Cybersecurity in smart local energy systems: requirements, challenges, and standards

Smart local energy system (SLES) can support tailored regional solutions through the orchestration of cyber physical architectures, coordinating distributed technologies, with operational and forecasting models across all energy actors. Unprecedented access to new information, data streams and remotely accessible control can substantially benefit the multi-objective optimisation of multiple performance metrics. Given the expansion of this internet of things (IoT) and cyber-physical system (CPS), it is important to not only design effective detection and management of potential cybersecurity issues, but also to address the challenges in having affective and adaptive governance—built on standards to ensure the security of the IoT to minimise risks and harms to all users. This study conducts an extensive and critical investigation into the existing standards and identifies areas to focus on as to support the expansive adoption of cyber physical networks. Although existing standards and protocols are highly fragmented, our findings suggest that many of them can meet the requirements of the applications and infrastructures of SLES. Additionally, many standards have been introduced to protect information security and personal privacy due to their increasing importance. The research also suggests that the industry needs to produce more affordable and cyber-secured devices and services. For the government and regulators, relevant guidelines on the minimum function and security requirements for applications should be provided. Additionally, compliance testing and certifications should be in place and carried out by an independent third party to ensure the components of SLES ecosystem with a satisfied security level by design.

is based upon the "supplier hub model" (Ofgem 2017), which means the electricity is generated from energy suppliers, transmitted via transmission and distribution networks, and finally consumed by end-users. The newly built large-scale DER sites are usually far away from the consumer end. Together with increasing energy demand, they pose new challenges to the existing energy system, which may require additional expensive generation assets and network reinforcement and expansion. However, there is an alternative approach, solving the problem at the near-consumer side.
The demand for more active energy management and more affordable energy supply have contributed to the rapid growth in DER deployments at the near-user end (Office of Gas and Electricity Markets 2017). Customers therefore will access to more complex and blended energy products, empowered by smart technologies and algorithms to manage their energy demand remotely and autonomously. Generators will need to optimise the operation of their assets to develop different business models and unlock the value (Energy Digitalisation Taskforce 2022). Additionally, they also need to make the best use of the enormous flexibility that potentially benefits the whole system, while maintaining the stability throughout the system at all levels. The network operators therefore must seek for new solutions to the problems and challenges. For the better integration, some potential solutions have been proposed to embrace the idea of localising energy supply and provide additional flexibility and resilience, such as virtual power plants (Rodríguez-Molina et al. 2014), local energy market (Mengelkamp et al. 2018), aggregators (Burger et al. 2017), and community energy system.
Amongst all potential solutions, SLES is considered as a promising pathway for fasttrack decarbonisation through "green" tech integration. It can also facilitate a more effective and localised operation (Ford et al. 2021) with enhanced energy equity and justice. The extraordinary scalability and replicability enable SLES to have more flexible implementations. It can be as small as a community energy system and can be scaled up to be as a part of the main grid. Previous study (Ford et al. 2021) identified the benefits of SLES, including effective provision of energy service, enabling flexibility within and across energy vectors, improved resilience, and ability to cope with failure, etc. SLES substantially benefits from its complex information and communication technology (ICT) infrastructures that can provide enhanced observability and distributed control on DERs. The smart elements include both physical smart devices and digital functionality (Mokhtar et al. 2021;Kirli et al. 2022). The physical smart devices, consisted of various IoT technologies, have enhanced the interoperation of the grid system by providing multi-directional information flow with adequate data from users, substations, transmission, and generation sides. More recently, there is increasing focus on the digital functionalities such as artificial intelligence (AI) and analytics. These smart elements contribute to the provision of a real-time balance, monitoring, and control at high granularity and accuracy. Stakeholders in the SLES can benefit from such system setup and operation, therefore an autonomous and locally self-sufficient energy system can be achieved.
However, the substantial information exchanged between the smart elements, can lead to an outstanding concern regarding the security, because of the competing interests of different parties or stakeholders, high level of interdependence, and social complexity (Jurcut et al. 2020). In general, there are two categories of threats, operation threats and information threats. There are mainly three types of operation threats, including data manipulation, impersonation, and denial of service (DoS) (Gunduz and Das 2020). The second category of threats is the privacy and information threat. The smart elements will inevitably increase significant data exchanges, elevating the security of privacy and information to an extremely important level. Although more attention has been distributed to this area, there is still a lack of understanding in the digital transition of the energy system and big data. The SLES is essentially reliant upon the accurate measurements and digitalised and interactive management through the smart elements. The data-driven analysis is supporting and on occasion leading operational and planning decisions across all services in the energy sector. In this way, its integrity is paramount to how we live now, and in the future.
Apart from the threats, the SLES will require many advanced devices to participate in the process, and it therefore is necessary to consider the compatibility for lowend devices. Previous studies suggested that existing standards and guidelines have not provided any clear definition of roles that different parties play, and a common understanding of key security requirements is yet to be shared (Labib et al. 2019). Additionally, the inherent vulnerabilities may potentially expose the system to potential attacks (Sha et al. 2018), because the controlling and monitoring is undertaken based on internet-protocols and off-the-shelf solutions. Similar to smart grid, the nature of SLES can be considered as part of critical infrastructures, which will likely draw unwanted attention and become the target of cyber-attack. It therefore is vital to undertake thorough examination on the components and identify existing vulnerabilities to ensure the main security objectives are met. To protect the IoT from the potential external cyberattacks, it requires not only effective threat detection and management, but also a considerable number of well-designed standards are necessary to ensure the security of the IoT system to minimise the risks. It is therefore worth investigating the currently existing standards and identify the area to focus on in the future.
The rest of the paper is structured as follows: in "Background of SLES" section, the background of SLES is described, including its key components, features and benefits, and potential challenges and risks; "Cybersecurity of smart local energy systems" section introduces general cybersecurity objectives and requirements for SLES and general energy system, and also cross compare the existing standards related to cybersecurity; "Discussion and suggestion" section discusses and explains the main findings and proposes several suggestions for SLES planning and development; and conclusions and future works are summarised in "Conclusion".

Background of SLES
In general, there are many key components comprising an energy system, including production, conversion, transmission, distribution and consumption (Alanne and Saari 2006). This structure also works for a small energy system at a local level, such as a community or a building, and SLES. SLES can transmit electric and information flow during the operation. The electric flow starts from energy producers and finish at end users in the traditional system. To some extent, the SLES operates in a similar way to the virtual power plants that can monitor and operate embedded DER assets to trade the generated power based on different market environments. Additionally, different A SLES aims to achieve local balancing from both demand and supply sides. For energy supply, the SLES can maximise the utilisation of energy produced locally from DERs to reduce the consumers' energy import (Menniti et al. 2018). It can also perform demand response to adjust energy demand across many sectors, such as heating and transport, based on the availability of power supply. The smart technologies are the fundamental attributes to realising these functions. For example, smart elements can contribute to more accurate measurements and more digitalised and interactive management through bi-directional information and electricity networks across different levels in the system. The high-resolution data enables consumers and system operators to have a better insight on the system operation and status. The smart elements together with emerging technologies, such as artificial intelligent and machine learning, can help with better decision-making (Ding et al. 2011) and therefore result in a more efficient and effective operation (Koolen et al. 2017;Rajasekaran et al. 2017;Keerthisinghe et al. 2019;Sunny et al. 2020).
The other important feature is the localness as the result of the extraordinary scalability. As mentioned previously, a SLES can scale up and operate as a part of the wider power grid and can also scale down as a local energy network. From a technical aspect, this is particularly important in the event of system failure. It still can ensure the consumers to have secure and continuous power supply with local DERs, resulting in a more resilient network. More importantly, SLESs would also bring other socialeconomic benefits. Different from the traditional system, the ownership of a SLES can be more flexible and diverse, which may encourage more active participation and engagement of the local authorities, network operators and consumers. Therefore, the SLES is very helpful to deliver more affordable energy and a fairer energy system (Ford et al. 2021). Additionally, local decision-making process will also make the service providers put more focus on consumers and quality of service, which can provide local customers an easy access to the system and address the desire to tackle the climate change locally (Ford et al. 2021). In this way, the locality of the SLES can not only help us exploit the value of system better, but also provide a location-specific solution to the energy transition.
Although the SLESs have some different characteristics compared to the traditional power grid shown in Table 1, the integration of SLES with existing power grid will benefits mutually. On one hand, the implementation of SLES can equip the existing grid with more flexibility and resilience, and therefore contributes to more autonomous operation and optimise the utilisation of connected resources. For example, the DERs within the SLES, such as wind turbines and energy storage, can provide the traditional power grid with more flexible and low-carbon generation and demand side management to mitigate the energy fluctuation in the grid and facilitate the renewable energy transition. Additionally, the SLES can increase the energy selfsufficiency at the local level, which can defer and even avoid the reinforcement and expansion of the network. On the other hand, the connection to the grid can enhance the reliability of power supply to the SLES. Especially when there is insufficient local generation, the connection to power network ensures the consumers can always have reliable and secure energy supply.

Challenges and potential risks
As mentioned previously, the lack of understanding in SLES and its operation, hinder the development of SLES. However, it has some similarities to smart cities. For example, both are part of the key public infrastructure and both heavily reliant upon the participation of private companies and consumers. In traditional system, the utility companies usually have the ownership of the entire infrastructure or utilise a managed service, which may prioritise the cybersecurity during system acquisitions and ensures the correct security measures in place. The emerging technologies, especially built upon IoT, are usually designed for the easy adoption so that the consumers can operate the devices through HAN or WAN. The number of consumer-owned smart devices can therefore easily outnumber those owned and operated by the utility. However, most consumers may not have the technical expertise or incentives to prioritise or maintain the infrastructure security. The divided administration makes the utility or system operators hard to monitor and manage devices, leading to a disparity in security protection. Therefore, administrative boundaries must be broken by interconnecting different networks to ensure the utility companies can operate smart devices and DERs together with consumers in a collaborative manner.
Most IoT-based devices adopted in the SLES are manufactured by third parties or private companies. Lu et al. (2013) acknowledged that the secure operation of the power system is based on a stable ICT supply chain, and any disruption on its components can lead to catastrophic impacts on the whole system. Boysen (2014) also identified that many security concerns and incidents usually can trace back to the inadequate management and risk of manufacturers and suppliers. In most of the real-life deployments, third parties or private companies are given access to key infrastructure assets and critical information without thorough reviews. Although it may contribute to faster service delivery and easier integration, it may lead to catastrophic impacts if without proper management.
In addition, the utilisation of HAN and WAN provide an easy and flexible access to the system management. It enables users and utility companies to obtain more accurate consumer demand and status of DER production in higher resolution and participate in more complex system operation, such as demand side response. However, exposing the system to the external WAN may also increase the attack surfaces, leading to private data breach, device compromise, and even instability of the whole system. The substantial growth in smart appliances and DERs in the SLES will essentially increase the cyberphysical interdependencies.
The operation therefore will no longer merely depend upon the secure physical status of the infrastructure, bringing the importance of cybersecurity to an unprecedented level.

Cybersecurity of smart local energy systems
According to the data provided by Scopus, the cybersecurity has been an increasingly popular topic in the past two decades, especially since 2016 shown in Fig. 1. Additionally, the Fig. 2 shows the most publications mainly focus on several areas, including Computer Sciences (33.5%), Engineering (26%), Mathematics (7.9%) and Energy (6.2%).
Amongst all the publications, the majority of publications are conducted by researchers from the US and the EU and the leading affiliations are shown in the Fig. 3.
The added ICT dimension to the classical power grid, introduced new security issues and challenges that were not or rarely present on the traditional power grid. These security issues and challenges could hinder the rapid deployment and adoption by endusers of the IoT-based smart grid and future SLES.

Cybersecurity objectives and requirements
According to National Institute of Standards and Technologies (NIST), there are three cybersecurity objectives to protect information being stolen, compromised, or attacked. The objectives include confidentiality, integrity and availability, also known as the CIA triads (Brooks et al. 2017). In most IT systems, confidentiality has been considered being of the greatest importance. However, in SLES, the priority is to ensure the availability of system and secure energy supply and integrity is the next important security objective followed by confidentiality.
Availability is to ensure the information is available when authorised users need to access it. In traditional power gird, utilities use limited information to estimate meter readings and hence the data availability is unlikely to cause serious impact on the grid. However, in the SLES, the safe operation of systems is heavily reliant upon the real-time and near real-time data from the sensors across the SLES, AMI and control signals exchanged between multiple entities. The application of AMI not only provides consumer's data with higher resolution, but also transmits outage alarms and manage critical functions, such as distribution automation. Availability is therefore the primary security objective in the SLES to ensure the timely transmission of data, even when the network is under attack and flooded traffic (Cleveland 2008). The availability of data in the SLES needs a secure collection of network layers, including application layer, transport layer, network layer and physical layer (Pishva 2017). Any threats and attacks on single or multiple layers in the network may keep the system from secure and safe  operation. The most common threat is denial of service attack (Liu et al. 2013;Berthier et al. 2010;Grochocki et al. 2012;Hong et al. 2014) where some malicious activities are designed to disrupt the accessibility of services to legitimate users and hence disrupt normal system operation (Huseinović et al. 2020;Islam et al. 2019).
Integrity aims to protect data and keep it in a correct state from any accidental or malicious modification of data. The data must not be changed in an unauthorised or undetectable manner (Mohammadpourfard et al. 2020). It involves maintaining the consistency, accuracy, and trustworthiness of data during storage, transmission, and usage. In the context of SLES, the data integrity is usually targeted by attackers who attempt to alternate critical data such as metre reading, billing information and control demand. Therefore, authentication, certification and attestation are commonly adopted as protection measures (Li et al. 2018). The components in the SLES needs to authenticate each other so that impersonation can be detected and avoided (Zhang et al. 2019). Then the data certificate keeps the message exchanges from any alternation and changes during the data transmission. With the increasing IoT devices, the system has become more vulnerable to complex data integrity attacks, such as false data injection (Lin et al. 2016;Yang et al. 2014;Xie et al. 2011), bypassing data detection (Zhang et al. 2018) etc.
Confidentiality refers to protecting personal privacy and proprietary information from unauthorised access. It emphasises the need for information protection, requiring relevant measures to ensure only authorised people being allowed to obtain the information. Attacks targeting confidentiality do not necessarily cause substantial impacts on the system operation but can be a preparatory step to a more damaging attack. The smart metre has raised some concerns regarding the consumers' privacy in recent years. Customers fear that the data leakage may potentially be used by unauthorised people or marketing firms. In the future, a SLES will involve with significantly frequent interaction between consumers, network operators and local authorities comparing to the traditional energy system. Counter measures against confidentiality issues such as eavesdropping and privacy breach, will becoming increasingly important (Bao and Lu 2015; Karampour et al. 2019;Chaudhry et al. 2021).

The development of cybersecurity standards
As previously discussed, due to the growth in distributed and integrated technologies into CPS with unprecedented reach and interdependencies, we provide an analysis of current best practices in cybersecurity within the energy sector concerned with SLES. Cybersecurity in the energy sector is not as mature as other markets, therefore, it's important to have a detailed understanding of current best practice in infrastructure security standards and protocols applied to the smart grid. Our research aims to assess the existing standards through several aspects, such as coverage, purpose, and the significance to the real-world implementations. By evaluating best practice in the smart grid infrastructure, it is therefore helpful to understand its relevance to SLES and to identify the gap between the existing standards and the future requirements. There are around 100 existing standards addressing the cyber security issues, but this section we only review some of them that reflecting the main trend of the development in the chronological order. The full list of standards included in the research can be found in the appendix.
The development of cybersecurity standards mirrors the trend of technological advancement, shown in Table 2. Initially, there were not any intelligent or smart control systems or devices in the system. Therefore, in the 1990s the cybersecurity protection was mainly addressed by enhancing the security of the physical assets. For instance, IEEE 1264 Guide for Animal Deterrents for Electric Power Supply Substations was proposed (Standard IEEE 1993). It defines types of intrusions and identified subsequent problems and impacts, evaluated by several parameters, such as intrusion location and seriousness of impacts. Correspondingly, relevant precaution and prevention measures are provided, such as physical obstacles and enclosure, security patrol and video surveillance. Later in 2000, IEEE 1402 Guide for Electric Power Substation Physical and Electronic Security was introduced and complemented the security protection from human intrusion. Besides existing measures against animal intrusion, IEEE 1402 also includes protection measures for electronics, such as virus scans, encrypting and dial-back verification. However, these protective measures are only briefly mentioned without details in depth.
With the development of cybersecurity protection, most standards focused on the design and management at a macro systematic level or a domain-specific level. DHS Cyber Security Procurement Language for Control System (Department of Homeland Security 2009) is an important documentation that combines many requirements into 11 high-level topics, such as system design, account and access control, end device management, physical and cyber threat and vulnerability detection. Each topic addresses a specific issue or concern in a control system, and describes a rationale, . It provides a framework that is not specific to the energy industry, but all types of organisations and business. It defines the outcomes of good cybersecurity practice. It considers not only the technical aspects of cyber security, but also the physical, cultural, and behavioural aspects, alongside effective leadership and governance.
The protection of communication network as part of industrial control and automation system was also addressed due to the proliferation of the Internet. In 2014, IEEE C37. 240 Standard Cybersecurity Requirements for Substation Automation, Protection, and Control Systems (IEEE 2014) was developed and published to present a set of baseline cybersecurity requirements dedicated to the communication system. It aimed to protect the security of interface between control systems and standardise the foundational requirements for communication components, such as access and use control, data integrity and confidentiality, network resource availability and timely response to events. Most importantly, it reemphasised the importance of monitoring and auditing security events and policies and conducting periodic security tests. Another instance is IEC 62443 Industrial communication networks-IT security for networks and systems, launched in 2010 (International Electrotechnical Commission 2018). It provides a detailed description regarding the elements and the development process of a cybersecurity management system for a control system and automaton technology. It also lists seven requirements, overlapped with the foundational requirements in IEEE C37.240, to achieve higher security levels. The security levels are considered as the functional requirements for the system, protecting from accidental information disclosure and unauthorised access and different level varies with the attacking method and activeness used by the attackers.
The increasing complex electronic devices implemented then shifted the focus towards the specific component or technology in the system. IEEE 1686 Standard for Intelligent Electronic Devices Cyber Security Capabilities was published in 2013 (IEEE 2013). The standard series detail a set of compulsory requirements for the electronic devices, such as an interface to change user accounts, keeping full sequential audit history, and monitoring security-related events. The standard also requires that all electric devices should have certain level of cryptographic features to ensure the device functionality and secure communication. Another example is Advanced Metering Infrastructure System Security Requirement (AMI-SECTF 2008) issued in 2008 in the US. It aims to provide a set of security requirements to ensure the high level of information assurance, availability, and security necessary to maintain a reliable system and consumer confidence. The requirement in the document can be generalised into three categories: (a) primary security services (aims to protect confidentiality and privacy, integrity, availability, identification, authentication, and authorisation); (b) supporting security services (such as detection, risk assessment, cryptography, and certificate); and (c) assurance services (such as accountability, and access control). Similar standards can also be found, such as CEN/CLC/JTC 13 N 468 Protection Profile for Smart Meter in the UK and Privacy and Security of the Advanced Metering Infrastructure in Netherlands.
The surge of electronic devices has markedly facilitated the digitalisation of energy system that needs to handle with substantial amount of information and data exchange. Therefore, joint efforts by academia and industry have been trying to propose relevant standards or protocols to ensure the data and information security. IEEE 1363 Standard Specifications for Public-Key Cryptography was firstly introduced in 2004 (Committee of the IEEE Computer Society 2009), aiming to produce a comprehensive document defining a range of common public-key techniques covering key agreement, publickey encryption and digital signatures. It includes different types of cryptographic techniques including traditional, identity-based, password-based, and lattice-based techniques and extensive discussions of security and implementation considerations.

IEEE P1912 Standard for Privacy and Security Framework for Consumer Wireless
Devices (IEEE 2020b) also focuses on data privacy and security, which defines a privacy scale where data can refer to personal identifiable information. The input of privacy data contributes to assessment tools to apply relevant necessary setting to the data, which is of great importance for the future applications at the end-user side. Meanwhile, more risk management guidelines are introduced to enhance the information security. For example, ISO/IEC TR 27019 Information technology-Security techniques-Information security management guidelines based on ISO/IEC 27002 for process control systems specific to the energy utility industry (British Standard Institute 2013). It suggests that security requirements analysis and a complementary individual risk analysis should be undertaken before the use of control devices or software. IEEE 2144.1 Standard for Cryptographic Protection of Data on Blockchain-Oriented Storage Devices (IEEE 2020a) also presents a trusted IoT data management framework integrate with application, function and trusted carrier layers. The framework is applicable for data management in blockchain and IoT technologies and to business scenarios that employing internal data collection, change and sharing with external parties. IEEE Std 11073-40101 Cybersecurity-Processes for vulnerability assessment (Committee of the IEEE Engineering in Medicine 2021) proposing an auditable approach to identification and assessment of cybersecurity vulnerabilities and estimation of risks, which is an useful tool and can be used as reference method for future smart devices development. Dong et al. Energy Informatics (2022) 5:9 Discussion and suggestion

Findings from the review of existing standards
The previous section has reviewed the development of cybersecurity standards and protocols that were defined and specified by industry and standard bodies. Many of them were developed to address security and privacy concerns and requirements in either control and wireless system and devices, or management strategy of cybersecurity issues. The requirements included in the standards differ from each other, in terms of technical details, the scope and the thematic coverage. Some publications extend or partially repeat requirements from other standards, and some are only supplementary documents to others. Our findings suggest that there is a considerable number of existing standards or protocols that would apply to the application and infrastructure of SLES, such as industry automated and control system, electric vehicles, and intelligent electronic devices. Many standard bodies from different countries have contributed to the knowledge, such as BSI from the UK, IEEE and ANSI from the US. These standards are applicable to some specific component or industry of the infrastructure. For example, most of the standards proposed by IEEE defines and specifies very detailed technical security elements for the IoT. The works are applicable to many aspects and components in the SLES, including IoT architectural framework, physical and medium access control, and wireless devices with end-to-end security.
Another finding is that the standards are not comprehensive and some only address cybersecurity to some certain extent. The existing standards are highly fragmented that are specific to certain industry, such as NERC CIP for electric utility and IEC 62443 for general industry automation and control systems, while some security frameworks providing general guidelines applicable to any industry or organisation without technical details, such as PAS 555. Majority of the standards only focus on securing one or a few components or security features in the system by the design or for the operation. Many researchers suggest that the ambiguous definition of the smart city still hinders the application. Therefore, it will be even more difficult to provide a set of comprehensive guidelines on cybersecurity for SLES, because of the differences between SLES and smart cities, such as more localised governance bodies and more active prosumers' participation in energy supply. SLES will be heavily reliant upon substantial integration of IoT technologies and automated control and communication networks, which will make cybersecurity one of the primary goals. However, it would depend on clear definitions of SLES and explicit guidelines on its operation and governance. Therefore, relevant necessary and essential measures can be adopted to construct a robust and sophisticated smart local energy network in a more systematic fashion.
In addition, our finding also suggest that the information security is becoming increasingly important due to the growing penetration of IoT and digitalisation of the energy industry. Different standards were put in place to standardise the data encryption, transmission, storage, and format to enhance the interoperability between different system components. Additionally, relevant standards were also designed to protect personal data and privacy via both algorithm and edge device design. The complex requirements are imposed to ensure certain levels of security measures embedded in the electronic devices by the manufacturers to protect the cybersecurity of both the system and users. However, HP conducted an assessment on 10 common IoT devices and they found each device had 25 vulnerabilities on average (HP 2015). For the future SLES applications, at near-consumer side, many IoT devices will be adopted to manage local generation and demand of consumers. For the local, distribution and transmission network, the timely and accurate communication will be critical to the system stability. The disparity in security features of the IoT devices can potentially cause problematic and even catastrophic issues. For this reason, we would recommend an adherence to certain standards must become as the norm of smart device development and sufficient and comprehensive standards are needed to be considered as the baseline standards that provides principles to ensure the scalability and flexible interpretability, which is also in line with the suggestions provided in Pishva (2017).
For this reason, the findings can help us understand how the existing standards can integrate with the SLES. For example, the substantial amount of data will be collected and exchanged during the daily operation, which makes the data safety and privacy protection extremely important. The potential peer-to-peer energy trading within the SLES can make the best use of the blockchain technologies and existing relevant standards such as IEEE 2144.1 that ensure the data security in the devices and entities. In addition, standards like PAS 555 can help us comprehend the critical role of cybersecurity and build an effective framework to assess and manage potential cyber threat, vulnerability, and attacks. As the result, a more active cyber threat prevention and detection mechanism will be added to the existing protection measure, further enhancing the cybersecurity of the SLES.

Cybersecurity suggestions for SLES planning and deployment
In the light of the emerging SLES, electric utility has been exposed to ever substantial challenges, especially cyber challenges, which may cause catastrophic impacts on the whole value chain of the power network. The legacy generation systems and cleanenergy infrastructure without sufficient security design will likely suffer serious disruption of service and ransomware attacks against generation assets. The physical security weaknesses allow access to the grid control system and hence result in largescale disruption of power to customers through remotely disconnecting services. At distribution level, limited security measures built into SCADA systems can cause disruption of reginal loss and disruption of service to customers. At network and enduser side, large attack surface of IoT devices such as smart meters and electric vehicles, will also possibly lead to theft of customer information, fraud, and service disruption.
The SLES aims to achieve an automated and local energy supply with high participation of prosumers with the help of highly penetrated IoT technologies. The difference in the operation and management of SLES and traditional power grid will contribute to the merging of information and operation technologies. For this reason, the challenges are brand-new and unprecedent, and can hardly be solved by using traditional cyber threat management strategies. Therefore, the researchers from academia and industry need to work on several things and we have made following recommendations.
Due to interdependency between the physical and cyber infrastructures, the cybersecurity of SLES should focus on protecting measures on both physical and cyber aspects. It is hard to detail every cybersecurity requirement here, but a good comprehensive cybersecurity guideline should include following 15 aspects: access control, audit and accountability, configuration management, identification and authentication, incident response, media protection, planning, personnel security, information system and service acquisition and integrity, awareness and training, security assessment and authorisation, information and document management, physical and environmental security, risk assessment and management, and communication system protection.
In addition, for the industry, more efforts are needed to provide more affordable and cyber-secured devices and services and more innovative technologies should also be encouraged to apply in real applications. Technologies, such as blockchain and OpenFMB, can not only facilitate scaling up the SLES applications with secured assurance, but also can improve the integration with legacy infrastructures with enhanced data interoperability. More emerging techniques and concepts should also be utilised to influence the development of cybersecurity, such as AI and machine learning (Cui et al. 2020;Esmalifalak et al. 2017). The increasingly complex cyber environment will only result in ever challenging security issues. Instead of obeying a specific design, cybersecurity measures should also become more organics and autonomous. Continuous training and adaptation will equip the system with a capability to automatic detect and respond to new threats, such as predictive defence (Cerotti et al. 2019;Ahmed et al. 2018) and hybrid cloud (Talaat et al. 2020).
A good balance between the affordability and quality of cybersecurity should be achieved so that IoT products can be more easily accessed by consumers. In comparison, the government and regulator should set out clearly what standards are mandatory and regulate the data management. Clear definitions and guidelines on SLES should be considered as priority. A tailored cybersecurity management strategy needs to be made upon good comprehension of a system setup, operation, and governance. A few baseline standards are needed to address the system's baseline security requirements, so that relevant components or technologies can therefore be adopted to meet the minimum function and security requirements.
At last, compliance testing and certifications should also play an important role in SLES and the wider energy system. Although there may be technical standards to ensure the security at the application or development stage, the consistency should come across the whole SLES ecosystem, including transport and energy. For this reason, it is necessary to conduct testing and certification by an independent party, which can assure the regulators that a satisfied security level is provided in key SLES ecosystem actors by design. It would be beneficial to move closer to energy system integration supporting the optimisation of the whole system.

Conclusion
In this paper, an extensive investigation into existing technical standards addressing cybersecurity issues is carried out. Our findings suggest that a considerable number of standards or protocols pre-existing that would meet the requirement of the application and infrastructure of SLES. However, the standards are not comprehensive and some only address cybersecurity to some certain extent. The existing standards are highly fragmented that are specific to certain industry, while some security frameworks providing general guidelines applicable to any industry or organisation without technical details. Majority of the standards only focus on securing one or a few components or security features in the system by the design or for the operation. Additionally, we also find that the information security is becoming increasingly important, and many standards are introduced to protect information security and personal privacy.
However, the successful development of SLES still needs more effort from multiple sides. A detailed cybersecurity guideline should include 15 main topics described in previous section. More efforts are needed from the industry to provide more affordable and cyber-secured devices and services to apply in real applications. The government and regulator should demonstrate a few baseline standards to address the system's baseline security requirements, so that relevant components or technologies can therefore be adopted to meet the minimum function and security requirements. Additionally, compliance testing and certifications should also be in place and carried out by an independent third party to ensure the components of SLES ecosystem with a satisfied security level by design.
Based on our findings and suggestions produced from this research, it is important to extend the research and further investigate how they can contribute to the design and operation of SLES. The future work will focus on proposing a framework for the detection and treatment to ensure the cybersecurity of SLES. Additionally, With the huge advancement of AI and machine learning in many verticals, there is increasing interest in applying AI techniques in in the energy sector. The SLES will benefit from ever more integrated smart technologies, but it also must encounter the inherent vulnerabilities and challenges. Attacks using advanced AI techniques can be more difficult to detect and mitigate, compared to threats seen in traditional energy networks. Therefore, future work can also investigate the potential AI-driven cyberattacks in SLES, particularly what system vulnerabilities they can exploit and impact, and how they can be managed and prevented in the context of system security, data governance, and privacy.