# Business Impact Analysis of AMM Data: A Case Study
## 6 Discussion
Furthermore, it is extremely important that, if there is an outage, it is brought back into operation as quickly as possible. According to the analysis, a backup every 24 h should be sufficient. Here, again, it would be advisable to set up a backup system that can continue to function in the event of failure of the main system. Customer data should be stored away from the system and protected by state-of-the-art encryption for maximum security. For other systems and applications, communication should always be secure, and preferably take place on an internal network, and security packages should be updated regularly. It is also advisable to regularly adjust the security policy of the entire organization according to need, and to focus on regular audits both internally and with external vendors, to ensure the most secure and reliable operation of the company. Last but not least, it is necessary to strictly ensure the reliability of external service providers in contracts and to define the legal consequences for non-compliance with standards and contractual conditions. In terms of the importance of datasets based on the classification of confidentiality, availability, and integrity, the most important assets for the AMM system and, consequently, for CEZ Distribuce, a.s., itself and the services provided by it were identified as the data sets of the meter register (BW), as well as the messages used for the management of meter functions, such as the disconnection message (ODP), connection message (PRIPO), appliance blocking message (TAR) and the active power management message (BLOCK). Of these datasets, and given their packet impact, it is arguably most important that the transmission of BLOCK information is as secure as possible, as this is the tool by which the distributor ensures the stability of the entire network in real-time. There is another network management tool, namely TAR, where blocked appliances are switched on or off, in line with the very logic of AMM as a sub-solution of the Smart Grid concept. All datasets that are in any way related to meter control should be encrypted according to the current recommendations of the National Cyber and Information Security Bureau (NCISB). Subsequently, if these datasets are used for meter access, a separate set of keys should be issued for each meter, which will be encrypted in turn according to the standards and defined by the type of meter access, data reading, rate setting adjustment, disconnect or appliance lockout, or active power control. Communication of this information should be encrypted and only occur within the internal network. Where data from meters such as PL15 and BW are involved, access should be password-protected. It should not be possible under any circumstances to overwrite the data in the meter remotely. If communication at the point of consumption is carried out by a KMZ field worker, then access to the meter should be password-protected. The KMZ worker should only work on the internal network. All communications with systems should be encrypted. The AMM datasets should be protected in a similar way to the systems in CEZ Distribuce, a.s.; their security policies should be in line with current NUKIB and ISO 27001 recommendations and should be regularly updated.