The industrial control systems that support energy production, transmission, distribution and ultimately end-use represent complex, intertwined computer-based systems and networks merging state-of-the-art technologies with legacy systems. Implementing cyber security for these systems is extremely challenging. Research is needed across multiple operational areas, and includes the development of methodologies to determine and assess their security and associated risks, the development of protective measures for both new and legacy systems, the detection of cyber-attacks as well as the monitoring of system resilience.