GRI industry information on disaster/emergency planning and disaster management measures
As an operator of critical infrastructure, 50Hertz is obliged by the IT Security Act and the Energy Industry Act (EnWG) to ensure that information is securely stored on systems that are necessary for maintaining security of supply. The processing, storage and communication of information must therefore be designed in such a way that the availability, confidentiality and integrity of the information and our critical systems are ensured to an appropriate degree.
Our information security management system was recertified in 2020 in accordance with ISO 27001 (“IT Security Catalogue pursuant to Section 11 (1a) EnWG”). Through an established security process, information security risks are systematically identified and dealt with. In the reporting year, no targeted cyberattacks were carried out against 50Hertz; moreover, no damage caused by information security incidents occurred. In an independent audit which evaluated and certified the operational security of data centres (based on DIN EN 56000), 50Hertz’s data centres were designated as “highly available” at Level 3.
As part of our data protection management system (DSMS), the existing e-learning programme relating to data protection was updated in XX and internal employees and subcontractors were subsequently trained in this area.
For 50Hertz, security does not stop at the company’s boundaries. For example, staff are trained in crisis management and crisis communication with internal and external stakeholders during regular crisis team exercises. Existing structures, processes and reporting channels are continuously reviewed and improved, and crisis team members and employees are trained in the skills needed to deal with unexpected and high-stress events; they are also trained to take quick and appropriate crisis management decisions. These and other measures serve to increase the resilience of 50Hertz. In addition to training being offered to all members of the crisis team, reviews are undertaken of property protection concepts and general corporate security is further developed.
50Hertz regularly rehearses so-called ‘black start’ events in order to be prepared to restore power supply within a short space of time in the event of a blackout. Such events must be regularly rehearsed with relevant partners as part of simulations and during grid restoration tests using real conditions. This ensures safety in the event of a crisis and is also required by law.
In the year under review, the grid was successfully restored for the second time using a so-called ‘start-up grid’. A start-up grid consists of an isolated grid with strategically useful transformer stations which are simultaneously electrified by a black start unit (in this case, a pumped storage power plant).