Digital supply chain security for power sector operators in the light of the new EU directives and regulation

With the continuous escalation of cybersecurity threats to Operational Technology (OT) systems in critical infrastructure, tighter regulations are being introduced to achieve cyber and operational resilience.As the security of the digital supply chain is an area of increasing concern, new EU regulations, namely NIS2, the Cyber Resilience Act (CRA) and the Cybersecurity Network Code for the Energy Sector (NCCES) introduce, among others, mandates concerning the security of the digital supply chain.This paper analyzes these legislative initiatives to improve the understanding of the dynamics of the regulation and its consequences for companies and the workforce in critical infrastructure, with a focus on the security of the digital supply chain in the power sector.Based on this analysis, we propose good practices that can support critical sector operators, particularly in the power sector, in the process towards compliance with the examined legislation.We also identify areas in which more research is needed to provide the industry with recommendations towards the same goal.