The national power system ensures that our homes are warm and lit, that water flows from the tap, that the internet works from the router, and that food and fuel are available in shops and petrol stations.
Digital control, remote monitoring and automation have made the energy system more efficient, but they also introduce new cyber vulnerabilities that energy security must address.
The year’s largest cyber exercise
In 2025, RIA organised a large-scale Cyber Reserve exercise in partnership with system operator Elering, focusing on how to ensure the functioning of Estonia’s energy system during a major cyber incident.
Under the exercise scenario, a real but not yet fully realised threat emerged to the operational continuity of Estonia’s electricity transmission network control centres. In the worst-case scenario, such a situation could escalate into a widespread power outage.
The exercise focused on identifying and mitigating risks where an attacker is suspected of having penetrated an organisation’s IT systems and may be able to remotely influence transmission network control systems, and on ensuring power system management under extreme conditions.
Nearly 200 experts from close to ten organisations took part in the exercise, which brought together cybersecurity, electricity supply security and crisis management into a single, integrated whole. Participants were given a realistic picture of how a cyber incident could disrupt the power system and what options the state and providers of vital services have to resolve such a situation.
What is the Estonian Cyber Reserve?
The Cyber Reserve is a nationwide network of experts managed and developed by RIA. Its purpose is to support the state and providers of vital services during high-impact cyber incidents. The Cyber Reserve includes more than one hundred experts from across Estonia, drawn from both the public and private sectors, whose knowledge and skills can be deployed when normal resources are no longer sufficient.
Activating the Cyber Reserve requires strong coordination, clear command structures and shared situational awareness. To practise these aspects, RIA organises complex exercises every year that simulate emergencies or imminent threats arising from cyber incidents and test cooperation at both technical and strategic levels.
Leadership and decision-making in a crisis
A key element of the exercise was practising leadership and decision-making.
Cyber incidents in the energy sector require rapid and well-considered decisions under conditions of limited information, often with far-reaching consequences.
Participants were confronted with dilemmas that required balancing system security against the risk of power outages. Responses unfolded in real time and depended on close cooperation between Elering, RIA, other state authorities (including ministries and the Government Office) and Cyber Reserve experts.
Supply security also depends on cyber resilience
The exercise confirmed that supply security is not only a matter of physical failures or generation capacity. Cyber threats can affect system control even when physical infrastructure is intact and production matches demand. It is therefore essential that the planning and development of the energy system systematically take cyber risks into account, including their potential impact on frequency control, reserve use and recovery processes.
The exercise underlined the need to maintain and develop the capability to restore the power system even when digital control systems are temporarily disrupted.
This requires both technical solutions and people with the necessary know-how, as well as clearly defined roles and responsibilities.
The Cyber Reserve exercise demonstrated how closely intertwined cybersecurity and energy security are. Resolving a high-impact cyber incident demands readiness to act in uncertain and rapidly changing conditions, to make decisions with incomplete information, and to sustain effective cooperation across different organisations. Cooperation builds resilience.
Last updated: 11.02.2026
