Abstract
Microgrids and nanogrids are increasingly deployed to support decentralized generation, local resilience, and renewable integration. However, their growing reliance on digital control, communication networks, cloud services, and IT–OT integration exposes them to diverse cybersecurity threats. Unlike traditional utility-scale systems, microgrids and nanogrids often operate under resource constraints, heterogeneous architectures, and limited cybersecurity expertise, making direct application of large-scale security frameworks impractical. This paper proposes a structured cybersecurity assessment framework for small- and medium-scale energy systems, supporting systematic risk identification, evaluation, and prioritization. The framework combines architectural inventory, trust-boundary analysis, threat modeling, and maturity-based assessment across six domains: governance and risk management, identity and access management, network and communication security, control-system and device security, monitoring and incident response, and physical security. Emphasis is placed on proportionality, repeatability, and actionability, enabling application across diverse operational contexts without excessive burden. An illustrative application to a campus microgrid and building nanogrid demonstrates how the framework assesses cybersecurity posture, identifies critical vulnerabilities, and defines staged mitigation roadmaps. Results indicate that a structured, context-aware assessment approach significantly improves cybersecurity awareness, investment prioritization, and resilience-oriented decision-making in decentralized energy environments. The framework offers a practical foundation for operators, designers, and policymakers seeking to enhance micro- and nanogrid security and resilience.