E.DSO Technology Report on Incident Management

As Europe’s electricity system becomes increasingly digitalised, decentralised and interconnected, incident response can no longer focus solely on traditional equipment failures and outages. Today’s incidents may span physical grid assets, operational technologies, IT and communication systems, distributed energy resources and market platforms.

The session highlighted a clear shift: anticipation and preparedness are becoming as important as response itself, while incident management increasingly requires multidisciplinary expertise, effective coordination and governance. Learning from incidents, innovation and knowledge sharing will also be essential to strengthening resilience across the sector.

Drawing on a survey among E.DSO members and experiences shared by Fluvius, Enedis and Stedin during a knowledge sharing session with representatives from 23 E.DSO members, the paper highlights several important developments:

  • Incident management is becoming increasingly multidisciplinary, requiring closer cooperation across operational, technical, IT and cybersecurity functions;
  • Grid congestion is emerging as a growing operational risk, raising new questions about the boundary between congestion management and emergency response;
  • Digitalisation brings both opportunities and new dependencies, making cybersecurity, communications resilience and data management integral to incident response;
  • TSO–DSO cooperation will become increasingly important as incidents increasingly cross traditional organisational and system boundaries.

Based on these findings, the paper puts forward five key recommendations:

  1. Develop integrated incident investigation frameworks bringing together physical, operational and cyber perspectives.
  2. Strengthen TSO–DSO incident cooperation, including information sharing, joint investigations and shared lessons learned.
  3. Establish clear governance for congestion-related emergencies, including escalation criteria, responsibilities and emergency procedures.
  4. Adopt a system-wide approach to cyber resilience, extending beyond utilities to the wider energy ecosystem.
  5. Enhance knowledge sharing across DSOs to facilitate the exchange of lessons learned, methodologies and resilience practices.

Ultimately, the paper underlines that building resilient electricity systems will depend not only on infrastructure investment, but also on integrated governance, collaborative incident management and continuous knowledge sharing.

More publications