How a new HVDC link got its security zones, SL-Ts and supplier requirements while the design could still change.
Composite of our HVDC transmission work. Details anonymised.
A European electricity transmission operator was building a new HVDC link. The link joins two AC grids through a converter station at each end. Its control and protection systems decide how much power flows and keep the link stable.
The operator’s contract required a cyber risk assessment during design, before equipment was bought and built. It would set the security zones, the target security levels (SL-T) and the security requirements for suppliers.
The scope covered both converter stations, AC substation automation, SCADA, station networks, engineering and remote access, and links to the control centre and suppliers. Corporate IT and external telecoms were treated as outside dependencies.
Security had to keep pace with design. The assessment had to shape the design before specifications and orders became hard or costly to change. Some controls it called for were not in the original supplier specifications. Each one raised a question: an existing obligation, or new scope with a cost?
The HVDC control and protection systems were proprietary supplier products. The team could not see inside them fully or change them freely. HVDC control runs to strict timing and availability limits. Segmentation, traffic inspection, login controls and patching all had to be checked so they did not add delay, drop links or cause unwanted trips.
The operator, main contractor, equipment suppliers and integrators each held part of the picture. The team had to agree one view of boundaries, interfaces, security roles and risk ownership. Risks, zones, SL-Ts, supplier requirements and actions also had to stay traceable across separate documents.
The work followed IEC 62443-3-2. It began by defining the system under consideration. The team read the Employer’s Requirements, the design drawings and the supplier documents. Workshops with the operator, contractor, suppliers and integrators then agreed the boundaries, key functions and interfaces. Last, the system was split into security zones and conduits.
Threat scenarios focused on what could go wrong at an HVDC link: power transfer lost, a converter blocked or tripped, protection that fails, operators losing sight of the system, or misuse of engineering and remote access. Each risk was rated for likelihood and impact against the project’s criteria. This set the SL-Ts and controls for each zone and conduit. The suppliers checked that each control would not harm availability, protection or maintenance.
Risk registers, reports, zone diagrams and requirement lists linked each risk to the systems it hit, the control, the party responsible and the requirement. Review workshops settled assumptions and raised items that needed an engineering or commercial decision. Residual risks went to the operator to accept through the project’s governance.
The assessment gave both converter stations and their links a traceable cyber risk baseline. It set the system boundary and listed the assets and interfaces. It drew the zones and conduits and kept them in a register. It recorded threat scenarios in a risk register, and set SL-Ts and security requirements. A treatment plan named each control, its owner and the residual risk. The outputs also fed detailed design and the FAT and SAT test plans.
The assessment turned HVDC cyber risks into clear engineering requirements. It showed who must deliver each control, and its effect on the project, before build.
The findings shaped decisions on network segmentation, remote access, engineering workstations and the HVDC control and protection systems. They showed which controls were needed, where they went and which supplier owned each one. Each control was checked so it would not harm availability or protection. Some controls went beyond the supplier specifications. These were raised during engineering, so their effect on scope, cost and programme could be settled before testing and commissioning.
