Please note: If you require URGENT Assistance or Response you should contact the DCC SOC via security@smartdcc.co.uk, as well as the DCC Service Desk, which is manned 24/7, on completion of this form.

The Security Sub-Committee (SSC) inbox is only manned during working hours - Monday to Friday, 9am-5pm.

Forms received outside of working hours will only be processed on the next available working day.

Failed to send your application. Please check your application and try again.

Which form are you filling in?

(Required)

The SEC Section G3.21A requires a CPL Manufacturer to report material security vulnerabilities to the SEC Security Sub-Committee (SSC):

“SEC G3.21A Where a CPL Manufacturer becomes aware of any material security vulnerability in, or likely cause of a material adverse effect on, the security of any Device Model in respect of which it is the CPL Manufacturer, it shall comply with the requirements of Section G3.18(b) and (c).”

In addition, Virtual WAN Device (VWD) manufacturers and manufacturers of SSC-approved Trial Devices must also notify the SSC of any security incidents or vulnerabilities where this is shown on the Certificate as a condition of approval.

For these purposes the following definition of "Material Security Vulnerability", applies:

"Material Security Vulnerability" means a weakness or exposure in (or in connection with) a Relevant Metering System which:

(i) renders the Metering System (and/or the data stored thereon) materially vulnerable to unauthorised access or operation, or unauthorised interference causing theft or corruption of data; and/or

(ii) is likely to have a material adverse effect on the security of any hardware, software or firmware which forms part of the Metering System.

Confidentiality Provisions

The SSC (and SECAS acting on its behalf) adheres to the SEC Panel Information Policy which ensures the safeguarding of the confidentiality, privacy and security of information handled by the SSC. The SSC uses Egress (KnowBe4) (approved by NCSC) as a secure, encrypted format to handle, store and retain confidential information and access is restricted to ‘those who have a need to know’.

SSC Members have signed ‘Non-Disclosure Agreements’ and use information about material security vulnerabilities and security incidents to undertake risk assessments as required by the Smart Energy Code (SEC) and to monitor risk mitigations. The SSC will ensure that parties affected by a vulnerability are made aware as required by the CPA Build Standard.

The information you provide within this form will be made available to the SSC who will notify SEC User Parties that are currently operating one or more of the affected Devices. This is to ensure that obligations under G3.21A and G3.18 b) and c) are met for CPL Manufacturers and for VWD and Trial Device manufacturers to meet the conditions of the Certification.

Please note that (Required) denotes a mandatory field that the manufacturer must fill in.

Is the Device Model listed on the CPL (excluding VWAN Devices)?(Required)
Affected device information
Device Model Device Description CPL Entry Number(s) Action
(Plain-English-description) e.g. SIMCH DB
(SMETS1, SMETS2, ESME, GSME, CH, SAPC, PPMID, Trial Device)
e.g. 000651, 000705
indicates required field
If this is a VWAN Device, please confirm what this is based on from the options below(Required)

The Smart Energy Code (SEC) places obligations on the DCC and DCC Users (SEC Parties who have completed the User Entry Process); and Triage Facility Providers to notify the Security Sub-Committee (SSC) of any Vulnerabilities or Incidents that occur in, or cause a material adverse effect on the security of, hardware, software, firmware or a Device. These obligations are G2.11, G2.15, G2.30, G3.5 and G3.18, (G12.4(i) and G12.5 for Triage Facility Providers).

In addition, DCC Users make use of the Smart Metering Key Infrastructure (SMKI). SMKI provides a secure and effective means of ensuring that messages to and from Smart Metering Equipment are properly authenticated, provide integrity and, where applicable, provide non-repudiation. SMKI can become Compromised (or suspected of being Compromised) and may adversely affect the security of a DCC User. DCC Users should inform the SSC and the SMKI Policy Management Authority (SMKI PMA) of a Compromise (or suspected Compromise) of their Cryptographic Material.

This form has been created for the DCC, DCC Users and Triage Facility Providers, to notify the SSC and/or the SMKI PMA of any Security Vulnerabilities or Security Incidents, or Compromises (or suspected Compromises) of Cryptographic Material. Egress (rebranded to KnowBe4) is a secure and effective mechanism using encryption for sharing sensitive information and has been selected as the secure web-based platform to share confidential smart metering related information.

Confidentiality Provisions

The SSC (and SECAS acting on its behalf) adheres to the SEC Panel Information Policy which ensures the safeguarding of the confidentiality, privacy and security of information handled by the SSC. The SSC uses Egress (KnowBe4) (approved by NCSC) as a secure, encrypted format to handle, store and retain confidential information and access is restricted to ‘those who have a need to know’.

SSC Members have signed ‘Non-Disclosure Agreements’ and use information about material security vulnerabilities and security incidents to undertake risk assessments as required by the Smart Energy Code (SEC) and to monitor risk mitigations.

The information you provide within this form will be made available to the SSC and/or SMKI PMA via SECAS – who are the Smart Energy Code Secretariat and Administrator.

Please note that (Required) denotes a mandatory field that the DCC or DCC User must fill in

Which entity is reporting security incident or vulnerability?(Required)
Type of SEC Party impacted

Type

Complete Part 1 for:
Complete Part 2 for:
Complete Part 3 for:

Part 1: Report of a Security Vulnerability or Security Incident

This report will be reviewed by the SSC and SMKI PMA and referred to any governance groups as appropriate.

Nature of Impact

Has it affected confidentiality of personal data or consumption data?(Required)
Has it affected the integrity of the system e.g. is trust in the SMKI Private Key Material Compromised?(Required)
Has it affected system availability and the operation of smart services?(Required)
Nature of Impact(Required)
Reason for reporting the Security Vulnerability or Security Incident:(Required)

Part 2

Report of a SMKI Recovery Event (Method 1)

Part 3

To be completed if using Methods 2 or 3

Upload your support files

Use the uploader to submit additional files.

Drop files here
or