Network Code on Cybersecurity electricity encryption rules

The EU Network Code on Cybersecurity (NCCS), formally Commission Delegated Regulation (EU) 2024/1366, is a binding set of sector-specific rules for the cybersecurity of cross-border electricity flows. It sets out how cyber risk is assessed, which entities carry obligations and how minimum and advanced controls are defined. It does not name specific encryption algorithms.

For organisations that run OT, this has a practical consequence. Whether a link has to be encrypted, and how strongly, follows from a chain of risk assessments and approved controls, not from a single article in the regulation. These links include the ones between control centres and substations, from edge sites to cloud platforms, and from remote engineers into the network. That chain now runs alongside a separate EU commitment to move high-risk systems to post-quantum cryptography (PQC) by the end of 2030.

What is the EU Network Code on Cybersecurity for cross-border electricity flows?

The NCCS is a delegated regulation that supplements the Electricity Regulation (EU) 2019/943. It sets common rules for cyber risk assessment, minimum requirements, monitoring, reporting and crisis management across the European electricity system.

Its legal basis is Regulation (EU) 2019/943 Article 59(2)(e), which allows the Commission to adopt network codes on cybersecurity. The Commission adopted the text on 11 March 2024. It was published in the Official Journal on 24 May 2024 and entered into force on 13 June 2024. Article 4 required every Member State to designate a competent authority by 13 December 2024. Examples include the Danish Energy Agency, Italy’s National Cybersecurity Agency and, in the Netherlands, a directorate of the Ministry of Climate and Green Growth.

The code took several years to develop. ENTSO-E and the EU DSO Entity submitted a joint proposal to ACER in January 2022. ACER revised it and sent it to the Commission in July 2022. In its announcement, ACER said that “this cybersecurity network code aims to further contribute to maintaining the security and resilience of the electricity system”.

The reason for a sector-specific code goes back to the Commission’s 2019 Recommendation on cybersecurity in the energy sector. There the Commission noted: “What might work in the internet will not be necessarily adequate in the energy sector.” The NCCS governance model is deliberately aligned with the NIS2 Directive (EU) 2022/2555. It reuses CSIRTs, the NIS Cooperation Group and existing incident channels rather than creating a parallel structure.

Which grid operators and entities fall under the NCCS?

An entity falls under the NCCS only if its competent authority identifies it as a high-impact or critical-impact entity under Article 24. That identification uses impact thresholds tied to cross-border electricity flows.

Article 2(1) lists the categories that can be identified. The first is electricity undertakings as defined in Article 2(57) of Directive (EU) 2019/944, which covers transmission and distribution system operators, generators, suppliers and similar market participants. The regulation also applies to the coordinating bodies that run the process. ENTSO-E represents the transmission side and reports 40 member TSOs from 36 countries (ENTSO-E, June 2025). The EU DSO Entity represents distribution system operators.

Two things affect the scope in practice:

• The electricity cybersecurity impact index (ECII). This index ranks what a cyber attack on a business process could do to cross-border flows. Processes above the high-impact or critical-impact thresholds define the perimeters where controls apply. Minimum controls cover the high-impact perimeter. Advanced controls cover the critical-impact perimeter.
• Critical ICT service providers. Critical-impact entities must list the ICT service providers that are critical to their critical-impact processes. Managed network, telecom and cloud providers that carry control traffic may therefore come under closer scrutiny, even though they are not grid operators.

For incident handling, the NCCS uses a cyber-attack classification scale with five levels. The two highest are “high” and “critical” (Delegated Regulation (EU) 2024/1366, 2024).

Does the NCCS require encryption of communication between control centres and substations?

Not in so many words. The regulation does not set a mandatory encryption protocol or algorithm for control-centre-to-substation links. Encryption requirements come from the minimum and advanced cybersecurity controls, which are derived from the risk assessments and mapped against recognised standards.

Article 29 sets out how those controls are created and updated. The TSOs, with ENTSO-E’s assistance and in cooperation with the EU DSO Entity, propose the controls. The competent authorities then approve them. Article 34 requires the controls to be mapped against European and international standards and national legislation. By 13 June 2025, ENTSO-E and the EU DSO Entity had to prepare a provisional list of those standards, including controls equivalent to the expected minimum and advanced controls.

In practice, telecontrol and SCADA links inside a critical-impact perimeter are exactly the assets the advanced controls are meant to protect. Wide-area paths between control centres and substations are a clear example, especially where they cross leased lines, carrier networks or the public internet. Protecting the confidentiality and integrity of data in transit on those paths is hard to argue away in an entity-level risk assessment.

The Commission has also acknowledged a real engineering limit. Some grid components, such as circuit breakers, must react so fast that there is no time to authenticate a command or encrypt a connection at the device. This is why many operators protect the network path between sites rather than every device behind it.

How do NCCS minimum and advanced cybersecurity controls relate to post-quantum cryptography?

The NCCS controls do not mention PQC, but the code brings in quantum risk in two ways: through risk assessments that have to consider long-lived and legacy assets, and through supply chain controls that apply to new procurement.

First, the risk assessment methodologies must take into account legacy systems and the real-time nature of grid operations. OT assets and the links between them often stay in service for decades. Traffic captured today, such as topology data, protection settings and switching schedules, could be decrypted later by an attacker with a capable quantum computer. Classical key exchange based on RSA or elliptic curves cannot rule that out. That risk belongs in the entity-level assessment for any link with a long service life.

Second, Article 33 adds minimum and advanced controls for the supply chain. These apply to procurement processes that start six months after the Article 29 controls are adopted or updated. Encryption gear, remote-access systems and cloud connectivity bought from that point on will be judged against those controls. Buying classical-only equipment with a long depreciation period is therefore a risk that has to be documented and accepted, not just a technical choice.

EU policy is consistent on how to manage the transition. Commission Recommendation (EU) 2024/1101 calls for deploying PQC in critical infrastructure through hybrid schemes that combine it with existing cryptography. The EU roadmap work also stresses crypto-agility. Fabiana Da Pieve of the European Commission, presenting the roadmap at an ENISA event, described the goal as cryptography where “cryptographic routines and ciphers can be easily upgraded or replaced”.

What this means for each connection type

Placing encryption without disturbing OT

One architectural pattern is a Layer 3 encryption gateway at each end of a link. For example, Quantum Network’s QPN gateway combines a classical and an ML-KEM (FIPS 203) key exchange into one session key and never falls back to unencrypted traffic. It sits in front of an existing firewall when that firewall still has to inspect the traffic. This pattern protects data in transit only. Firewalls, segmentation and device hardening are still needed, and the operator’s own risk assessment decides where each measure applies.

How do NCCS risk assessments interact with the EU 2030 deadline for migrating critical infrastructure to post-quantum cryptography?

The two run in parallel and do not line up neatly. The first full NCCS cycle, from entity notification through regional assessment to revised controls, can run past the end of 2030. That is the date by which the EU roadmap expects high-risk use cases to be migrated to PQC.

The EU Coordinated Implementation Roadmap for the Transition to PQC was adopted in June 2025. It says Member States should begin the transition by the end of 2026, and that “the protection of high-risk use cases should be transitioned to PQC as soon as possible”, no later than the end of 2030 (European Commission, 2025). Commission material on the roadmap explicitly lists energy as critical infrastructure in the high-risk group.

The legal status differs too. The NCCS is a directly applicable regulation. The PQC roadmap is a coordinated commitment by Member States that guides national transition plans. In practice, though, the same national authorities often deal with both. An operator that tells a competent authority in 2029 that it is waiting for the revised NCCS controls before addressing quantum risk will be hard-pressed to justify that position.

A workable sequence for operators

1. Map cryptography to perimeters. For every link that crosses a high-impact or critical-impact perimeter, record where keys are agreed, which algorithm is used and who controls the endpoints. Include cloud and remote-access paths.
2. Add quantum risk to the entity-level assessment. Treat harvest-now-decrypt-later as a threat scenario for data with a long confidentiality life. Record the treatment, or a reasoned risk acceptance, as the NCCS reporting expects.
3. Prioritise wide-area OT links. Links between control centres and substations over third-party networks usually carry the highest impact and are the easiest to protect at the network layer without touching field devices.
4. Set procurement criteria before the supply chain controls apply. Require hybrid key agreement and crypto-agility in new tenders, so that equipment bought now does not become stranded before 2030.
5. Use derogations carefully. The NCCS allows derogations where costs significantly exceed benefits. The cost of a later forced migration belongs in that calculation as well.

In short, the NCCS will not tell an operator to use a particular algorithm on its OT links. It does require a documented, defensible line from risk to control for every link that matters to cross-border flows. With the EU’s end-2030 target for critical infrastructure ahead, that line now has to account for quantum risk.