The Change Board approved MP091 on 20 December 2019 for implementation in the February 2020 SEC Release.
What is the issue?
Once a Party completes their Full User Security Assessment (FUSA) the SEC Panel assigns them one of four assurance statuses. Two of these, “Provisionally Approved” and “Deferred”, indicate significant security deficiencies that require substantial remediation, the severity of which are not reflected in the current SEC terminology.
The Security Sub Committee (SSC) believes that the assurance status set should be clear to Parties and accurately reflect the situation. As such it proposes to amend these assurance status as follows:
“Provisionally Approved” to “Deferred”; and
“Deferred” to “Rejected”.
Additionally, there is no current provision for the SSC to require a Party to undertake a second FUSA. The SEC only allows for updates to the original User Security Assessment Response. The SSC believes it would be more appropriate that where a Party is set a status of “Rejected” a second FUSA is more appropriate than an updated User Security Assessment Response. A second FUSA would provide assurance for all Parties, and the DCC, that the (significant) deficiencies have been addressed.
What is the solution?
MP091 will amend SEC Section G to reflect the new Assurance Statuses and, where a User has a status set as “rejected”, allow the SSC to require a further FUSA be completed.
Who is impacted?
Large Suppliers
Small Suppliers
Electricity Network Parties
Gas Network Parties
This is the April 2024 SEC Modifications Working Group meeting, where we will be discussing: MP085B ‘Synchronisation of Smart Meter voltage measurement periods (meters currently installed)’ MP244 ‘Device Alerts
This is the April 2024 SEC Issues Group meeting, where we discussed: PPM continuity plan Please see the meeting summary here: SEC Issues Group Meeting Summary - April 2024 (CLEAR)
By subscribing you consent to receiving the SECAS newsletter.
Manage Cookie Consent
This website uses cookies. Please choose which categories of cookies you would like to enable.
Functional cookies
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.