  Power systems are evolving into cyber-physical energy systems (CPES) due to
the integration of modern communication and Internet-of-Things (IoT) devices.
CPES security evaluation is challenging since the physical and cyber layers are
often not considered holistically. Existing literature focuses on only
optimizing the operation of either the physical or cyber layer while ignoring
the interactions between them. This paper proposes a metric, the Cyber-Physical
Energy System Quantitative Security Metric (CPES-QSM), that quantifies the
interaction between the cyber and physical layers across three domains:
electrical, cyber-risk, and network topology. A method for incorporating the
proposed cyber-metric into operational decisions is also proposed by
formulating a cyber-constrained AC optimal power flow (C-ACOPF) that considers
the status of all the CPES layers. The cyber-constrained ACOPF considers the
vulnerabilities of physical and cyber networks by incorporating factors such as
voltage stability, contingencies, graph-theory, and IoT cyber risks, while
using a multi-criteria decision-making technique. Simulation studies are
conducted using standard IEEE test systems to evaluate the effectiveness of the
proposed metric and the C-ACOPF formulation.
