Cyber security risk assessment methods for energy systems: A systematic literature review

In recent decades, energy control networks have turned from ‘isolated islands’ into a large-scale, digitalized smart grid with ecosystem-like interdependencies. This shift opens the way for various cyber risks that were impossible beforehand. These cyber risks must be carefully assessed and treated to ensure the smooth operation of one of the most vital industries for society and the economy. The review examines the Cybersecurity Risk Assessment (CRA) approaches designed with a particular focus on energy systems. Despite the critical importance of the topic, there is no comprehensive study examining achievements in CRA for the energy sector. This article identifies the key peculiarities of the energy sector and establishes the criteria for CRA methodologies within the energy domain. We identify the existing CRA approaches designed for the energy sector, examine their core aspects, and analyse them against our energy-specific criteria. The review considers the problem from different angles, including the evaluation of mature CRA frameworks, comprehensive CRA approaches, and those CRA methods which focus on assessing a specific threat or system type. Our analysis reveals key gaps and outlines research directions for enhancing energy-specific CRA frameworks. This review is particularly valuable for cybersecurity IT specialists applying and designing CRA frameworks for the energy sector.