Emerging risks
Within the Group’s Enterprise Risk Management model, particular attention is paid to identifying changes in the reference context in order to seize upon events or macro-trends coming from outside the organisation that could have a significant medium-long term impact (3-5 years and beyond) on Snam’s business or on the sector.
These changes may, on the one hand, cause new risks to emerge in the long term, but also have consequences for the company today, changing the nature and extent of potential impacts and the probability of occurring of already identified risks.
The purpose of the process of identifying emerging risks is to succeed in assessing their impact in good time and putting in place the necessary strategies and related mitigation actions, both in terms of prevention and control. In this area, some of the emerging risks identified by Snam are cyber security and risks related to the energy transition.
Cyber security
Materiality and potential impacts on Snam
Snam carries out its activities through a complex technological architecture relying on an integrated model of processes and solutions capable of promoting the efficient management of the entire country’s gas system. The development of the business and recourse to innovative solutions capable of continuous improvement, however, requires a constant focus and an ability to continuously adapt to the changing needs to protect it. The Group’s new Business Plan provides for approximately 500 million euros of investments in digitalisation – from the remote control of activities to the implementation of articulated infrastructures enabling the Internet of Things via which Snam aims to become the most technologically-advanced gas transportation operator in the world, as well as to guarantee increasingly greater security and sustainability in its business processes.
Global experts project and the company believes that cyber security threats will evolve in the future, in terms of both number and complexity. The digital channel is increasingly used illicitly by various types of actors with different purposes and modes of action: cyber criminals, cyber hacktivists, and state-sponsored action groups. Similarly, technological evolution makes increasingly sophisticated tools available to these categories, through which consolidated attack techniques can be made more effective and new ones can be developed. In addition to this, the increasing digitalisation of the network with the use of new technologies (e.g. Internet of Things) poses significant challenges for the Group in these regards, extending the potential attack surface exposed by both internal and external threats.
In this scenario, cyber security plays an extremely important role as it deals with preventing or tackling very diverse events that can range from the compromise of individual workstations to the degradation of entire business processes in the field of transportation, storage and regasification, with potential effects on the normal capacity to provide the service.
A correct approach to cyber security management also makes it necessary to ensure full compliance with the increasingly stringent sector regulations issued at both European and national level, in order to improve the management and control oversight of companies that provide essential services to the country.
Mitigation actions
Snam has developed its own cyber security strategy based on a framework defined in accordance with standard principles on the subject and has had a dedicated department for a few years now which, comprehensively, deals with addressing and implementing what has been planned at the strategic level, ranging from governance aspects to those that are more predominately technological.
First and foremost, we should note the adaptation of internal processes to the provisions of standards ISO/IEC 27001 (Information Security Management Systems) and ISO 22301 (Business Continuity Management Systems), as well as the formal certification of conformity to the listed standards of an independent third party. Secondly, on the basis of multiple activities, out of which Risk Analysis and Technical Verification activities stand out, the protection needs arising from technological evolution, from changing business processes or from the identification of previously unknown vulnerabilities, are assessed and, where appropriate, solutions to replace or integrate those already in place are implemented. More specifically, in order to adequately counter the most modern cyber threats, Snam has defined a cyber security incident management model intended to prevent, monitor and, when necessary, implement prompt remediation against events potentially capable of harming the confidentiality, integrity and availability of information processed and the IT systems used. At the basis of these activities is a Security Incident Response Team which, by relying on solutions that make it possible to collect and correlate all security events recorded throughout the company’s IT infrastructure, has the task of monitoring all anomalous situations that could have negative impacts for the company and activate, when necessary, suitable containment and remediation actions via the involvement of the technical and business structures concerned. Even in 2020, the Security Incident Response Team was able to work without interruption and guarantee its support activities 24 hours a day, seven days a week.
The change that has become necessary in operational processes and, in particular, the massive recourse to remote working methods has not had an impact on overall security posture to date; this is mainly due to the fact that the adoption of smartworking, which has occurred in recent years as an alternative solution to working in the office, had already led to risk analysis activities and the adoption of security solutions suitable to preserve the company’s interests, even in the presence of a potential attack surface that is larger than in the past. As part of the cyber incident management activities (preventive and reactive) and in respect of formal agreements signed between the various parties, information-sharing with national and European institutions and peers is used in order to improve the capacity and speed of response when faced with the possible negative events for which exposure may be a reality. This practice will also become increasingly necessary in the future given the cyber threat notification requirements that national security regulations impose and will impose.
With regard to technological development, as mentioned previously, Snam has set in motion an ambitious digitalisation programme that will radically change business processes in the years to come and within which a strong focus on cyber security will always be guaranteed. During 2020, the foundations were laid for the safe development of all the nascent Internet of Things initiatives. Firstly, a precise Security by Design process has been defined, which puts in place compliance for precise requirements and checks for each application and infrastructural development. Additionally, more appropriate security technologies have been defined to support the new capabilities that Snam will acquire in the years to come. Lastly, the security processes to be developed have been identified in order to take due account of the new security requirements that arise from a business context in which work methods, the technologies adopted and the surface area exposed to digitalisation will change considerably over the course of just a few years.
A great deal of attention is also paid to increasing awareness and specialist training of personnel, in order to facilitate the identification of weak signals and raising consciousness about risks of a cyber nature that could occur during normal work activities. Therefore, regular initiatives of various kinds are organised in this area, for which recourse is made to the teaching methods deemed most appropriate at any given time: frontal instruction, the creation of multimedia, exercises and tests, newsletters, etc.
With reference to the management of information supporting business processes, it is worth highlighting that the company owns assets used for data transmission to and from the country (fibre); this gives greater intrinsic security thanks to not being dependent on the service provided by third-parties and the possibility of using the communication channel exclusively.
Energy transition and development of the hydrogen technologies market
Materiality and potential impacts on Snam
While the climate change demonstrates the real effects of rising temperatures, the energy sector is facing a momentous transformation. Without any change to the company’s commitment to its core business of regulated activities for natural gas transportation, storage and regasification, Snam is building a wide-ranging and diversified platform of activities related to energy transportation (in particular, renewable energy transport and management, the construction and management of plants related to sustainable mobility and energy efficiency) to seize upon the opportunity of being a “system integrator” able to offer green solutions and contribute to the development of renewable gases.
The business diversification can reinforce Snam’s position as an enabler of the energy transition towards forms of using resources and energy sources that are compatible with environmental protection and gradual decarbonisation, with a long-term vision that is in keeping with its purpose and European objectives.
Furthermore, Snam has been working to make its infrastructure suitable for transporting increasing quantities of renewable gas with the prospect of transporting fully decarbonised gas by 2050.
In this context, and with particular reference to the Group’s strategy, the main risk factors include the risks posed by technological innovation in favour of switching to the use of electric technologies, and/or delays in the development of new technologies for the production, transportation and storage of green hydrogen at competitive costs; the delay or failure to make investments (infrastructures, projects, new acquisitions) as a result of uncertainties related to operational, economic, regulatory, authorisation, competitive and social factors; the failure to develop the hydrogen market with to the value chain that should fuel the infrastructure. Lastly, consideration must be given to the possible evolution of the regulatory framework in favour of intermittent energy sources and which would, at the same time, penalise the development of the renewable gas market.
Indeed, these factors may penalise the achievement of the development objectives of the aforementioned activities and, more generally, the opportunity for Snam to benefit from the new mega-trends in the energy transition.
Mitigation actions
The development and introduction of new technologies that would enable the achievement of the development objectives for energy transition activities pose a number of challenges for the Group. In this context, specific initiatives have been identified and developed, in order to respond to the urgent need to address climate change. With particular reference to the hydrogen value chain, the study of the necessary technological developments connected to the chemical and physical processes for the relative production requires particular skills and expertise, in order to support research and development both within the company and the national system. The processes commonly used for the commercial production of hydrogen are: the reforming of hydrocarbons and biogas (95%), a thermochemical conversion process, which requires conversion temperatures between 150° and 500°C with the production of CO2 equivalent to the hydrocarbon used, and the electrolysis of water (4-5%). Specifically, the lack of skills in the alternative technologies to natural gas is a risk that could potentially be exacerbated by rapid changes in the external environment. That is why the Group is always committed to the development of internal competencies, to bringing skills in-house via acquisitions and to the participation and encouragement of governmental and industry working groups dedicated to hydrogen at national and international level. At the European level, it is also a member of Hydrogen Europe, while in Italy it is represented in the H2IT trade association – the Italian Hydrogen and Fuel Cell Association.
The Group’s facilities and assets will also need to be ready to seize upon the opportunities arising from the development of alternative gases to natural gas. In April 2019, first in Europe, Snam experimented with feeding a mix of 5% hydrogen and natural gas into its transmission network, an experiment that was also repeated in December 2019, doubling the percentage of hydrogen by volume to 10%. The company is currently committed to verifying the full compatibility of its infrastructure with increasing quantities of hydrogen mixed with natural gas, as well as to supporting the development of the Italian supply chain, in order to promote the use of hydrogen in many sectors, from industry to transportation. Currently, around 70% of Snam’s methane pipelines are compatible with hydrogen and standards have been defined for the purchase of only hydrogen-ready components for the network. The Group’s infrastructure development is therefore aimed, on the one hand, at the more efficient use of programmable and low-impact fossil fuels, while, at the same time, promoting the biomethane alternative and guaranteeing the necessary conditions for accommodating hydrogen also.
Italy can use hydrogen to its advantage both to achieve decarbonisation targets and to create new forms of industrial competitiveness, leveraging its manufacturing potential and its expertise in the natural gas chain: that is why it is crucial to develop partnerships to foster the development of operators along the hydrogen value chain, also participating in working groups so that Snam may take on a leading role in role in advocacy and awareness-raising activities for the use of hydrogen as a fundamental energy source for decarbonisation both in Italy and abroad.
To date, the Group has reached agreements with various entities in order to promote the growth of all phases of the hydrogen value chain, with a focus on conducting pilot projects to increase the production and use of hydrogen, via strategic partnerships in hard-to-abate industries (e.g. steel plants, refineries, other energy-intensive industries, mobility, etc.) and scouting for investment opportunities in innovative technologies (fuel cells, hydrogen production and storage).