# Are european security policies ready for advanced metering systems with cloud back-ends?

Oyvind Toftegaard, Janne Hagen, Bernhard Hämmerli

► To cite this version:

Oyvind Toftegaard, Janne Hagen, Bernhard Hämmerli. Are european security policies ready for advanced metering systems with cloud back-ends?. 16th International Conference on Critical Infras- tructure Protection (ICCIP), Mar 2022, Virtual Event, United States. pp.47-69, 10.1007/978-3-031- 20137-0_2 . hal-05397793

HAL Id: hal-05397793

https://inria.hal.science/hal-05397793v1

Submitted on 4 Dec 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
Chapter 2

ARE EUROPEAN SECURITY POLICIES
READY FOR ADVANCED METERING
SYSTEMS WITH CLOUD BACK-ENDS?

Oyvind Toftegaard, Janne Hagen and Bernhard Hämmerli

**Abstract** Advanced metering systems deployed in Europe are enablers of distributed power production where prosumers can feed surplus energy into the grid. Successfully managing complex energy systems requires real-time data access, flexible production and rapid demand response. The accompanying need for data storage capacity and processing power has rendered cloud services an attractive option. However, at this time, European cyber security legislation related to advanced metering systems does not reflect the broad usage of cloud technology.

This chapter describes an advanced metering system reference model based on the cloud profiles of five distribution grid operators. It identifies cloud-related gaps in current European Union cyber security legislation applicable to advanced metering systems. The gaps are identified via a holistic mapping of security principles from prominent cloud security frameworks to existing European Union legislation. A novel, advanced metering system security policy framework that covers all the identified cloud security gaps is specified. The security policy framework is an important first step towards cloud-ready security legislation for advanced metering systems. Authorities overseeing cyber security and energy resources can employ the policy framework as a starting point for a broad debate among the various stakeholders to institute cloud-ready security policies for advanced metering systems.

**Keywords:** Advanced metering systems, cloud, security policies, legislation

# 1. Introduction

The European Union (EU) Green Deal requires a shift from coal-based power production to renewable sources such as wind and solar energy [12]. Electricity production by wind farms and solar panels is
highly dependent on climate and weather conditions – wind turbines operate in certain wind speed ranges and solar irradiance is seasonal and latitude dependent. Long-term planning and short-term adaptation to balance supply and demand from weather predictions are challenging. Meanwhile, consumption patterns are changing and the introduction of induction stoves and proliferation of electric vehicles are expected to drive the maximum consumption peaks higher.

The European power grid, which is maintained and operated by transmission and distribution grid operators, must continuously balance production and consumption. When power production is less than demand, smart computing systems manage the demand response to achieve system balance. Digital technology, sensors, cloud services, big data analytics and optimization algorithms are cornerstones for managing demand. The introduction of 3G mobile broadband in 2001 and 4G in 2011 made rapid data transfer more available and affordable [36]. The introduction of Amazon Web Services in 2006 and Microsoft Azure in 2008 made cloud services available to the masses. The shift to advanced metering system (AMS) architectures with cloud-based back-ends is a natural consequence of these technological developments. Fast mobile broadband enables large amounts of data to be collected from smart meters at customer premises for billing and data analytics. Cloud services are attractive because they provide high availability and scalability of data storage, and processing power. Costs can be reduced by customizing cloud resources to accommodate individual smart meter systems.

Smart meters incorporating onboard circuit breakers are common in the European Union [1]. Millions of new, computer-controlled circuit breakers have been introduced across the European energy system. The European power grid, like the Internet, crosses national borders and grid balancing is coordinated in multi-state synchronous areas. As a result, an incident in one member state can impact the grid in other member states. In 2003, cross-border cascading effects originating in France and Switzerland resulted in the loss of power to about 56 million Italians [27]. In 2006, more than 15 million households lost power supply due to cascading effects across Germany, France, Italy, Belgium, Spain and Portugal [40]. Proper security regimes and resilient power infrastructure are needed to reduce the risk of cross-border impacts such as cascading blackouts.

Several policies have been developed to advance cross-border cyber security harmonization. Examples are the information security components in the ISO 27000 series of standards [24] and the European Union cyber security guidelines published by the European Union Agency for Cybersecurity (ENISA) [20, 21]. An important difference between leg-
isolated policies (regulations) and standards or guidelines is that regula-
tions are compulsory. During the past decade, the European Union has
issued several regulations [15–19] covering security requirements that
are applicable to advanced metering systems [9]. However, developing
and approving regulations are time consuming, and there is always the
risk that legislated requirements will become obsolete or even counter-
productive [23]. Therefore, when large numbers of European grid opera-
tors are procuring cloud-based advanced metering systems, national au-
thorities should ensure that security regulations adequately cover cloud
operations.

This chapter assesses whether the European security legislation ap-
plicable to advanced metering systems reflects the broad usage of cloud
technology. An advanced metering system reference model is presented
to guide the scope of the assessment. Gaps in cloud-related Euro-
pean Union legislation are identified by mapping security principles from
prominent cloud security frameworks against regulatory requirements.
Finally, a novel, cloud-secure policy framework for advanced metering
systems that covers the cloud security gaps is articulated.

## 2. Background

This section describes the evolution of advanced metering systems and
discusses European Union legislation related to cyber security.

## 2.1 Advanced Metering System Evolution

Modern advanced metering systems are complex systems of systems
that connect distributed smart meters with centralized applications via
two-way metering. These systems have been enabled by tremendous
technological advancements over the decades.

The first electromechanical meters had analog displays [33]. Electric-
ity consumption data was read manually by consumers and communi-
cated by mail or orally to power grid operators. Automatic meter read-
ing (AMR) was introduced in 1962 [37]. The deployed systems enabled
grid operators to collect information using handheld data collectors or
via landline telephone networks. The meters that supported automated
readings incorporated solid-state metering components and digital dis-
plays. However, the cost effectiveness of automatic meter reading sys-
tems was questioned [8]. In 1999, it was demonstrated that advanced me-
tering infrastructures (AMIs) with two-way data communications could
reduce costs [8]. Soon after, grid operators across Europe began to invest
heavily in advanced metering infrastructures.
<figure><img src="image_3.png" /><figcaption>Figure 1. Electricity metering system evolution in the European Union [3, 10, 15].</figcaption></figure>

Advanced metering infrastructures were upgraded further with more sophisticated meters with interactive displays and two-way metering. The upgrades provided customers with information about their electricity consumption and enabled them to participate in energy markets by selling excess energy produced by solar panels.

In recent years, ecosystems of advanced metering system applications have been built around advanced metering infrastructure backbones. The upgrades include meter readings with high frequency and end-to-end communications between grid operators and consumers. The frequent meter readings provide detailed consumption profiles that benefit operators and customers. Home energy management systems and electric vehicle charging stations can combine the consumption data with power price and grid tariff information to schedule and optimize electricity usage. End-to-end data streams from grid operators to consumers enable operators to customize the data content transmitted to consumers and rapidly adapt to load changes.

Figure 1 shows the advances in electricity metering technology in three prominent areas, interface type, metering technology and data communications. It is a modified version of a figure in [3] in that it describes the evolution of electricity metering systems in Europe and limits the content to interface type, metering technology and data communications.
<figure><img src="image_4.png" /><figcaption>Figure 2. Advanced metering system applications.</figcaption></figure>

In the future, increasing numbers of advanced metering system applications are expected to be built around advanced metering infrastructure backbones. These systems include customer management systems, grid information systems and consumer apps such as those used for home energy management. Other systems that are gaining popularity include integration services that enable related technologies, such as water meters, to communicate using advanced metering infrastructure backbones. Figure 2 shows advanced applications for consumer price schemes and water meter reading built around an advanced metering infrastructure backbone.

Cloud services are being leveraged to address the data processing needs in current and future advanced metering system deployments. The trend involves smart meters with cloud-based back-ends [29, 38]. As the complexity of advanced metering systems grows, security and privacy will become increasingly important. Clearly, it is necessary to institute cloud security standards and related policies governing cyber security.

## 2.2 European Union Cyber Security Legislation

Figure 3 shows a timeline covering technological advancements, cyber security concerns and European Union security legislation. The cyber security concerns and related legislation are mapped to the three steps in electricity metering technology advancement, automatic meter reading, advanced metering infrastructures and advanced metering systems. The figure shows how legislation has developed in relation to technological advancements to address emerging cyber security concerns.

In 1995, the European Union Data Protection Directive [14] came into force to protect the privacy of citizens in member states. Despite the
<figure><img src="image_5.png" /><figcaption>Figure 3. Technology, cyber security concerns and legislation timeline.</figcaption></figure>

privacy protections provided by the legislation, the Dutch population expressed considerable skepticism when the decision was made to install smart meters compulsorily. In 2009, the Dutch Senate blocked two proposed smart metering bills due to privacy concerns [7]. In 2016, the European Union Data Protection Directive was replaced with the European Union General Data Protection Regulation (GDPR) [16]. GDPR updated the security and privacy requirements, and tackled privacy challenges related to technological development.

In 2009, smart meters in Puerto Rico were reported to have been hacked, possibly causing an annual loss of 400 million dollars [39]. The attacks supposedly adjusted the settings that recorded power consumption. In 2014, the European Union issued the Measuring Instruments Directive (MID) [15], which provided specific rules governing data integrity related to electricity measurements by smart meters.

The European Union Network and Information Security (NIS) Directive [17] published in 2016 introduced minimum cyber security requirements for operators of essential services. Because power grid operation is an essential service, grid operators were subject to the cyber security requirements imposed by the directive. The same year, the UK Government Communications Headquarters (GCHQ) intervened to change the nationwide smart meter design, where all smart meters had the same encryption key [34]. Without the intervention, a malicious actor who
cracked or otherwise obtained a smart meter key could have gained access to all the smart meters in the country.

The European Union Electricity Directive [19] published in 2019 contains the first compulsory rules on security and privacy that are exclusive to smart metering systems. The high-level rules state that smart metering security “shall comply with relevant Union security rules” with “due regard of the best available techniques for ensuring the highest level of cyber security protection while bearing in mind the costs and the principle of proportionality.” The Electricity Directive also states that the “privacy of final customers and the protection of their data shall comply with relevant Union data protection and privacy rules.”

In 2019, the European Union also passed the Cybersecurity Act [18], which covers a voluntary program for the security certification of products, processes and services. The certification program targets products such as smart meters [11]; however, progress has been limited because the program in voluntary.

## 3. Research Methodology Overview

The comparative study of cloud security frameworks and European Union legislation with security requirements applicable to advanced metering systems was conducted by applying an exploratory research design comprising three phases.

The objective of the first phase was to understand how applications built on the advanced metering infrastructure backbone are transferred to the cloud. A qualitative analysis was performed that categorized cloud-based advanced metering system applications such as head-end systems (HESs), meter data management systems (MDMSs) and customer information systems. The categorization was based on the advanced metering system architectures deployed by five Norwegian grid operators. The architectural descriptions were collected by the Norwegian Water Resources and Energy Directorate during advanced metering system supervision activities conducted in 2017 and 2018. The categorization led to the specification of an advanced metering system as a service (AMSaaS) reference model covering advanced metering systems with cloud-based back-ends.

The objective of the second phase was to identify cloud-related security gaps in European Union legislation that are applicable to advanced metering systems. A qualitative approach was employed that mapped European Union legislation related to advanced metering system security against security principles from three cloud security frameworks, the Cloud Security Alliance (CSA) Egregious 11 [5], the International
Organization for Standardization (ISO) Cloud Services Standard (ISO 27017) [26] and the UK National Cyber Security Centre (NCSC) Cloud Security Principles [30].

Five European Union legislative constructs were considered, Measuring Instruments Directive (MID), General Data Protection Regulation (GDPR), Network and Information Security (NIS) Directive, Cybersecurity Act and Electricity Directive. The five constructs were selected after a thorough review of European Union legislation because they contain security requirements applicable to advanced metering systems.

The effort sought to create a holistic overview of prominent cloud security principles and map the principles to the legislative constructs while noting whether or not the principles are covered by the constructs. The three cloud security frameworks were selected because of their distinctive features and relevance to cloud security. The CSA framework was specified to reduce the risk of the most prominent cloud threats. The ISO framework was designed to complement requirements in the ISO Code of Practice for Information Security Controls (ISO 27002) Standard [25] that was created to support the implementation of the ISO Information Security Management System (ISO 27001) Standard [24]. The NCSC framework was designed to provide general cloud security guidance for various organizations.

Next, the mapping of the security principles from the cloud security frameworks to the European Union legislative constructs was placed in relevant categories specified in the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) [31]. NIST CSF is a widely-used cyber security standard that has contributed to the creation of several cyber security frameworks [2, 32]. The use of the NIST CSF categories provided an excellent functional overview that rendered the subsequent analysis more efficient.

The objective of the third phase was to close the identified cloud related security gaps and provide a first step towards cloud-ready security legislation applicable to advanced metering systems. Therefore, a cloud-ready European advanced metering system security policy framework was created based on the NIST CSF categories and a policy hierarchy model. The mapping of security principles from the cloud security frameworks and the scope of the AMSaaS reference model were used to select relevant NIST CSF categories. The advanced metering system security policy framework was subsequently created to cover all the cloud security principles relevant to the AMSaaS reference model that were found to be missing in the European Union legislative constructs during the gap analysis.
<figure><img src="image_6.png" /><figcaption>Figure 4. AMSaaS reference model for AMSs with cloud-based back-ends.</figcaption></figure>

## 4. Reference Model

Traditional advanced metering system models comprise smart meters, a communications system and a centralized head-end system. Modern advanced metering system back-ends have applications that support a variety of automated functions such as electricity billing, distribution management and entrepreneur dispatching [4]. Cloud services are now being used to support these functions. Little attention has focused on advanced metering system back-ends; as a result, the paradigm shift to the cloud by the back-end systems has been largely ignored.

Figure 4 shows the advanced metering system as a service (AMSaaS) reference model created to capture the architectures of advanced metering systems with cloud-based back-ends. As mentioned above, the reference model is derived from the advanced metering system architectures of five Norwegian grid operators. Details about these architectures are not available to the public. However, access was obtained for this research because it was conducted in cooperation with the Norwegian Water Resources and Energy Directorate.

The AMSaaS reference model was designed by identifying advanced-metering-related systems in the five architectures that were “in the cloud,” meaning that the systems were located at remote servers not operated by the grid operators. The identified in-the-cloud systems included one grid operator mobile data access point, two grid operator head-end systems, two grid operator meter data management systems, three grid operator integration services for external and internal systems (data integration bus in Figure 4), one grid operator support and software update system, and two grid operator entrepreneur dispatch
systems. These systems are highlighted in light gray in Figure 4. The boxes in dark gray are legacy systems that the grid operators operate in their premises. The legacy systems are included to render the reference model more holistic and because legacy systems are prominent candidates for migration to the cloud.

Analysis of the advanced metering architectures revealed that data concentrators and master smart meters are commonly used to connect smart meters in a radio mesh network with the head-end system via mobile broadband (MBB). After reaching the head-end system, the advanced metering system data is often transferred to a meter data management system that functions as the master data repository. When more than one head-end system is in use, a data integration bus may be employed to ease data transfer from the head-end systems to the meter data management system. Other back-end systems, such as entrepreneur dispatch systems, billing systems, distribution management systems, customer information systems and outage management systems, may access relevant data from the meter data management system. These back-end exemplars are relatively immature. Several back-end systems (see, e.g., [28, 35, 41]) may be procured or deployed as cloud applications in the future.

## 5. Framework to Legislation Mapping

The security principles in the three prominent cloud security frameworks mentioned above were mapped to the five European Union legislative constructs applicable to advanced metering systems, Measuring Instruments Directive (MID), General Data Protection Regulation (GDPR), Network and Information Security (NIS) Directive, Cybersecurity Act and Electricity Directive. The three cloud security frameworks are described in the following paragraphs.

The Cloud Security Alliance (CSA) Egregious 11 [5], published in 2019, describes the 11 most pressing cloud security threats. The framework specifies measures for mitigating the threats. However, the measures are highly technical and stem from a more comprehensive CSA standard [6]. To maintain the policy-level focus, it was decided to work with the 11 threats and not consider the detailed technical measures in the CSA standard.

ISO 27017, the International Organization for Standardization (ISO) Cloud Services Standard [26], was published in 2015. Like the CSA's Egregious 11 framework, the ISO 27017 standard adopts a detailed technical approach. The standard provides additional guidance on the implementation of measures in the ISO 27002 standard, with a focus on
cloud provision and usage. To maintain the cloud focus, only the seven cloud-specific principles in ISO 27017 were considered in the mapping. To ease the mapping process, it was decided to adopt a high-level version of the seven ISO 27017 principles published by the German Federal Office for Information Security [22].

The UK National Cyber Security Centre (NCSC) Cloud Security Principles [30], published in 2018, comprises two frameworks. One framework targets board members whereas the other framework targets technical personnel. The first framework was employed in the mapping because it is at a high level that matches the European legislative constructs. The NCSC cloud security principles enable organizations to assess whether or not cloud services are secure enough to handle their data.

The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) [31] was employed to categorize the cloud security principles in the three frameworks. Only the NIST CSF categories relevant to the cloud framework principles were considered. As mentioned above, the main reason for introducing the NIST CSF categories was to facilitate the creation of a policy framework.

Tables 1, 2 and 3 show the mappings between the cloud security principles in the frameworks and the European Union legislative constructs. Note that the NIST CSF categories (left-most column of the three tables) are used for categorization only. As a result, multiple security principles may fall in a given NIST CSF category.

Analysis of Tables 1, 2 and 3 reveals that seven cloud security principles are mapped to the Cybersecurity Act whereas only three principles are mapped to GDPR, two to MID and one each to the NIS and Electricity Directives. However, since the Cybersecurity Act focuses on a voluntary certification scheme, the seven principles mapped to the construct would not be compulsory. Therefore, the cloud readiness of the compulsory cyber security principles mapped to the European Union legislative constructs are considered to be lower than the overall analysis results because the analysis includes compulsory as well as voluntary principles.

It is important to note that there are only two NIST CSF categories for which all three cloud security frameworks have coverage. The two categories, maintenance and continuous security monitoring, have the highest consensus regarding their importance. The maintenance category includes operational security such as system patching, checking new configurations for vulnerabilities and hardening where necessary. The continuous security monitoring category includes usage visibility such as collecting audit logs and monitoring security.
<table><caption>Table 1. Mapping of cloud security principles from frameworks to EU legislation applicable to AMSs.</caption><thead><tr><th>NIST CSF Category</th><th>CSA EE Principles</th><th>ISO 27017 Principles</th><th>NCSC CSP Principles</th><th>EU Legislation Principles</th></tr></thead><tbody><tr><td>Asset Management</td><td></td><td>Deletion and removal of cloud service customer assets</td><td>Asset protection and resilience</td><td>Cloud security is not covered</td></tr><tr><td></td><td></td><td>Cloud security architecture and strategy</td><td></td><td>Cloud security is not covered</td></tr><tr><td>Governance</td><td></td><td>Roles and responsibilities in cloud environments</td><td>Governance framework</td><td>Cloud security is not covered</td></tr><tr><td>Supply Chain Risk Management</td><td>Strong control plane</td><td></td><td>Supply chain security</td><td>Cloud security is not covered</td></tr><tr><td>Identity Management, Authentication and Access Control</td><td></td><td>Segregation in virtual computing environments</td><td>Secure user management</td><td>Cyb. Act Art. 51(b) (Access rights and authorization)</td></tr><tr><td></td><td></td><td>Identity, credential, access and key management</td><td>User separation</td><td>Cloud security is not covered</td></tr><tr><td></td><td></td><td>Account hijacking protection</td><td>Identity and authentication</td><td>Cyb. Act Art. 51(b) (Access rights and authorization)</td></tr><tr><td></td><td></td><td></td><td></td><td>Cloud security is not covered</td></tr></tbody></table>
<table><caption>Table 2. Mapping of cloud security principles from frameworks to EU legislation applicable to AMSs (continued).</caption><thead><tr><th>NIST CSF Category</th><th>CSA EE Principles</th><th>ISO 27017 Principles</th><th>NCSC CSP Principles</th><th>EU Legislation Principles</th></tr></thead><tbody><tr><td>Awareness and Training</td><td>Insider threat security</td><td></td><td>Personnel security</td><td>Cloud security is not covered</td></tr><tr><td></td><td></td><td></td><td>Secure use of services</td><td>Cloud security is not covered</td></tr><tr><td>Data Security</td><td>Data breach prevention and handling</td><td></td><td>Data-in-transit protection</td><td>GDPR Art. 5, 1.(f) (Data protection)<br>Cyb. Act Art. 51(a-b) (Lifecycle data protection)<br>MID H1, 4.3b and Annex I: High level of integrity protection and security</td></tr><tr><td></td><td></td><td>Secure configuration and change control</td><td>Physical and virtual network alignment</td><td>Cyb. Act Art. 51(i) (Security by default and by design)<br>Secure development</td></tr><tr><td></td><td></td><td></td><td></td><td>Cyb. Act Art. 51(i) (Security by default and by design)<br>GDPR Art. 32, 1(d) (Testing and evaluation of technical and organizational measures)</td></tr><tr><td>Information Protection Processes/ Procedures</td><td>Data breach prevention and handling</td><td>Metastructure and applstructure failure prevention</td><td>Operational security for administrators</td><td>Secure service administration</td><td>Cloud security is not covered<br>NIS Art. 14, 2. (Incident prevention and handling)<br>NIS Art. 14, 4. (Significance of incident determination)<br>Cyb. Act Art. 51(d) (Known dependency and vulnerability identification and documentation)</td></tr></tbody></table>
<table><caption>Table 3. Mapping of cloud security principles from frameworks to EU legislation applicable to AMSs (continued).</caption><thead><tr><th>NIST CSF Category</th><th>CSA EE Principles</th><th>ISO 27017 Principles</th><th>NCSC CSP Principles</th><th>EU Legislation Principles</th></tr></thead><tbody><tr><td>Maintenance</td><td>Secure configuration and change control</td><td>Virtual machine hardening</td><td>Operational security</td><td>Cyb. Act Art. 51(g,j) (Vulnerability and update management)</td></tr><tr><td>Protective Technology</td><td>Interface and API security</td><td></td><td>External interface protection</td><td>Cloud security is not covered</td></tr><tr><td>Continuous Security Monitoring</td><td>Cloud usage visibility</td><td>Cloud service monitoring by cloud service customers</td><td>Auditing information for users</td><td>Cyb. Act Art. 51(e-f) (Access and activity recording)<br>MID Annex I point 8.2 (Evidence of intervention)</td></tr><tr><td></td><td>Abuse and nefarious use of cloud service prevention</td><td></td><td></td><td>Cloud security is not covered</td></tr><tr><td>Communication</td><td>Data breach prevention and handling</td><td></td><td></td><td>El. Dir. Art. 14, 3. (Notification of cyber events with significant impacts to authorities)<br>GDPR Art. 33 (Notification of personal data breaches to supervisory authorities)<br>GDPR Art. 34 (Communication of personal data breaches to the data subjects)</td></tr></tbody></table>
The analysis exposes 11 cloud security gaps in the cloud security principles covered by the European Union legislative constructs. The gaps are identified in Tables 1, 2 and 3 using the annotation “Cloud security is not covered.” Gaps occur in eight of the 11 NIST CSF categories. It is suggested that, because the NIST CSF categories are common starting points for cyber security policies [2, 32], authorities should use the eight categories with gaps as starting points to strengthen legislation based on the key cloud security principles.

# 6. Cloud-Secure AMS Policy Framework

This section describes the novel, cloud-secure European advanced metering system security policy framework that draws from three prominent cloud security frameworks. Principles from the three cloud security frameworks were mapped to the NIST CSF categories and existing European Union security legislation applicable to advanced metering systems. The mapping facilitated the identification of relevant cloud security policies from the NIST CSF categories and the evaluation of the cloud-security readiness of European Union legislation.

Figure 5 shows the proposed cloud-secure European advanced metering system security policy framework. The security policies in the dark gray boxes are not covered by current European Union legislation. The security policies in the light gray boxes are partially covered by European Union legislation. The security policies in the unshaded boxes are covered completely by European Union legislation. It is important to note that the term “coverage” considers only the security principles that are related to the AMSaaS model. As a result, European Union legislation requiring, for example, national authorities to conduct asset management or governance of general national concerns are considered to be out of scope.

Figure 5 shows the most prominent security policies for advanced metering systems with cloud-based back-ends. The security policy framework has three organizational layers of protection for defense in depth, strategic, tactical and operational. The strategic layer contains high-level cyber security policies that are connected to strategic business goals; awareness and training is included on this layer due to its influence on corporate culture. The tactical layer covers security and privacy administration functions with a focus on streamlining processes. The operational layer covers day-to-day cyber security activities and hands-on procedures.

Table 4 lists the cloud security principles, organized according to the three organizational layers and NIST categories, that must be covered
<figure><img src="image_7.png" /><figcaption>Figure 5. Cloud-secure European AMS security policy framework.</figcaption></figure>

to close the cloud security gaps identified in Section 5. These principles should be used as supplementary requirements in future European Union legislation to address cloud security in advanced metering systems.

The security principles in the Cybersecurity Act only pertain to voluntary certification programs. Therefore, authorities in member states that do not have certification programs would need to add these principles in the advanced metering system security policy framework shown in Figure 5. Of course, since the principles from the Cybersecurity Act are not compulsory, the question arises why they are included in the analysis and not treated as gaps. The reason is that this work focuses on policy readiness. Perhaps, future European Union legislation will mandate the missing security principles and also make the voluntary security principles compulsory.
<table><caption>Table 4. Cloud security principles to be incorporated as supplementary requirements.</caption><thead><tr><th>Layer</th><th>Policy</th><th>Legislation</th><th>Supplementary Requirements</th></tr></thead><tbody><tr><td rowspan="2">Strategic</td><td>Governance</td><td>No</td><td>Governance framework that also establishes roles and responsibilities for cloud service providers</td></tr><tr><td>Awareness and Training</td><td>No</td><td>Personnel education covering insider threats, screening of personnel and secure use of cloud services</td></tr><tr><td rowspan="2">Tactical</td><td>Asset Management</td><td>No</td><td>Asset protection and resilience program covering cloud security architecture and cloud strategy emphasizing asset disposal</td></tr><tr><td>Supply Chain Risk Management</td><td>No</td><td>Supply chain risk management program covering strong control plane principles</td></tr><tr><td rowspan="4">Operational</td><td>Protective Technology</td><td>No</td><td>Documentation of interface and API protection</td></tr><tr><td>Identity Management, Authentication and Access Control</td><td>Partial</td><td>Identity, credential, access and key management program protecting against account hijacking and covering segregation and separation</td></tr><tr><td>Information Protection Processes/Procedures</td><td>Partial</td><td>Operational security procedures for administrators covering secure service administration</td></tr><tr><td>Continuous Security Monitoring</td><td>Partial</td><td>Systematic audit logging routines for identifying abuse and nefarious use of cloud services</td></tr></tbody></table>

The policy framework is a first step towards cloud-ready security legislation applicable to advanced metering systems in the European Union. The policy framework is specified at a high level and serves as a preliminary proposal at this time. However, it can be further developed and refined with feedback from the various stakeholders, which would enhance the possibility of implementation. A well-composed set of cloud security requirements may be the primary motivation for grid operators to acquire the knowledge and competence needed to fully manage the security of outsourced advanced metering systems in the cloud.
## 7. Conclusions

Advanced metering applications that operate with cloud resources or even reside in the cloud are being built around advanced metering infrastructure backbones, drawing new cloud-related cyber security risks. These risks must be managed by grid operators and authorities may need to mandate appropriate security principles to manage the risks. This research has demonstrated that existing European Union legislation applicable to advanced metering systems has gaps related to cloud security. The gaps were identified by mapping security principles in prominent cloud security frameworks to relevant European legislation while noting whether or not the principles are covered by the individual legislative constructs. The mapping and subsequent analysis focused on existing legislative coverage and lack thereof, not on the adequacy of the legislation in addressing the security principles for which there is already full or partial coverage.

A novel, cloud-secure European advanced metering system security policy framework is specified to assist authorities in addressing the identified gaps. This policy framework is an important first step towards creating cloud-ready security legislation that applies to advanced metering systems. Authorities overseeing cyber security and energy can employ the policy framework as a starting point for a broad debate among the various stakeholders to institute cloud-ready security policies for advanced metering systems. The next steps are to discuss the policy framework in industry seminars at the member state levels and pass the knowledge gained to European organizations such as the Council of European Energy Regulators (CEER) and the European Union Agency for the Cooperation of Energy Regulators (ACER). In fact, ACER is currently contributing to new legislation for the European energy sector called the Network Code on Cybersecurity [13]. Considerable efforts will be required on the part of all the stakeholders, industry groups, consumers and authorities, to articulate, and eventually legislate, a holistic European advanced metering system security policy framework. But this must be done because the migration of electric power management and distribution functionality to the cloud significantly elevates the threats to critical infrastructure as well as personal privacy.

A potential limitation of the research is that elements of security principles may have been lost during the consolidation phase. This is because, in some instances, there were no clear or matching levels of aggregation between the NIST CSF categories, cloud security frameworks and European Union legislative constructs. Another limitation is that the focus on cloud security principles ignored other important principles
ples such as security testing, backup and restoration. These and other
missing principles should be incorporated in a holistic security policy
framework.

One aspect of future research is to assess how European Union se-
curity policies cover fully-managed advanced metering systems. Ad-
vanced metering system suppliers have begun to offer complete AM-
SaaS solutions, including complete advanced metering ecosystems that
incorporate leased smart meters and communications networks, and di-
verse cloud-based advanced metering applications. Consequently, cloud-
outsourcing of advanced metering systems will have a much larger phys-
ical scope and induce increased risks related to vendor lock-in, lack of
transparency and supply chains.

Acknowledgements

This research was supported by the Norwegian Energy Regulatory Authority in the Norwegian Water Resources and Energy Directorate. The authors wish to thank Ph.D. candidate Jenny Sjastad Hagen of the University of Bergen and the Bjerknes Center for Climate Research for her critical reading and language vetting. The authors also wish to thank Ms. Guro Grotterud of the Norwegian Energy Regulatory Authority for providing valuable comments during the preparation of this chapter.

References

[1] C. Alaton and F. Tounquet, Benchmarking Smart Metering Deploy-
ment in the EU-28, Final Report, Directorate-General for Energy,
European Commission, Brussels, Belgium, 2019.

[2] Australian Cyber Security Centre, Cyber Security Principles, Canberra, Australia (www.cyber.gov.au/acsc/view-all-content/guidance/cyber-security-principles), 2022.

[3] D. Avancini, J. Rodrigues, S. Martins, R. Rabelo, J. Al-Muhtadi and P. Solic, Energy meter evolution in smart grids: A review, *Journal of Cleaner Production*, vol. 217, pp. 702–715, 2019.

[4] R. Bago and M. Campos, Smart meters for improved energy demand management: The Nordic experience, in *Eco-Friendly Innovation in Electricity Transmission and Distribution Networks*, J. Bessede (Ed.), Woodhead Publishing, Sawston, United Kingdom, pp. 339–361, 2015.

[5] Cloud Security Alliance, Top Threats to Cloud Computing – The Egregious 11, Seattle, Washington (cloudsecurityalliance.org
/artifacts/top-threats-to-cloud-computing-egregious-ele ven), August 6, 2019.

[6] Cloud Security Alliance, Cloud Controls Matrix (CCM), Seattle, Washington (cloudsecurityalliance.org/research/cloud-con trols-matrix), 2022.

[7] C. Cuijpers and B. Koops, Smart metering and privacy in Europe: Lessons from the Dutch case, in *European Data Protection: Coming of Age*, S. Gutwirth, R. Leenes, P. de Hert and Y. Poullet (Eds.), Springer, Dordrecht, The Netherlands, pp. 269–293, 2013.

[8] EME Analys, Introduction of AMI Systems in Sweden and Europe (in Swedish), Stockholm, Sweden (docplayer.se/9943 18-Inforandet-av-ams-system-i-sverige-och-europa.html), 2007.

[9] S. Eskeland, Temporal anonymity in the AMS scenario without TTPs, *Proceedings of the Twelfth European Conference on Software Architecture: Companion Proceedings*, article no. 57, 2018.

[10] European Commission, 2012/148/EU: Commission Recommenda- tion of 9 March 2012 on Preparations for the Roll-Out of Smart Metering Systems, Document 32012H0148, Brussels, Belgium, 2012.

[11] European Commission, Proposal for a Regulation of the European Parliament and of the Council on ENISA, the “EU Cybersecu- rity Agency” and Repealing Regulation (EU) 526/2013, and on Information and Communication Technology Cybersecurity Certi- fication (“Cybersecurity Act”), COM/2017/0477 Final, Document 52017PC0477, Brussels, Belgium, 2017.

[12] European Commission, Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions – The European Green Deal, COM/2019/640 Final, Document 52019DC0640, Brussels, Belgium, 2019.

[13] European Network of Transmission System Operators for Elec- tricity, ENTSO-E and the EU DSO Entity submit the network code on cybersecurity for ACER review, News Release, Brus- sels, Belgium (www.entsoe.eu/news/2022/01/14/entso-e-and- the-eu-dso-entity-submit-the-network-code-on-cybersecu rity-for-acer-review), January 14, 2022.

[14] European Parliament and the Council of the European Union, Di- rective 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, Document 31995L0046, Brussels, Belgium, 1995.
[15] European Parliament and the Council of the European Union, Directive 2014/32/EU of the European Parliament and the Council of 26 February 2014 on the Harmonization of the Laws of the Member States Relating to Making Available on the Market of Measuring Instruments, Document 32014L0032, Brussels, Belgium, 2014.

[16] European Parliament and the Council of the European Union, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), Document 32016R0679, Brussels, Belgium, 2016.

[17] European Parliament and the Council of the European Union, Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 Concerning Measures for a High Common Level of Security of Network and Information Systems Across the Union, Document 32016L1148, Brussels, Belgium, 2016.

[18] European Parliament and the Council of the European Union, Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on Information and Communications Technology Cybersecurity Certification and Repealing Regulation (EU) No. 526/2013 (Cybersecurity Act), Document 32019R0881, Brussels, Belgium, 2019.

[19] European Parliament and the Council of the European Union, Directive (EU) 2019/944 of the European Parliament and of the Council of 5 June 2019 on Common Rules for the Internal Market for Electricity and Amending Directive 2012/27/EU, Document 32019L0944, Brussels, Belgium, 2019.

[20] European Union Agency for Network and Information Security, ENISA Smart Grid Security: Recommendations for Europe and Member States, Heraklion, Greece, 2012.

[21] European Union Agency for Network and Information Security, Smart Grid Threat Landscape and Good Practice Guide, Heraklion, Greece, 2013.

[22] Federal Office for Information Security, Mapping from the BSI Cloud Computing Compliance Controls Catalog (C5) to ISO/IEC 27017, Bonn, Germany, 2018.

[23] M. Fenwick, W. Kaal and E. Vermeulen, Regulation tomorrow: What happens when technology is faster than the law? *American University Business Law Review*, vol. 6(3), pp. 561-594, 2017.
[24] International Organization for Standardization and International Electrotechnical Commission, ISO/IEC 27001:2013 Information Technology – Security Techniques – Information Security Management Systems – Requirements Standard, Geneva, Switzerland, 2013.

[25] International Organization for Standardization and International Electrotechnical Commission, ISO/IEC 27002:2013 Information Technology – Security Techniques – Code of Practice for Information Security Controls Standard, Geneva, Switzerland, 2013.

[26] International Organization for Standardization and International Electrotechnical Commission, ISO/IEC 27015:2015 Information Technology – Security Techniques – Code of Practice for Information Security Controls Based on ISO/IEC 27002 for Cloud Services Standard, Geneva, Switzerland, 2015.

[27] C. Johnson, Analyzing the causes of the Italian and Swiss blackout, 28th September 2003, *Proceedings of the Twelfth Australian Workshop on Safety-Critical Systems and Software and Safety-Related Programmable Systems*, pp. 21–30, 2007.

[28] Kamstrup, OMNIGRID – The digital substation, Skanderborg, Denmark (www.kamstrup.com/en-en/electricity-solutions/smart-electricity-meters/omnigrid), 2022.

[29] Kamstrup, Services and training for electricity utilities, Skanderborg, Denmark (www.kamstrup.com/en-en/electricity-solutions/services), 2022.

[30] National Cyber Security Centre, Cloud Security Guidance, London, United Kingdom (www.ncsc.gov.uk/collection/cloud/the-cloud-security-principles), 2018.

[31] National Institute of Standards and Technology, Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1, Gaithersburg, Maryland (nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf), 2018.

[32] Norwegian National Security Authority, The National Security Authority's Basic Principles for ICT Security (in Norwegian), Oslo, Norway (nsm.no/getfile.php/133747-1592917276/Dokumenter/Veiledere/nsm_grunnprinsipper_for_ikt-2018.pdf), 2018.

[33] C. Osaretin, Smart Meter and Energy Management in an Integrated Power System (www.researchgate.net/publication/305043932_Smart_Meter_and_Energy_Management_In_An_Integrated_Power_System), 2016.
[34] Power Engineering International, Intervention saves 11bn-pound UK smart meter system from potential mass hack, Maarssen, The Netherlands, March 18, 2016.

[35] H. Saele, K. Ingebrigtsen and M. Istad, Advanced Netering and Management Systems of the Future (in Norwegian), Report No. 34/2019, Norwegian Water Resources and Energy Directorate, Oslo, Norway (publikasjoner.nve.no/rapport/2019/rapport2019_34.pdf), 2019.

[36] S. Sahoo, M. Hota and K. Barik, 5G networks, a new look into the future: Beyond all generation networks, *American Journal of Systems and Software*, vol. 2(4), pp. 108-112, 2014.

[37] H. Shahinzadeh and A. Hasanalizadeh-Khosroshahi, Implementation of smart metering systems: Challenges and solutions, *TELKOMNIKA Indonesian Journal of Electrical Engineering*, vol. 12(7), pp. 5104-5109, 2014.

[38] Siemens, Cloud-based apps and services for advanced metering infrastructure (AMI), Munich, Germany (new.siemens.com/global/en/products/energy/energy-automation-and-smart-grid/managed-services.html), 2022.

[39] Smart Energy International, Puerto Rico smart meters believed to have been hacked – and such hacks likely to spread, Cape Town, South Africa, April 11, 2012.

[40] Union for the Coordination of Transmission of Electricity, Final Report: System Disturbance on 4 November 2006, Brussels, Belgium (eepublicdownloads.entsoe.eu/clean-documents/pre2015/pu2015/publications/ce/otherreports/Final-Report-20070130.pdf), 2007.

[41] U.S. Department of Energy, Advanced Metering Infrastructure and Customer Systems: Results from the Smart Grid Investment Grant Program, Washington, DC (www.energy.gov/sites/prod/files/2016/12/f34/AMI%20Summary%20Report_09-26-16.pdf), 2016.