UkrainianProfessional Education

Abstract

The rapid digitalization of renewable energy facilities is creating a new class of risks related to information security, data integrity, and operational process resilience. With the growth in solar and wind power plant capacity, integration of intelligent control systems, and remote monitoring channels, the dependence of business indicators on the reliability of IT/OT landscapes is increasing. Existing international risk management standards (ISO 31000, ISO/IEC 27005, NIST RMF) do not fully take into account the geographical distribution of assets, seasonality of generation, hybridity of SCADA infrastructures, and the specifics of interaction with market and meteorological APIs. The article proposes the SURE RM model - a structured, practically oriented approach to IT risk management in renewable energy projects. The model covers the full life cycle: from the formation of an asset register and threat scanning to context analytics, development and implementation of response plans, and evaluation of the effectiveness of the measures taken. Special attention is paid to the semi-quantitative risk assessment method (P×I×D×C), which provides transparent prioritization of scenarios and optimization of costs for countermeasures. The proposed artifacts (asset register, threat catalog, risk heat maps, playbooks) are integrated with PMBOK, PRINCE2 and Agile methodologies, which makes the model compatible with traditional and agile project management. A demonstration example of a 10 MW solar power plant shows practical steps for building a threat map, ranking risks and choosing a response strategy, which allows reducing the average downtime, accelerating SCADA data recovery and reducing financial losses. SURE RM provides structured stakeholder engagement, generates performance metrics (MTTR, RTO, RPO, MFA coverage) and facilitates coordination with external audits. The model can be scaled for a portfolio of facilities of different generation types, supports threat catalog updating and analytics automation. The extended abstract reflects the scientific novelty, practical utility and potential directions for further research, including calibration of probabilistic models based on historical incidents, development of automated monitoring panels and economic assessment of the effectiveness of countermeasures in the long term

Keywords: