Recent cyberattacks on European electricity companies have reinforced the need for a common and collaborative effort to enhance ecosystem-wide cyber resilience, e.g. ENTSO-E,12 EDP13 and ELEXON.14 The European Commission Regulation on the Internal Market for Electricity (COM/2016/0861) provides for the adoption of technical rules (e.g. a network code) across the electricity ecosystem. In April 2019, an EU Commission recommendation on cybersecurity in the energy sector highlighted that “smart grid” digitalization increasingly exposes the energy system to cyberattacks and incidents that may jeopardize the security of energy supplies.15 Already, the European transmission system operator (TSO; ENTSO-E) and distribution system operator (DSO; E-DSO, EURELECTRIC, GEODE and CEDEC) communities are working together to develop recommendations and drive a consultation process on initial proposals for a cybersecurity network code. The initial proposals include recommendations on: – Inclusion of ISO 27001 certification using a common scope. – Identification of critical IT and OT systems and components through a common cyber-risk assessment process. – Inclusion of a common set of functional security requirements for systems and components. – Inclusion of a product assurance scheme whereby functional security requirements can be independently tested and results shared. – Introduction of an information-sharing process for the distribution of technical cyber-incident information. The selected recommendations will undergo a formal consultation process with other energy-sector stakeholders in 2021 supported by ENTSO-E. Once finalized, the cybersecurity network code recommendations will affect the European energy sector by enforcing energy stakeholders to comply and implement cybersecurity actions.