of relay settings, and their coordinated manipulation is the most consequential attack available at the distribution edge. IEEE 1547-2018 replaced the earlier trip-first philosophy with mandatory voltage and frequency ride-through precisely because simultaneous disconnection of distributed generation during a system disturbance amplifies that disturbance. Reversing those settings across a large population would restore the failure mode the standard was written to eliminate.

Two events in California demonstrate the physical mechanism without any adversary involved. During the Blue Cut Fire disturbance in August 2016, a transmission fault was followed by the loss of roughly 1,200 MW of solar photovoltaic output, and the Canyon 2 Fire disturbance in October 2017 produced a further loss of roughly 900 MW. NERC investigated both. The causes were inverter responses to measured frequency during the fault and momentary cessation behavior rather than any attack, and the findings drove revisions to inverter performance requirements. For security purposes the events establish the important point: a settings-level behavior common to a large inverter population can remove a bulk-scale block of generation in a fraction of a second, and the grid notices.

Firmware is the delivery mechanism for such a change. Inverter firmware is frequently updated over the air by the manufacturer, on a schedule the manufacturer controls, sometimes from infrastructure outside the jurisdiction in which the fleet operates. That arrangement places the integrity of a large distributed resource in the hands of the vendor's build and signing infrastructure. Signed firmware verified by a hardware root of trust in the inverter is the necessary control, together with rollback protection and an update path that a utility can audit. Related practice appears under firmware update security and secure boot and attestation.

Manipulable Load as Well as Generation

The same reasoning applies to controllable load. Research on botnets of high-wattage connected appliances, published at USENIX Security in 2018 under the BlackIoT name, argued that synchronized switching of a sufficiently large population of such devices could produce frequency excursions, line overloads, or increased operating cost. The scale required is large and contested, and the analysis is a modeling result rather than a demonstrated attack, but the mechanism is not in dispute: demand is a control input to the power system, and connected demand is a control input an adversary may be able to reach.

Electric vehicle charging concentrates this concern because the individual loads are large and the population is growing quickly. A direct-current fast charging site presents hundreds of kilowatts at a single point, managed charging schemes deliberately create the coordination channel needed to move that load in time, and the charging network operator occupies the same aggregator position described above. Anti-islanding and safety functions form a useful boundary case in all of these systems: they are safety-critical, and they should not be remotely disableable at all, regardless of the authentication presented.

False Data Injection

System operators do not measure the grid directly. They estimate its state from redundant measurements using a state estimator that discards readings inconsistent with the network model. Work by Liu, Ning, and Reiter published in 2009 showed that an adversary with knowledge of the network topology and control of a sufficient set of meters can construct a coordinated set of false measurements that lies in the null space of the estimator's residual test. The estimator converges on a wrong state and reports no bad data. Downstream applications, including contingency analysis and economic dispatch, then act on that state.

The practical barrier is that constructing such an attack requires accurate topology knowledge and simultaneous control of specific measurements, which is demanding. The defenses follow from the requirements: protect the integrity of the network model, ensure that a strategically chosen subset of measurements is authenticated so that the adversary cannot control a consistent set, and randomize which measurements receive extra scrutiny.

Time References and Synchrophasors

Phasor measurement units time-stamp their measurements against a common reference, historically derived from the global positioning system. The accuracy demanded is severe: the one percent total vector error limit in the synchrophasor measurement standard, published jointly as IEC/IEEE 60255-118-1, corresponds to a timing error of only tens of microseconds at power frequency. Civil satellite timing signals are unauthenticated and weak at the receiver, so a spoofed signal that captures a receiver and then walks its clock slowly away from true time introduces a phase angle error that appears entirely plausible.

Because angle differences drive stability assessment and some protection schemes, a spoofed reference can misinform an operator or a control scheme about the loading of a corridor. Defenses include multi-constellation and multi-frequency receivers, receiver-level spoofing detection, holdover oscillators good enough to bridge a rejected signal, and distribution of time by terrestrial means where the criticality warrants it. Synchrophasor infrastructure is covered further under smart grid communications.

Detection Grounded in the Power System

The grid offers a defensive advantage that ordinary networks lack: its data must obey physical law. Measurements have to satisfy Kirchhoff's laws and the network equations, power flows have to balance, and quantities have to change at rates the equipment allows. A monitoring system that models these relationships can flag data that is internally inconsistent even when every packet is properly formatted and correctly authenticated.

The same principle extends to commands. Operational traffic in a substation is highly repetitive, so deviations in which device issues a command, at what time of day, and under what system conditions carry real information. A trip command that arrives when no fault indication precedes it is anomalous on power system grounds regardless of its network provenance. Combining protocol-aware passive monitoring with power system context is what distinguishes effective grid intrusion detection from a generic network sensor deployed in an unfamiliar environment.

Ukraine, December 2015

Three Ukrainian regional distribution companies lost power to roughly 225,000 customers in a coordinated attack. The intrusion began months earlier with spear-phishing that delivered the BlackEnergy 3 malware into the corporate networks, after which the attackers moved laterally, harvested credentials, and reached the operational networks through legitimate remote access. Breakers were opened using the operators' own human-machine interfaces. The attackers then wiped workstations, corrupted the firmware of serial-to-Ethernet converters so that operators lost remote control, and flooded the utilities' call centers with automated calls to delay the response.

Two lessons dominate the analysis. The intrusion arrived through ordinary information technology channels and became an outage only because the boundary between the corporate and operational networks was crossable. And restoration succeeded within hours because the utilities still had manual control: crews drove to substations and closed breakers by hand. Deeper automation would have made recovery slower, not faster.

Ukraine, December 2016, and Afterward

The following year an attack on a transmission substation serving Kyiv used purpose-built malware, published as Industroyer and CrashOverride, which represented a qualitative change. Rather than driving an operator interface, it contained modules implementing IEC 60870-5-101, IEC 60870-5-104, IEC 61850, and OPC Data Access, so that it could enumerate and command grid equipment directly using the protocols those devices speak. It also carried a component targeting a protective relay's ability to perform its function. The outage itself was brief, and the event is generally read as a capability demonstration.

A successor tool, Industroyer2, was recovered in Ukraine in April 2022 in an attempt against high-voltage substations that was detected before it succeeded. It was narrower, implementing only IEC 60870-5-104 and configured for specific target devices. The trajectory across these events is toward malware that understands power system protocols natively and requires no operator interaction, which raises the value of monitoring that understands the same protocols.

Adjacent Cases and Honest Boundaries

It is worth stating plainly that no cyberattack has been publicly confirmed to have caused a power outage in the United States. The most-cited North American event, in March 2019, involved a firewall vulnerability exploited to cause repeated device reboots at a renewable generation operator, producing intermittent loss of visibility to generation sites without any loss of generation. Intrusion without disruption is nonetheless well documented. A Chinese state-linked group tracked as Volt Typhoon, and by one vendor as VOLTZITE, was resident in the network of Littleton Electric Light and Water Departments, a small Massachusetts municipal utility, for roughly three hundred days during 2023, reaching operational systems and taking operational technology data including network and system diagrams before it was removed without any effect on service. Access held quietly against a later occasion is a different objective from an immediate outage, and it does not appear in outage statistics at all. The Colonial Pipeline ransomware incident of 2021 is instructive for a different reason: the malware affected business systems, and the operator halted the pipeline as a precaution because the boundary between billing and operations could not be quickly established. An attack need not reach the control system to stop the physical process.

Overstating the threat is counterproductive in a sector that must justify every expenditure to a regulator. The defensible claim is narrower and sufficient: capable actors have repeatedly demonstrated the ability to reach grid control systems, purpose-built tooling for power system protocols exists and has been used, and the distribution edge is accumulating remotely controllable capacity faster than it is accumulating oversight.

Device Identity and Integrity

A modern grid device should be able to prove what it is and what software it is running. That requires a hardware root of trust holding a device-unique private key that never leaves the part, a boot chain that verifies each stage's signature before executing it, and attestation that reports the measured software state to a verifier. With those in place, network authentication rests on something an attacker cannot copy by extracting a shared secret from firmware, and a compromised device can be recognized as compromised.

Cryptographic key storage at scale increasingly relies on dedicated modules within the utility's own infrastructure, discussed under hardware security modules. The constraint peculiar to this sector is environmental and economic: a distribution-class inverter competes on price, and secure elements, key provisioning during manufacture, and long-term certificate management all add cost to a product sold in volume. Regulatory or procurement pressure is generally what makes those features appear.

Supply Chain and Provenance

CIP-013 formalized what the sector had already recognized: security properties are determined at procurement, not at installation. Practical measures include obtaining a software bill of materials so that a newly disclosed vulnerability in a common library can be traced to the affected devices, requiring evidence of a secure development lifecycle such as certification against IEC 62443-4-1, which governs the product development process, together with IEC 62443-4-2, which sets technical security requirements for the component itself, verifying firmware signatures against keys obtained through a channel independent of the firmware itself, and contractually defining the vendor's remote access and vulnerability disclosure obligations.

The concentration of inverter manufacturing in a small number of suppliers, several of which operate the cloud services that monitor and update their fleets, has drawn policy attention in several jurisdictions. Reuters reported in May 2025 that inspectors in the United States had found undocumented communication devices, including cellular radios, in some Chinese-made inverters and battery systems. That account rested on unnamed sources, named no manufacturer, and has not been accompanied by a published technical teardown, so it is better read as a reason to inspect than as an established finding. Whatever view one takes of the geopolitics, the structural observation is sound: when a single vendor's update infrastructure can change the behavior of many gigawatts of interconnected capacity, that infrastructure is part of the power system's control chain and should be evaluated as such.

Graceful Degradation and Autonomous Fallback

The most durable security property a grid device can have is the ability to behave safely without instructions. An inverter that loses its communications channel should hold its last validated settings and continue to provide ride-through and volt-var response autonomously, rather than reverting to defaults or ceasing operation. Local protection functions should never depend on a network path. Setpoints received remotely should be clamped to a locally configured envelope so that an implausible command is refused at the device.

This design philosophy accepts that compromise may occur and limits what compromise can accomplish. It also aligns with the operating requirements of microgrid power electronics, where autonomous operation during loss of the wider grid is a functional requirement rather than a security measure. The same architecture serves both purposes, which is a useful argument when justifying the cost.

Assessment, Exercise, and Response

Security testing in this domain cannot be conducted casually on live plant. Active scanning has caused unintended device behavior in operational networks often enough that passive discovery is the default, with active testing reserved for laboratory replicas, hardware-in-the-loop benches, or planned outages. Those same benches, built for control validation, serve well for security assessment because they reproduce the protection and control interactions that determine whether a manipulation has physical consequence.

Response planning has to include the physical restoration path. The Ukrainian utilities recovered because manual operation remained possible, and exercises that assume a clean control system understate the problem. Useful exercises rehearse operating without the supervisory system, restoring devices from verified configuration baselines rather than from potentially altered live configurations, and coordinating with neighboring operators whose systems may be affected simultaneously. Sector-wide exercises such as the biennial GridEx series exist to test exactly these assumptions across many organizations at once.