Risk Assessments in Virtual Power Plants with NESCOR Criteria, Practical Application, Advantages and Disadvantages

Cyber security in the energy sector is paramount to the safe and reliable generation, transmission, and delivery of electrical energy. In the paradigm of the Virtual Power Plant, a structure which aggregates the output of multiple Distributed Energy Resources and connects to the grid as one entity, it is particularly challenging to prioritize those security controls and countermeasures that measurably improve its security posture. Assessing and framing cyber risk is critically important to enable such endeavors. The National Electric Sector Cybersecurity Organization Resource (NESCOR) has published an assessment framework for the energy sector as part of a study on failure scenarios. This paper presents the results of a practical application of this methodology with an adaptation to VPP specifics and illuminates some of the advantages and challenges present in the process.