Grid infrastructure attack

The threat

An intrusion into grid operations triggers protective trips and localised outages. National authorities engage, the public wants answers, and every restoration step must be weighed against stability and safety.

Key injects

• 01A substation trips; load sheds cascade to neighbouring feeders.
• 02A national CERT requests a joint bridge call.
• 03Social media amplifies outage reports and speculation.
• 04Restoration risks a second trip if sequenced wrongly.

What's assessed

• Inter-agency coordination and information sharing
• Public-safety and outage communication
• Safe restoration sequencing
• National-security escalation judgement

Exercise objectives

• Run a defensible restoration sequence: no reconnection step without a documented stability check.
• Draft the 24-hour early warning along the NIS2/KRITIS reporting chain and run the national CERT bridge call professionally.
• Keep public outage communication accurate while attribution is still open.
• Hold one decision log across grid operations, security and government stakeholders.

Roles at the table

• ●Crisis team lead · Coordinates control room, security and authorities; keeps one picture of the grid and one log.
• ●IT / SOC · Separates protective trips from intrusion effects; clarifies what the intruder touched and which telemetry to trust.
• ●Grid control-room lead · Owns load management and restoration sequencing; nothing reconnects without their stability check.
• ●Communications · Outage maps, press lines and social-media rumour control under national attention.
• ●Legal / regulatory affairs · Reporting duties along the NIS2/KRITIS chain (24 h / 72 h / 1 month) and the liability behind shedding decisions.
• ●Executive management · Faces ministry and regulator, approves extraordinary measures, carries the public responsibility.

Discussion prompts

• 01A wrong restoration order risks a second trip. Who owns the restart sequence: grid operations or the crisis team?
• 02The national CERT wants indicators now; forensics is twenty percent done. How much do you share, and how fast?
• 03Social media already says 'cyber attack on the grid'. You cannot confirm it. What is your first public sentence?
• 04Load shedding hits a district with a hospital. Who decided, on which criteria, and can you show both afterwards?
• 05At what point does this stop being your incident and become a national-security matter, and are you prepared for that handover?
• 06The 24-hour early warning is due with the root cause unknown. What goes in, and what deliberately stays out?

Suggested timeline

• 00:00–00:25Substation trip and cascade: situation picture, crisis declaration
• 00:25–01:10Stabilisation: load management, isolation of suspect systems
• 01:10–01:50Authorities engage: CERT bridge call, early warning drafted (24 h)
• 01:50–02:35Restoration sequencing under uncertainty; public communication
• 02:35–03:00Hot wash: decision trail, reporting chain, 72-hour follow-up planned