How Britain Would Restart the Electricity Grid After a Cyber Attack

A successful cyber attack on Britain’s electricity system would not necessarily produce a nationwide blackout. Most attacks against energy companies affect business systems, customer data, billing or communications without interrupting the physical flow of electricity.

However, the most serious scenario would be an attack that disrupted operational technology, disabled control-room systems, manipulated network data or caused operators to disconnect equipment as a safety precaution. If enough generation and network infrastructure were lost simultaneously, parts of Great Britain could suffer a partial or total shutdown.

Restarting the system would involve far more than switching power stations back on. Electricity generation, transmission and demand would have to be rebuilt in carefully controlled stages. Communications would need to work without normal mains power. Control-room information would have to be trusted. Engineers might need to operate substations locally, while cyber specialists established which digital systems remained safe.

The formal process was traditionally called Black Start. The industry increasingly uses the term Electricity System Restoration, but Black Start remains widely understood.

This article explains how that restoration would work, why communications and digital systems are critical, and how a cyber attack could make an already difficult engineering operation significantly more complicated.

If a cyber incident ever caused widespread system failure, How Britain Would Restart the Electricity Grid After a Cyber Attack explains how Black Start providers, power islands, control rooms and emergency communications would be used to rebuild the network.

First, Britain does not have one enormous electricity switch

Britain’s electricity system is a collection of interconnected organisations, networks and generating assets.

The National Energy System Operator, or NESO, balances the electricity system across Great Britain. It coordinates generation and demand and oversees system restoration. National Grid Electricity Transmission, Scottish Power Transmission and Scottish and Southern Electricity Networks Transmission own and operate different parts of the high-voltage transmission network.

Distribution network operators take electricity from the transmission system and deliver it through regional networks to homes and businesses. Generators, interconnectors, battery sites, renewable installations and large industrial users all have separate operational responsibilities.

Electricity suppliers are different again. A supplier may send bills, manage tariffs and buy energy on the wholesale market, but it does not normally control the local cables supplying a customer’s home.

This distinction matters. A ransomware attack on a supplier’s billing system could cause serious disruption without stopping electricity. An attack on a transmission control system, protection system or operational communications network would present a very different risk.

That is why Could a Cyber Attack Cause a UK-Wide Power Cut? must be considered in terms of generation, transmission, distribution, balancing and restoration—not simply whether an energy company has been “hacked”.

Northern Ireland is also an important exception. It is not part of the Great Britain synchronous electricity system managed by NESO. Northern Ireland operates within the all-island Irish electricity system, so its restoration arrangements are separate.

What Black Start actually means

A power station normally needs electricity before it can produce electricity

It sounds contradictory, but most large power stations cannot simply start themselves from complete darkness.

They may need electricity for:

• Control and protection equipment
• Fuel pumps
• Cooling systems
• Lubrication pumps
• Ventilation
• Water treatment
• Instrumentation
• Communications
• Safety systems
• Excitation equipment used by generators

Under normal conditions, this power comes from the grid or from the station’s own operating units. During a total shutdown, neither source may be available.

A restoration-capable generator must therefore be able to start independently of the external electricity system, or receive power from another specially prepared source. A smaller auxiliary generator, hydroelectric unit, dedicated diesel generator, battery system or another suitable installation may provide the initial energy.

The restoration service provider must then be able to energise part of the network, help start other generators and accept carefully controlled blocks of electricity demand.

Black Start is a sequence, not a single event

The first generator does not immediately reconnect millions of homes. It creates a small, stable electrical island.

From there, operators can:

• Energise selected transmission lines
• Supply auxiliary power to another generator
• Start additional generating units
• Establish a larger power island
• Reconnect essential demand
• Join neighbouring islands together
• Rebuild a stable national system

Every stage must be controlled. Reconnecting too much demand can cause frequency to fall and collapse the newly established island. Energising long transmission lines can create difficult voltage conditions. Connecting two power islands that are not properly synchronised could damage equipment and cause another shutdown.

Restoration is therefore closer to assembling an aircraft in flight than flicking a master switch.

The national restoration standard

Great Britain’s Electricity System Restoration Standard requires NESO to have sufficient capabilities and arrangements to restore:

• 60% of electricity demand in each region within 24 hours
• 100% of Great Britain’s electricity demand within five days

NESO is required to have the necessary arrangements in place by 31 December 2026. The standard is intended to strengthen and regionalise restoration capability, reducing dependence on a small number of traditional large power stations. NESO’s Electricity System Restoration Standard explains the targets and implementation deadline.

These figures require careful interpretation. They are planning and capability requirements, not a guarantee that every household would regain power within a particular number of hours after every conceivable attack.

The actual restoration time would depend on:

• The physical damage caused
• Which generators remained available
• Weather and electricity demand
• The condition of transmission and distribution networks
• Whether communications were functioning
• Whether control systems could be trusted
• Whether attackers remained inside operational networks
• The availability of trained staff
• The ability to obtain fuel, transport and replacement equipment

A cyber attack that caused no physical damage might be recovered from faster than a severe storm or coordinated sabotage. Conversely, an attacker who corrupted systems, destroyed equipment and disrupted communications could make restoration much slower.

How the restoration process would begin

The first task would be understanding what had happened

Immediately after a major loss of electricity, control-room operators would need to determine whether the cause was:

• A technical failure
• Extreme weather
• Physical sabotage
• A cyber attack
• A combination of events
• An apparently routine fault being exploited by an attacker

A cyber incident creates a particularly dangerous information problem. Operators might still see data on their screens, but they could not automatically assume it was accurate.

An attacker could potentially:

• Hide the true status of circuit breakers
• Alter alarms
• Suppress equipment warnings
• Manipulate voltage or frequency readings
• Create false operator accounts
• Interfere with remote-control commands
• Corrupt network models
• Disable event logs
• Interrupt communications between organisations

Electricity engineers would therefore have to compare information from multiple independent sources. This could include substation reports, protection-system records, local instrument readings, dedicated telecommunications channels and direct voice confirmation from field engineers.

Unsafe systems would be isolated

If investigators suspected that an operational network had been compromised, affected organisations could disconnect systems from wider networks, disable remote access and restrict privileged accounts.

That might prevent further malicious activity, but it could also remove some of the digital tools normally used to control the grid.

Cyber containment and electrical restoration could therefore pull in opposite directions. The cyber team might want a system switched off and preserved for forensic examination. The control room might need that same system to restore electricity.

The decision would be based on safety and essential operational needs. Restoring power quickly would not justify reconnecting a system capable of sending dangerous or unauthorised commands.

Restoration instructions would be activated

NESO, transmission owners, distribution operators and contracted restoration providers maintain plans for serious electricity emergencies.

Once a total or partial shutdown had been confirmed, restoration plans would identify:

• Which restoration providers should start
• Which transmission routes should be energised
• Which substations must be configured
• Which generators should receive start-up power
• Which demand blocks should be reconnected
• How separate power islands should be coordinated
• Which communications channels should be used

Exact technical plans are understandably not published in operational detail. Publicly disclosing every restoration route, communications dependency and critical site would itself create a security risk.

Starting the first generator

A restoration-capable plant would start using an electricity source that did not depend on the wider grid.

Hydroelectric generation has traditionally been well suited to this role because some hydro units can start relatively quickly and need comparatively little auxiliary power. Certain gas-fired units, interconnectors and other generating technologies can also provide restoration services where they meet the technical requirements.

The generator must establish stable voltage and frequency before it can energise other equipment. Britain’s electricity system normally operates at approximately 50 hertz. During restoration, frequency can move more sharply because a small electrical island has less inertia and fewer resources available to correct disturbances.

The first unit must be able to cope when sections of network and blocks of demand are added. If operators connect too much demand at once, the generator can slow, frequency can fall and protection systems may disconnect it.

That would return the local system to darkness and force the restoration sequence to begin again.

Creating a power island

Once the first generator was stable, operators could energise a selected section of the transmission or distribution network.

This creates a power island: a small part of the electricity system operating independently from the rest of the country.

The initial island might contain:

• A restoration-capable generator
• Selected transmission lines
• One or more substations
• Carefully controlled local demand
• Auxiliary supplies for another power station

Adding some demand is often necessary. A generator cannot necessarily operate securely with no load, but the demand must be predictable and added gradually.

Hospitals and other essential services would be high social priorities, but the electrical sequence cannot be organised purely according to public importance. Operators must first create a technically stable route capable of supporting those services.

Some hospitals, emergency centres, water facilities and telecommunications sites would initially rely on batteries or standby generators. Their endurance would become an important factor if restoration continued for many hours.

Starting larger power stations

The first restoration source may not be large enough to supply a city. Its role may instead be to provide the electricity needed to start a much larger generator.

A prepared transmission route would be energised from the initial power island to the next station. That station would use the incoming supply for pumps, controls, cooling and other auxiliary equipment.

Once synchronised, the larger generator would increase the island’s capacity. More network sections and demand could then be added.

This process would be repeated across different regions. Britain might temporarily operate as several separate electrical islands rather than one national system.

Reconnecting the islands

Joining two live electrical islands is one of the most sensitive stages.

Their voltage, frequency and electrical phase must be sufficiently aligned before the connecting circuit breaker is closed. If they are badly out of synchronism, very large electrical and mechanical stresses can result.

Operators would use synchronisation equipment and control-room information to confirm that conditions were acceptable. In a cyber incident, the integrity of these measurements would be critical.

A false frequency or phase reading would not be a minor data error. It could cause physical damage.

This is one reason cyber resilience cannot be separated from electrical engineering. The confidentiality of data matters, but during system restoration, its integrity and availability are often even more important.

Why communications could decide whether restoration succeeds

Control rooms cannot restore Britain in isolation

Restoration requires coordination among:

• NESO
• Transmission owners
• Distribution network operators
• Restoration service providers
• Power-station control rooms
• Substation engineers
• Field response teams
• Telecommunications providers
• Government and emergency services

NESO’s communications work for the restoration standard identifies the need for:

• Real-time telemetry for operating the network
• SCADA and protection-system communications
• Status data and situational awareness
• Voice communications between participants
• Resilient data and voice services at primary restoration sites

The published communications report specifies 72 hours of independence from mains electricity for data and voice communications at primary restoration sites. It also considers technologies including fibre, microwave radio, private radio, satellite, private LTE and public mobile networks. NESO’s Communication Infrastructure Working Group reportprovides the detailed public requirements.

Ordinary mobile phones may not be enough

Mobile base stations normally have backup power, but their endurance is not unlimited. Batteries may last only for a defined period, while generator-supported sites depend on fuel and physical access.

During a widespread blackout, mobile networks could also become congested as millions of people attempted to call relatives, obtain information or contact emergency services.

Restoration communications therefore cannot rely solely on ordinary mobile phones or public internet connections. Dedicated operational telecommunications, private fibre, radio and satellite services provide alternative routes.

Resilience requires diversity. Two communications services are not genuinely independent if both pass through the same exchange, use the same power supply or depend on the same software platform.

Voice communication remains essential

Modern grids depend heavily on automated data, but human voice communication remains crucial during an abnormal event.

An operator may need to confirm:

• The physical position of a circuit breaker
• Whether a substation is safe to energise
• Whether staff are present
• Whether a generator has completed its start-up sequence
• Whether a protection system has operated
• Whether remote commands are being received correctly
• Whether a communications channel itself may be compromised

During a cyber incident, a trusted voice conversation can provide an independent check against manipulated screen data. However, identity verification becomes important. Operators must be confident that the person issuing an instruction is authorised to do so.

The control-room access problem

Attackers might target identities rather than machinery

A sophisticated attacker would not necessarily need to write specialist malware for every substation. Stealing administrator credentials, compromising remote-access services or taking control of an engineering workstation could provide a route into operational environments.

If there were evidence that privileged accounts had been stolen, operators could not simply change one password and continue.

They might need to:

• Disable remote-access gateways
• Revoke digital certificates
• Reset privileged accounts
• Replace authentication tokens
• Inspect operator workstations
• Rebuild compromised servers
• Validate configuration files
• Review logs from independent sources
• Restrict operations to known terminals and locations
• Require two-person approval for sensitive commands

The National Cyber Security Centre advises that response plans should prioritise essential functions and the operational technologies and datasets needed to maintain them. Plans should also be auditable, testable and exercised against realistic scenarios. NCSC Cyber Assessment Framework: Response and Recovery Planning.

Backup control rooms are useful, but not automatically safe

Network operators maintain alternative facilities and business-continuity arrangements. If a primary control room became inaccessible, staff could transfer operations elsewhere.

But a second control room is not a complete answer if it depends on:

• The same compromised identity platform
• The same network-management software
• Replicated corrupted data
• The same external communications provider
• The same remote-access infrastructure
• Backups infected before the attack was discovered

Cyber resilience requires logical separation as well as a separate building.

A restoration control environment must be demonstrably trustworthy. That may mean using isolated recovery systems, known-good software images, offline configuration backups and emergency accounts that are not dependent on the compromised corporate network.

Physical access might become necessary

If remote control was unavailable or considered unsafe, engineers could be sent to substations and generating sites to inspect and operate equipment locally.

Local operation is slower. It requires trained personnel, safe site access, working communications and accurate instructions. Travel may also be difficult during a widespread blackout because traffic lights, fuel stations, rail services and public communications could be disrupted.

The more Britain’s energy system depends on remote and automated operation, the more important it becomes to retain tested methods for degraded or manual operation.

Britain’s dependency on digital systems

Electricity networks were once operated with more local staff, analogue instruments and direct voice instructions. Modernisation has made the system more efficient and observable, but it has also increased dependency on digital technology.

Key systems can include:

• Supervisory control and data acquisition systems
• Energy management systems
• Distribution management systems
• Automatic generation control
• Network-modelling software
• Protection relays
• Substation automation
• Generator control systems
• Interconnector control systems
• Weather and renewable forecasting
• Electricity market platforms
• Identity and access management
• Digital telecommunications
• Cloud-hosted support services
• Third-party monitoring and maintenance platforms

Not every system is equally critical to immediate restoration. Billing systems could remain offline without preventing the physical network from operating. Loss of real-time telemetry, protection or secure voice communications would be much more serious.

The Government’s Energy Sector Cyber Security Strategy 2026–2030 recognises the risks created by legacy infrastructure, new technologies, critical suppliers and concentrated dependencies. It calls for tested cross-sector response and recovery arrangements, improved understanding of critical components and greater resilience against sophisticated attackers. UK Government Energy Sector Cyber Security Strategy 2026–2030.

When automation helps—and when it becomes a risk

Automation could accelerate restoration by monitoring voltage and frequency, configuring networks and coordinating distributed resources faster than a purely manual process.

But automation must behave safely when:

• Communications fail
• Data becomes delayed
• Measurements disagree
• Part of the network is compromised
• A controller loses contact with another organisation
• An operator overrides the system
• Malicious commands imitate legitimate instructions

In normal operation, a brief loss of data may be manageable. During restoration, the same failure could destabilise a small power island.

Designers therefore need secure fallback modes. Systems should fail predictably, preserve local safety and give operators a clear understanding of what remains under control.

Could solar farms, batteries and wind help restart the grid?

Traditionally, Black Start relied heavily on selected large power stations and a transmission-led, top-down restoration process.

Britain’s generation mix is changing. Coal generation has ended, while wind, solar, battery storage and distributed generation are playing larger roles. NESO and network operators have therefore investigated how smaller resources could contribute to restoration.

The Distributed ReStart project examined the creation of distribution restoration zones. Instead of waiting for the high-voltage transmission system to be rebuilt from above, a suitable local “anchor” generator could establish an island within a distribution network. Other generators and demand could then be added before the zone assisted the wider system.

Potential participants include:

• Hydroelectric generation
• Wind generation with appropriate controls
• Solar generation combined with grid-forming technology
• Battery energy storage
• Biomass or energy-from-waste facilities
• Smaller gas generators
• Other embedded generation

This is not as simple as having solar panels or a large battery nearby. The equipment must be capable of establishing or supporting voltage and frequency, operating as part of an island, accepting restoration instructions and meeting demanding communications and cyber-security requirements.

Most domestic solar installations disconnect automatically when the grid fails. This prevents electricity being exported into damaged lines and endangering engineers. A normal household solar system therefore does not become a miniature Black Start plant during a blackout.

NESO’s work describes a distribution restoration zone as a local network energised by an anchor plant, potentially supported by additional “top-up” generators. NESO Distributed ReStart Requirements Report.

What a cyber-specific restoration might look like

The first few minutes

Protection systems would disconnect unstable or damaged parts of the network. Control rooms would assess the scale of the outage and determine whether the system had separated into surviving islands.

At the same time, security teams would examine indicators of compromise, unusual logins, unexplained commands and communications failures.

Emergency power would support control rooms, telecommunications sites, power stations and selected substations.

The first hour

NESO and network operators would establish trusted communications and activate restoration procedures.

Known restoration providers would be instructed to prepare or start. Operators would determine which network routes were safe to energise.

Compromised remote-access services could be disabled. Sensitive control actions might require additional authorisation or direct voice confirmation.

The following hours

Initial power islands would be established. Selected transmission lines would be energised, larger generators started and essential demand gradually reconnected.

Engineers might be deployed to sites where telemetry was missing or remote operation could not be trusted.

Cyber specialists would continue checking whether the attacker retained access. Restoring electricity while an intruder remained capable of opening breakers or altering safety settings could trigger a second failure.

The first day

If restoration proceeded successfully, separate regional islands would expand and begin reconnecting.

Electricity would not necessarily return evenly. Some places could be restored relatively quickly because they were close to a viable restoration route. Others might remain without supply while damaged, unstable or digitally compromised network sections were investigated.

The 60% regional restoration objective means planning must avoid a situation where one part of Britain recovers while another region remains almost entirely without electricity.

The following days

Remaining networks would be restored, temporary operating arrangements replaced and compromised technology rebuilt or repaired.

Full electricity restoration would not mean the cyber incident was over. Market systems, customer services, corporate networks and non-essential remote access could remain unavailable for much longer.

Investigators would need to establish:

• How the attackers entered
• Which systems they accessed
• Whether configurations were altered
• Whether data was stolen
• Whether malware remained dormant
• Whether suppliers or contractors were compromised
• Which recovery systems could be trusted

Real-world evidence from Ukraine

The most important real-world electricity cyber incidents occurred in Ukraine.

In December 2015, attackers gained access to electricity distribution environments and remotely operated breakers, causing outages affecting approximately 225,000 customers. The incident also involved destructive malware, interference with communications and attacks on supporting systems.

The US Cybersecurity and Infrastructure Security Agency reported that the affected companies continued operating in a constrained state and used manual control after the attack. CISA: Cyber-Attack Against Ukrainian Critical Infrastructure.

The lesson for Britain is not that the same attack could be copied exactly. Britain has different network arrangements, security controls and restoration procedures.

The important lessons are that attackers may:

• Combine stolen credentials with operational knowledge
• Disrupt communications as well as electricity controls
• Damage supporting IT systems to slow recovery
• Target more than one organisation
• Force operators into manual operation
• Time an attack to maximise confusion

This is also why What Would Happen If Multiple Energy Companies Were Attacked Simultaneously? matters. An attack against one company may be containable. Simultaneous disruption of network operators, generators, telecommunications and critical suppliers would place much greater pressure on restoration arrangements.

Britain has not experienced a publicly confirmed electricity cyber attack comparable to the 2015 Ukrainian incident, but Which UK Energy Companies Have Suffered Cyber Incidents? shows that organisations supporting the British energy system have already faced ransomware, data breaches and supply-chain compromises.

A British example that was not a cyber attack

The major Great Britain power interruption of 9 August 2019 was caused by an unusual combination of technical events rather than malicious cyber activity.

A lightning strike was followed by generation losses, including Hornsea One offshore wind farm and Little Barford gas-fired power station. Frequency fell sufficiently for automatic low-frequency demand disconnection to remove electricity from approximately one million customers.

The system was stabilised quickly, but disruption continued on parts of the railway because some trains did not recover properly when electricity returned.

That incident demonstrates an important principle: electrical restoration and service restoration are not identical.

Power may be available again while:

• Trains remain stranded
• Mobile networks recover
• Water systems restart
• Industrial equipment requires inspection
• Data centres transfer from generators
• Building alarms need resetting
• Heating and ventilation systems reboot
• Local equipment waits for manual intervention

After a cyber attack, organisations might deliberately delay reconnecting sensitive systems until they were confident that doing so was safe.

The supply-chain problem

A serious attacker may target the technology and service providers used by multiple energy organisations.

Potential concentration risks include:

• Common control-system vendors
• Remote-maintenance platforms
• Telecommunications carriers
• Cloud services
• Identity providers
• Software-update systems
• Specialist engineering contractors
• Security-monitoring providers
• Equipment manufacturers

The MOVEit incident affecting Elexon did not interrupt electricity supplies, but it demonstrated how a vulnerability in widely used third-party software can reach an important energy-sector organisation. This and other examples are examined in Which English Energy Companies Have Suffered Cyber Incidents?

For restoration planning, the crucial question is not simply whether an operator has backups. It is whether those backups, communications routes and recovery tools share hidden dependencies with the compromised system.

What Britain is doing to improve restoration resilience

More restoration providers

A wider range of generators and storage assets should reduce dependence on a small number of traditional power stations.

Regional restoration capability

The Electricity System Restoration Standard requires capability across regions, not merely enough generation somewhere in Great Britain.

Distributed restoration

Distribution restoration zones could allow local generation, storage and controlled demand to help rebuild the system from the bottom up.

Communications resilience

Dedicated operational communications, diverse routes and mains-independent power are being incorporated into restoration requirements.

Cyber exercises

Plans must be tested under conditions where data, communications and remote access may be unreliable. A plan that assumes every control system remains trustworthy is not a cyber-restoration plan.

Stronger energy cyber regulation

The Government’s 2026–2030 strategy places greater emphasis on critical suppliers, testing, regulatory oversight, workforce skills and cross-sector recovery.

The hardest cyber-restoration decisions

The most difficult choices would probably occur where electrical urgency and cyber caution collided.

Operators could face questions such as:

• Do we use a control system that is functioning but may be compromised?
• Do we reconnect a generator before every workstation has been examined?
• Can telemetry be trusted if one communications route is behaving abnormally?
• Should remote access remain disabled even if field teams cannot reach a site?
• Is a backup clean, or was it created after the attacker gained access?
• Can two power islands be synchronised safely with reduced digital visibility?
• Do we energise a critical service whose own systems may have been compromised?
• How much automation can be used when central coordination is degraded?

There may not be a perfect answer. Restoration planning must give trained operators safe options rather than forcing them to choose between total inaction and blind trust in compromised technology.

What households and businesses would experience

Electricity would probably return unevenly and in stages.

Customers might experience:

• Repeated short interruptions
• Low or unstable voltage in early restoration stages
• Mobile and broadband outages
• Limited access to fuel
• Disrupted card payments
• Water-supply problems
• Delayed public transport
• Unavailable supplier websites
• Conflicting online information
• Requests to reduce electricity consumption
• Controlled disconnection while the system stabilised

Power cuts should be reported to the electricity network through 105, not primarily to the electricity supplier. In an emergency involving danger to life, people should contact the emergency services.

Households and smaller organisations can also use the UK Power Cut & Cyber Impact Checker to consider their dependency on communications, medical equipment, heating, refrigeration, security systems and remote working.

What businesses should learn from Black Start

Most businesses do not need to understand transmission engineering, but they should understand their own restoration dependencies.

A realistic continuity plan should ask:

• How long will our uninterruptible power supplies last?
• Does the standby generator start automatically?
• How much fuel is stored safely on site?
• Can fuel be delivered during a widespread outage?
• Which systems must be shut down cleanly?
• Will doors and access-control systems continue working?
• Can staff communicate if mobile networks fail?
• Does equipment restart automatically when power returns?
• Could everything restarting together overload the building supply?
• Are backups accessible without cloud authentication?
• Can essential work continue without normal internet access?
• Who has authority to reconnect operational equipment?

Electricity returning to the building should not automatically trigger the uncontrolled restart of every machine, charger, heating system and server.

Final assessment

Britain could restart the electricity system after a major cyber attack, but the process would be controlled, regional and potentially slow.

Restoration would begin with generating equipment capable of starting without external electricity. Small power islands would be established, transmission routes energised, larger generators restarted and demand reconnected in carefully measured blocks. Those islands would eventually be synchronised to rebuild the wider Great Britain system.

The engineering is formidable, but a cyber attack introduces another problem: trust.

Operators would need to know that control-room data was genuine, communications were secure, remote commands were authorised and recovered systems were not still under an attacker’s control. Backup control rooms and generators would help only if they were not dependent on the same compromised identities, software, suppliers and telecommunications routes.

The decisive question would not be whether Britain still possessed enough generating capacity. It would be whether people, machinery, communications and digital systems could be brought back together safely.

Black Start is therefore no longer solely an electricity-generation service. It is a national cyber-physical recovery capability.

Reference material and research

• Electricity System Restoration Standard – National Energy System Operator
• Electricity System Restoration Communication Infrastructure Working Group Report – NESO
• Distributed ReStart Requirements Report – NESO
• Distributed ReStart Project Update – NESO
• Energy Sector Cyber Security Strategy 2026–2030 – UK Government
• Operational Technology Security Guidance – National Cyber Security Centre
• Cyber Assessment Framework: Response and Recovery Planning – NCSC
• Cyber-Attack Against Ukrainian Critical Infrastructure – CISA