SSC Guidance

SSC and SMKI PMA – Standards, Procedures and Guidelines

The SMKI PMA and the SSC has developed bespoke guidance to ensure that the DCC and Users can continue to abide by relevant and essential guidelines to maintain the integrity of smart metering security and SMKI and DCCKI operations.

The guidance (link below) has been developed to supersede the discontinued NCSC Good Practice Guides (GPG):

• GPG 45 – Verifying Individual Identity
• GPG 46 – Verifying Organisation Identity
• GPG 13 – Protective Monitoring
• GPG 18 – Forensic Readiness

SSC Guidance on Device Security Assurance and Triage

The security controls and assurance arrangements for the end-to-end Smart Metering System are defined in the Smart Energy Code (SEC) and aim to provide confidence to all SEC Parties that the systems and Devices supporting smart metering are appropriately secure.

The SEC Section G7.19 places an obligation on the Security Sub-Committee (SSC): “The Security Sub-Committee shall: …….

(g) develop and maintain documents to be known as “SSC Guidance for Device Security Assurance and Triage” which shall set out the SSC’s guidance on the requirements and processes to be followed in respect of Devices (including their triage and refurbishment) in order to:

(i) achieve appropriate levels of security assurance in accordance with the requirement of this Code; and

(ii) obtain and maintain CPA Certification.”

The SSC Guidance for Device Security Assurance and Triage is in three parts:

• Part 1 provides the methodology, a process and a template for any party to raise a change to the NCSC Commercial Product Assurance (CPA) Security Characteristics (SCs) or to raise a Use Case for Device Triage.
• Part 2 provides details of the arrangements and the Security Requirements and Guidance to be applied to Use Cases that have been approved by the SSC with advice from NCSC.
• Part 3 provides details of the assurance arrangements for Triage Facilities in the form of a Triage Security Controls Framework (TSCF):
  • Section 1 of the TSCF describes the purpose and what the TSCF aims to achieve; the different types of Security Assessment and their frequency; and the role of the User CIO;
  • Section 2 of the TSCF provides greater detail at a practical level for the User Assessment lifecycle with information and logistical requirements for how a User should engage with the User CIO; the timeline for User Assessments; and the detailed questions the User CIO might ask, and the evidence it might expect to see from a User to support its assessment.

[Note that Manufacturer’s Triage Systems, Triage Tools and Triage System Interfaces are assured via an extension to the CPA Build Standard, as defined in “CPA Security Characteristic Triage interface updates to GSME, ESME, & SAPC SCs and CPA Build Standard Extensions”.]

The SSC Guidance for Device Security Assurance and Triage forms part of the SEC Materials defined in SEC Section M5.1, and the document is regularly reviewed and updated by the SSC.

SSC and SMKI PMA – Standards, Procedures and Guidelines

SSC Guidance for Device Security Assurance and Triage

• SSC - SSC Guidance for Device Security Assurance and Triage - Part 1 v1.1
• SSC - SSC Guidance for Device Security Assurance and Triage - Part 2 v1.2
• SSC - SSC Guidance for Device Security Assurance and Triage - Part 2 v1.2 (Tracked Changes)
• SSC - SSC Guidance for Device Security Assurance and Triage - Part 3 (TSCF) - Section 1 v1.2
• SSC - SSC Guidance for Device Security Assurance and Triage - Part 3 (TSCF) - Section 2 v1.2
• SSC Guidance on Applying for Approval of Trial Devices v1.2
• Application for a Trial Device Certificate - Application Form

CPA Security Characteristics and Risk Review

See main page here.

• ESME CPA Security Characteristics V1.4
• GSME CPA Security Characteristics V1.4
• CH CPA Security Characteristics V1.4
• SAPC CPA Security Characteristics V1.3
• HCALCS CPA Security Characteristics V1.3
• Triage interface updates to GSME, ESME, & SAPC SCs and CPA Build Standard Extensions - CPA SC v2.1
• CPA SC Agreed Interpretations
• CPA Risk Review of Smart Metering Devices v1.0