# Evaluating Cybersecurity Risks of Bulgaria's Energy Sector: Focus on PV and HVAC-R
## 2 Literature Review
### Cybersecurity Regulations Concerning Electric Power Systems  
A number of documents regarding the cybersecurity of energy facilities have been published. * IEC 61850 for intelligent electronic devices in electrical substations [57]. The IEC 61850-7-420 standard defines key points in an electrical substation automation system design. More specifically, it demonstrates which data models need to be set in designs of communication networks for the power utility automation of distributed energy resources. The model allows devices to understand the semantics of the data exchanged between each of them (such as measured parameters with respective units and expected ranges, control commands, alarms, flags, set points, etc.) seamlessly. * Regulation 2024/2847 on horizontal cybersecurity requirements for products with digital elements known as the Cyber Resilience Act (CRA) [58]. The scope of the CRA is to safeguard businesses and consumers buying software and hardware products with digital components by requiring manufacturers and retailers to ensure cybersecurity throughout the respective product's lifecycle. Critical products need to undergo a third-party assessment by an EU authorized structure before introducing them on EU markets. Such products are therefore marked with the \"CE\" marking to indicate compliance. * Directive 2022/2555 on measures for a high common level of cybersecurity across the EU known as the Network and Information Security Directive (NIS 2) [59]. This directive presents a mandatory cybersecurity framework based on the original NIS directive with an expanded scope of critical infrastructures and essential service operators in the sectors of transport, energy, banking, healthcare, public electronic communications, social platforms, waste and wastewater management, postal and courier services, etc. Medium-sized and large entities operating in these critical sectors have to take cybersecurity measurements, regularly train employees and management in cybersecurity, and notify the relevant authorities of significant incidents. * The IEC 62443 series of standards on cybersecurity for industrial and automation systems [60]. The IEC 62443 series of standards provides a structured framework to address cybersecurity challenges in industrial and automation systems through a holistic approach between people, processes, and technology, based on shared responsibility. It is also used to help asset owners and stakeholders to determine the necessary security level and to assess risk. PLCs and SCADA systems have successfully become more secure and continue to be a cornerstone in CPSs due to measures taken by the authorities and industry. However, there are some gaps left unaddressed by these documents as well as the ENISA guidelines [61] and the industry-specific guidance of IEEE standard 1547.3 towards distributed energy resources [62]. There are precedents of devices and technology being compromised and weaponized such as the 2024 attacks in Lebanon [63], the cyber espionage by Huawei [64; 65], the SWIFT ban on Russian banks after its invasion on Ukraine, the findings of suspicious components in imported energy technology [66], etc. The regulations cited above do not deal with peaceful technology that has been intentionally weaponized. Only large utility-scale PVs are subjected to these regulations. Residential PVs are too small to be classified as essential, important, or critical entities. Residential PVs are generally overlooked as individually they are significantly smaller (<30 kWp) than large PV farms (>10 MWp). However, they have increased drastically in recent years and are collectively closing in in terms of power. The newly developed Network Code on Cybersecurity (NCCS) [67] focuses on grid operators. However, residential PVs are only connected to the grid electrically (internet connection is provided by the inverter's own network), which in most cases is through the existing point of common coupling. Thus, there is no dedicated professional operator or a cybersecurity branch.