KiVA2025 - Cyber Security Exercise at Nuclear Facilities

SLOVENIA, December 5 - The KiVA exercise series has a special role in Slovenia, as it brings together key stakeholders in nuclear safety, nuclear security, emergency preparedness and response, and cyber security. The first KiVA exercise in 2019 and the second, more technically complex KiVA²⁰²², were recognised as examples of good practice at the international level during International Atomic Energy Agency review missions. Both contributed significantly to improving and testing procedures, clarifying responsibilities, working with actual operational technology (OT) systems and information technology (IT) systems in nuclear facilities, and assessing communication pathways in the event of a cyber incident.

This year’s exercise, KiVA²⁰²⁵, was designed as a table-top exercise aimed at testing decision-making, coordination, and communication among stakeholders. The scenario simulated conditions as close to real as possible and examined the adequacy of existing procedures and cooperation between nuclear facility operators and the competent institutions. The exercise enabled a comprehensive assessment of preparedness and the coherence of response actions in the event of a cyber incident requiring a rapid, reliable, and effective response.

Participants were divided into two groups, one from the Krško NPP and the other from JSI. The groups were multidisciplinary, consisting of OT and IT experts, as well as operators. This composition provided a valuable and rare opportunity to exchange knowledge and perspectives on cyber security from multiple angles. The exercise was also observed by representatives of the Slovenian Computer Emergency Response Team (SI-CERT), the Agency for Radioactive Waste Management (ARAO), and GEN energija, d.o.o.

With the successful completion of KiVA²⁰²⁵, Slovenia has once again demonstrated its commitment to continuously strengthening cyber security in nuclear and radiation facilities and enhancing cooperation among relevant institution.