Preparation for compliance with PETA requirements and cybersecurity audit

PETA is the Lithuanian abbreviation for the Rules for the Use of Electricity Networks, which establish security requirements applicable to the control systems of power generation and energy storage facilities.

The requirements apply to operators of power generation and energy storage facilities with a maximum capacity (Pmax) exceeding 100 kW. They are relevant to both existing facilities and new facilities being connected to the electricity network.

Depending on whether the facility is connected to the distribution network (ESO) or the transmission network (Litgrid), the relevant Rules for the Use of Electricity Networks apply.

Facility operators must ensure that their control systems comply with the established security requirements and submit a security declaration and a cybersecurity audit report to the relevant network operator.

• preparation for compliance with PETA requirements;
• PETA cybersecurity audit;
• a comprehensive service covering preparation, a cybersecurity audit and assistance in preparing the security declaration.

Depending on the selected scope of services, the process may include:

• a current-state analysis and gap assessment;
• an assessment of risks related to control system components, manufacturers and suppliers;
• preparing or updating the required cybersecurity documentation and organising evidence of compliance;
• a cybersecurity audit of processes and technical security measures;
• preparing the cybersecurity audit report and the required annexes;
• preparing the security declaration or assisting with its preparation.

Depending on the selected scope of services:

• compliance with the PETA security requirements is assessed;
• gaps are identified and recommendations for addressing them are provided;
• evidence of compliance is collected and organised;
• the required cybersecurity documentation is prepared or updated;
• a cybersecurity audit is performed, and an audit report with the required annexes is prepared;
• a security declaration is prepared.

• The applicable PETA security requirements and the actions required to implement them are clearly identified.
• Cybersecurity gaps in control systems and priorities for addressing them are identified.
• Documents and technical evidence demonstrating compliance are collected and organised.
• The organisation is prepared to demonstrate and declare compliance with the PETA security requirements.