NCCS: The Network Code on Cybersecurity, the Duties for TSOs and DSOs

The first EU cyber rulebook just for electricity

Every energy utility knows NIS2 by now. The NCCS is something different. Not a cross-sector law for all critical industries, but a regulation that asks a single question: what happens to cross-border electricity flows if someone hacks you?

The answer sits in Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024, in force since 13 June 2024. It supplements the electricity market regulation 2019/943 and thereby moves cybersecurity to where the European power system is governed anyway: into the network codes.

Why a dedicated rulebook? Because the power grid is Europe's most tightly coupled critical sector. A bank can be hacked nationally. A transmission grid cannot. Frequency and load flows stop at no border, so the regulation no longer does either.

Who is covered: far more than TSOs and DSOs

Strictly speaking, the title of this page is too narrow. TSOs and DSOs are the core addressees, but the NCCS reaches everywhere a disruption could hit cross-border flows. The list is long.

• Transmission and distribution system operators
• Generators, storage operators, aggregators and demand response providers
• NEMOs and electricity market platforms, balancing responsible parties
• Regional coordination centres, ENTSO-E and the EU DSO Entity itself
• Critical ICT service providers and managed security providers
• Operators of recharging points

The last item surprises many. Charge point operators sit on the same list as transmission operators, because controllable load becomes grid-relevant in aggregate. One more peculiarity: companies outside the EU can also be designated if their systems influence European electricity flows.

The classification: ECII, high-impact and critical-impact

The heart of the NCCS is a two-tier classification. The measure is the Electricity Cybersecurity Impact Index, ECII for short, developed by ENTSO-E and the EU DSO Entity.

High-impact means a disruption would have a major effect on cross-border flows. Critical-impact means it would lead to critical interruption or destabilisation. For Germany the provisional thresholds sit at 1,500 MW and 3,000 MW. Provisional, because the formal designation by the authorities only follows in mid-2027; until then the associations work with provisional lists.

The roadmap to 2028

"Obligations by 2026" is a common reading, and it is only half true. 2026 is the year of methodologies and preparation. The hard entity duties follow in 2027 and 2028. That is no all-clear, it is the reason 2026 matters: afterwards the lead time is gone.

The duties in detail

What lands on designated entities is a complete management system with a duty of proof. Considerably more than a virus scanner and an emergency binder.

The foundation is a cybersecurity management system built on European and international standards, in practice the ISO 27001 family. On top sits a risk management cycle of context analysis, assessment, treatment and acceptance, to be run completely every three years. All of it is verified externally: the full scope at least every three years, partial audits yearly.

Two duties go beyond the usual ISMS. First, the reporting of significant cyberattacks under the Cyber-Attack Classification Scale, a dedicated severity scale; a complete NIS2 notification under Article 23 satisfies this duty too. Second, the supply chain: controls across the entire ICT lifecycle, personnel background checks, secure by design, zero-trust architectures and contractually secured audit rights towards suppliers. Under Article 27, entities must even actively report their critical ICT service providers to the authority.

And there will be drills. The NCCS demands cybersecurity exercises at several levels, from the individual company up to regional crisis simulation. The information exchange runs under the Traffic Light Protocol.

German perspective: three frameworks stacked

No German grid operator implements the NCCS on a green field. NIS2 transposition, the IT security catalogue under Section 5c EnWG and the KRITIS umbrella act run in parallel, with the Federal Network Agency as the common bracket. It is currently consolidating its security catalogues; the new framework becomes binding from October 2026.

That is precisely the German homework: three reporting logics. The 24-hour deadline for security incidents from national law, the NIS2 cascade of initial and follow-up reports, the CACS notification under the NCCS. Without a shared reporting matrix, in an emergency either nobody reports or everyone reports three times.

Challenges and risks

The NCCS is hard to fault on substance, a coordinated attack on the interconnected grid is one of Europe's most real disaster scenarios. The burden lies in implementation.

One structural point remains: the NCCS regulates impact on cross-border flows, not national security of supply. An attack that only hits a German distribution grid stays under NIS2 and the national catalogue. The three frameworks complement each other, but none makes the others redundant.

What grid operators should do now

Wait for the designation? You can. Then the CSMS build starts exactly when the twelve-month clock for the first risk report is already running. The alternative: use 2026 as the preparation year it is.

Five steps for 2026

1. Self-assess against the ECII thresholds

   Does your controllable generation or load exceed 1,500 MW? Even just below, the look is worth it, the methodology keeps being refined until 2027 and the thresholds are provisional.

2. Gap analysis against the existing ISMS

   Lay the ISO 27001 based ISMS from the national catalogue next to the NCCS requirements. Experience says the gaps are called: supply chain controls, CACS reporting capability, exercise programme.

3. Bring the reporting paths into one matrix

   NIS2, national catalogue and NCCS side by side: who reports what, to whom, within which deadline? One page of paper that saves hours in an emergency.

4. Sharpen supplier contracts

   Audit rights, security requirements and exit clauses for critical ICT service providers belong in every contract renewal now. Renegotiating under time pressure in 2027 gets expensive.

5. Actively follow the 2026 methodology documents

   The Union-wide risk report in mid-2026 and the controls proposal in early 2027 define what will later be audited. Whoever reads along knows their duties before the designation.

The NCCS is part of a larger pattern: the EU is shifting energy regulation from national catalogues to directly applicable regulations, from the Data Act to the network codes. Whoever sets up their security and data architecture cleanly once serves all three frameworks from one system.

Further reading

Frequently asked questions