{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T05:06:10Z","timestamp":1750309570902,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":39,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,12,13]],"date-time":"2024-12-13T00:00:00Z","timestamp":1734048000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,13]]},"DOI":"10.1145\/3716554.3716565","type":"proceedings-article","created":{"date-parts":[[2025,5,28]],"date-time":"2025-05-28T12:05:02Z","timestamp":1748433902000},"page":"70-80","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Digital supply chain security for power sector operators in the light of the new EU directives and regulation"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5368-0917","authenticated-orcid":false,"given":"Arne Roar","family":"Nygard","sequence":"first","affiliation":[{"name":"Norwegian University of Science and Technology, Trondheim, Norway"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2966-9683","authenticated-orcid":false,"given":"Sokratis","family":"Katsikas","sequence":"additional","affiliation":[{"name":"Norwegian University of Science and Technology, Trondheim, Norway"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,5,28]]},"reference":[{"key":"e_1_3_3_2_2_2","unstructured":"Marie Aarland. 2023. Enhancing Cybersecurity In The Power Industry\u2019s Digital Supply Chain: Exploring Procurement Strategies. Interview."},{"key":"e_1_3_3_2_3_2","unstructured":"Ayman Al\u00a0Issa Tucker Bailey Jim Boehm and David Weinstein. 2021. Enterprise cybersecurity: Aligning third parties and supply chains. https:\/\/www.mckinsey.com\/capabilities\/risk-and-resilience\/our-insights\/enterprise-cybersecurity-aligning-third-parties-and-supply-chains."},{"key":"e_1_3_3_2_4_2","unstructured":"America\u2019s Cyber Defense Agency (CISA). 2023. Hardware Bill of Materials (HBOM) Framework for Supply Chain Risk Management. https:\/\/www.cisa.gov\/resources-tools\/resources\/hardware-bill-materials-hbom-framework-supply-chain-risk-management."},{"key":"e_1_3_3_2_5_2","unstructured":"America\u2019s Cyber Defense Agency (CISA). 2024. Software Bill of Materials (SBOM). https:\/\/www.cisa.gov\/sbom."},{"key":"e_1_3_3_2_6_2","doi-asserted-by":"publisher","unstructured":"Elisabetta Biasin and Erik Kamenja\u0161evi\u0107. 2022. Cybersecurity of medical devices: new challenges arising from the AI Act and NIS\u00a02 Directive proposals. International Cybersecurity Law Review 3 1 (01 Jun 2022) 163\u2013180. 10.1365\/s43439-022-00054-x","DOI":"10.1365\/s43439-022-00054-x"},{"key":"e_1_3_3_2_7_2","doi-asserted-by":"publisher","unstructured":"Glenn\u00a0A. Bowen. 2009. Document Analysis as a Qualitative Research Method. Qualitative Research Journal 9 2 (01 Jan 2009) 27\u201340. 10.3316\/QRJ0902027","DOI":"10.3316\/QRJ0902027"},{"key":"e_1_3_3_2_8_2","doi-asserted-by":"publisher","unstructured":"Sandor Boyson. 2014. Cyber supply chain risk management: Revolutionizing the strategic control of critical IT systems. Technovation 34 7 (2014) 342\u2013353. 10.1016\/j.technovation.2014.02.001","DOI":"10.1016\/j.technovation.2014.02.001"},{"key":"e_1_3_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-323-91614-1.00013-7"},{"key":"e_1_3_3_2_10_2","doi-asserted-by":"publisher","unstructured":"Pier\u00a0Giorgio Chiara. 2022. The IoT and the new EU cybersecurity regulatory landscape. International Review of Law Computers & Technology 36 2 (2022) 118\u2013137. 10.1080\/13600869.2022.2060468 arXiv:10.1080\/13600869.2022.2060468","DOI":"10.1080\/13600869.2022.2060468"},{"key":"e_1_3_3_2_11_2","doi-asserted-by":"publisher","unstructured":"Philipp Eckhardt and Anastasia Kotovskaia. 2023. The EU\u2019s cybersecurity framework: the interplay between the Cyber Resilience Act and the NIS\u00a02 Directive. International Cybersecurity Law Review 4 2 (01 Jun 2023) 147\u2013164. 10.1365\/s43439-023-00084-z","DOI":"10.1365\/s43439-023-00084-z"},{"key":"e_1_3_3_2_12_2","unstructured":"European Cyber Security Organisation (ECSO). 2024. Challenges of the Industry to implement the CRA. https:\/\/ecs-org.eu\/ecso-uploads\/2024\/03\/ECSO_Survey_CRA_2024.pdf."},{"key":"e_1_3_3_2_13_2","unstructured":"European Parliament and the Council. 2020. The EU\u2019s Cybersecurity Strategy for the Digital Decade. https:\/\/ec.europa.eu\/newsroom\/dae\/redirection\/document\/72164."},{"key":"e_1_3_3_2_14_2","unstructured":"European Parliament and the Council. 2022. DIRECTIVE (EU) 2022\/2555. https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555."},{"key":"e_1_3_3_2_15_2","unstructured":"European Parliament and the Council. 2022. REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019\/1020. https:\/\/digital-strategy.ec.europa.eu\/en\/news-redirect\/756860."},{"key":"e_1_3_3_2_16_2","unstructured":"European Parliament and the Council. 2024. COMMISSION DELEGATED REGULATION (EU) 2024\/1366. https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=OJ%3AL_202401366"},{"key":"e_1_3_3_2_17_2","unstructured":"European Union Agency for Cybersecurity (ENISA). 2017. Stock taking of information security training needs in critical sectors. https:\/\/www.enisa.europa.eu\/publications\/stock-taking-of-information-security-training-needs-in-critical-sectors?v2=1."},{"key":"e_1_3_3_2_18_2","unstructured":"European Union Agency for Cybersecurity (ENISA). 2022. European Cybersecurity Skills Framework (ECSF) - User Manual. https:\/\/www.enisa.europa.eu\/publications\/european-cybersecurity-skills-framework-ecsf\/@@download\/fullReport."},{"key":"e_1_3_3_2_19_2","unstructured":"European Union Agency for Cybersecurity (ENISA). 2023. Threat Landscape 2023. https:\/\/www.enisa.europa.eu\/publications\/enisa-threat-landscape-2023."},{"key":"e_1_3_3_2_20_2","unstructured":"European Union Agency for Cybersecurity (ENISA). 2024. Foresight Cybersecurity Threats For 2030 - Update 2024: Extended report. https:\/\/www.enisa.europa.eu\/publications\/foresight-cybersecurity-threats-for-2030-update-2024-extended-report\/@@download\/fullReport."},{"key":"e_1_3_3_2_21_2","series-title":"(SOUPS \u201923)","volume-title":"Proceedings of the Nineteenth USENIX Conference on Usable Privacy and Security","author":"Evripidou Stefanos","year":"2023","unstructured":"Stefanos Evripidou, Uchenna\u00a0D Ani, Stephen Hailes, and Jeremy D\u00a0McK. Watson. 2023. Exploring the security culture of operational technology (OT) organisations: the role of external consultancy in overcoming organisational barriers. In Proceedings of the Nineteenth USENIX Conference on Usable Privacy and Security (<conf-loc>, <city>Anaheim<\/city>, <state>CA<\/state>, <country>USA<\/country>, <\/conf-loc>) (SOUPS \u201923). USENIX Association, USA, Article 7, 17\u00a0pages."},{"key":"e_1_3_3_2_22_2","doi-asserted-by":"publisher","unstructured":"Donald David\u00a0Stewart Ferguson. 2023. The outcome efficacy of the entity risk management requirements of the NIS2 Directive. International Cybersecurity Law Review 4 4 (01 Dec 2023) 371\u2013386. 10.1365\/s43439-023-00097-8","DOI":"10.1365\/s43439-023-00097-8"},{"key":"e_1_3_3_2_23_2","unstructured":"Jeremy Haas and Ryan Bergquist. 2019. Five Questions to Ask About Third-Party Vendors and Cybersecurity. https:\/\/www.supplychainbrain.com\/blogs\/1-think-tank\/post\/30489-the-company-you-keep-five-questions-to-ask-about-third-party-vendors-and-cybersecurity."},{"key":"e_1_3_3_2_24_2","doi-asserted-by":"publisher","unstructured":"Badis Hammi and Sherali Zeadally. 2023. Software Supply-Chain Security: Issues and Countermeasures. Computer 56 7 (2023) 54\u201366. 10.1109\/MC.2023.3273491","DOI":"10.1109\/MC.2023.3273491"},{"volume-title":"Industrial communication networks - Network and system security - Part 1-1: Terminology, concepts and models","year":"2009","key":"e_1_3_3_2_25_2","unstructured":"IEC62443-1-1-2009 2009. Industrial communication networks - Network and system security - Part 1-1: Terminology, concepts and models. Standard. International Electrotechnical Committee, Geneva, CH."},{"volume-title":"Information security, cybersecurity and privacy protection Information security management systems Requirements","year":"2022","key":"e_1_3_3_2_26_2","unstructured":"ISO\/IEC 27001:2022 2022. Information security, cybersecurity and privacy protection Information security management systems Requirements. Standard. International Standardization Organization, Geneva, CH."},{"key":"e_1_3_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-99-6974-6_14"},{"key":"e_1_3_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-38530-8_20"},{"key":"e_1_3_3_2_29_2","doi-asserted-by":"publisher","unstructured":"Kristian Kannel\u00f8nning and Sokratis Katsikas. 2023. A systematic literature review of how cybersecurity-related behavior has been assessed. Information & Computer Security 31 (2023) 463 \u2013 477. 10.1108\/ICS-08-2022-0139","DOI":"10.1108\/ICS-08-2022-0139"},{"key":"e_1_3_3_2_30_2","unstructured":"Aikaterina Latsiou Arne\u00a0Roar Nyg\u00e5rd Sokratis Katsikas and Costas Lambrinoudakis. 2024. Never Trust \u2013 Always Verify: Managing Cybersecurity Risk in the Digital Supply Chain. Submitted."},{"key":"e_1_3_3_2_31_2","unstructured":"Mattis van \u2019t Schip. 2024. The Regulation of Supply Chain Cybersecurity in the NIS2 Directive in the Context of the Internet of Things. European Journal of Law and Technology 15 1 (02 May 2024). https:\/\/ejlt.org\/index.php\/ejlt\/article\/view\/989"},{"key":"e_1_3_3_2_32_2","unstructured":"Norwegian Intelligence Service. 2024. Focus 2024: The Norwegian Intelligence Service\u2019s assessment of current security challenges. https:\/\/www.etterretningstjenesten.no\/publikasjoner\/focus\/Focus24_contents."},{"key":"e_1_3_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1145\/3538969.3544421"},{"key":"e_1_3_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.5220\/0012046000003555"},{"key":"e_1_3_3_2_35_2","unstructured":"Maria Papaphilippou Konstantinos Moulinos and Marianthi Theocharidou. 2023. Good Practices for Supply Chain Cybersecurity. https:\/\/www.enisa.europa.eu\/publications\/good-practices-for-supply-chain-cybersecurity."},{"key":"e_1_3_3_2_36_2","doi-asserted-by":"publisher","unstructured":"Sandra Schmitz-Berndt. 2023. Defining the reporting threshold for a cybersecurity incident under the NIS Directive and the NIS 2 Directive. Journal of Cybersecurity 9 1 (01 Jan 2023) tyad009. 10.1093\/cybsec\/tyad009","DOI":"10.1093\/cybsec\/tyad009"},{"key":"e_1_3_3_2_37_2","doi-asserted-by":"publisher","unstructured":"Mohammed\u00a0Raiz Shaffique. 2024. Cyber Resilience Act 2022: A silver bullet for cybersecurity of IoT devices or a shot in the dark? Computer Law & Security Review 54 (2024) 106009. 10.1016\/j.clsr.2024.106009","DOI":"10.1016\/j.clsr.2024.106009"},{"key":"e_1_3_3_2_38_2","unstructured":"Abdul Subhani. 2021. Risks And Vulnerabilities When Using Third-Party Vendors. https:\/\/www.forbes.com\/sites\/forbestechcouncil\/2021\/06\/14\/risks-and-vulnerabilities-when-using-third-party-vendors\/?sh=19e3ca7f2a4b."},{"key":"e_1_3_3_2_39_2","doi-asserted-by":"publisher","unstructured":"Niels Vandezande. 2024. Cybersecurity in the EU: How the NIS2-directive stacks up against its predecessor. Computer Law & Security Review 52 (2024) 105890. 10.1016\/j.clsr.2023.105890","DOI":"10.1016\/j.clsr.2023.105890"},{"key":"e_1_3_3_2_40_2","unstructured":"Guy Waizel. 2023. he potential effects of recent EU cybersecurity and resilience regulations on cloud adoption and EU cyber resilience. \"CES\" Working Papers XV 3 (2023) 231 \u2013 253. https:\/\/ceswp.uaic.ro\/articles\/CESWP2023_XV3_WAI.pdf"}],"event":{"name":"PCI 2024: 28th Pan-Hellenic Conference on Progress in Computing and Informatics","acronym":"PCI 2024","location":"Athens Greece"},"container-title":["Proceedings of the 28th Pan-Hellenic Conference on Progress in Computing and Informatics"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3716554.3716565","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3716554.3716565","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:19:11Z","timestamp":1750295951000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3716554.3716565"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,13]]},"references-count":39,"alternative-id":["10.1145\/3716554.3716565","10.1145\/3716554"],"URL":"https:\/\/doi.org\/10.1145\/3716554.3716565","relation":{},"subject":[],"published":{"date-parts":[[2024,12,13]]},"assertion":[{"value":"2025-05-28","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}