# Survey of Cybersecurity Governance, Threats, and Countermeasures for the Power Grid +
## 6 Recommended Gap Analysis Strategies for Cybersecurity Assurance in the Energy Sector  
While previous sections have identified individual cybersecurity threats and countermeasures for them, a combination of these security services will be required to prevent gaps in protection. NIST recommends that gap analysis be performed on individual company networks and provides a Cybersecurity framework specific for smart grids with five continuous functions [25]. * Identify--Determine assets within the organization and their risk factors for potential Cybersecurity risks. * Protect--Create safeguards to ensure delivery of infrastructure services through access control, awareness and training, data security, and information protection procedures. * Detect--Identify any Cybersecurity events with continuous monitoring. * Respond--Implement predefined procedures for response planning and communications. * Recover--Develop plans to maintain resilience and restore capabilities of services. The framework provides an in-depth procedure, recommended considerations, and information references to successfully implement each of these five functions to align with DoE's C2M2. All five functions are reliant on each other for proper implementation. For example, a failure in identification can lead to shortcomings in the implementation of protection services. For \"identification\", categories that are defined include asset management, business environment, governance, risk assessment, risk management strategy, and supply chain risk management. This set of categories is where most variability will appear within different organizations, as assets and protocols used by different devices will have different associated risks. The organization will need to identify critical functions and assets to tailor their profile for effective risk management. The goal of the \"protect\" function is to ensure security and resilience of systems, while ensuring all personnel are aware of their roles of cybersecurity within an organization. The protection service is where most of the countermeasures mentioned in the previous sections are implemented, with categories for access control, training, data security, information protection processes and procedures, maintenance, and protective technologies. These categories map directly to the countermeasures for integrity and confidentiality attacks shown in Table 2. Access control can effectively counter man-in-the-middle, replay, and privacy violation attacks. FDIA detection is also the primary detection countermeasure focused on in this paper, with the NIST \"detect\" function comprised of categories for anomalies and events, continuous monitoring, and detection processes. Implementation of these services should also identify the scope and impact of any events that take place. The final two categories in the NIST profile are aimed at the occurrence of a cybersecurity event, with \"respond\" and \"recover\". Respond is divided into categories of response planning, communications, analysis, mitigation, and improvements, whereas Recovery is divided into planning, improvements and communication. The procedures for these categories should be in place before an attack occurs, as proper response planning and communications will allow for improved response and recovery timelines. With every event, analysis and mitigation is expected to be performed, with any lessons incorporated into future improvements of response planning. After a successful response, recovery procedures will be enacted with future improvements added to procedures for future events. The goal of the framework is to aid stakeholders of any organization to identify, assess, and manage any risks that may be in their organizational network. Compliance with this framework can look vastly different between different organizations, so NIST also provides steps to implement or improve a Cybersecurity program. 1. Prioritize and Scope2. Orient
3. Create a Current Profile
4. Conduct a Risk Assessment
5. Create a Target Profile
6.