applications to include cybersecurity in the decision support process. Figure 3 shows conceptually how merging the two models into a cohesive message profile. This can be used to exchange cyber and physical data between organizations. An example of a tool in the EMS that would benefit from inclusion of cybersecurity information is a coordinated cyberphysical alarm processor. The enhanced alarm processor is a suite of cyberphysical security evaluation applications that have the capability to identify cyberattack scenarios in the power system SCADA environment. The tool receives real-time feeds of cybersecurity and power system alarms, thus enabling the capability to correlate both streams of data to identify cyberattacks targeting power system operation. These messages are typically exchanged with geographically dispersed control centers through a complex networking infrastructure that is exposed to threat actors. It is possible that threat actors corrupt the integrity of legitimate monitoring messages sent from the substation to the control center by exploiting vulnerabilities in Glossaries IEC TF 57 CIM IEC TF 57 DMTF Thesauri Thesauri DMTF Information Model Selected Terms figure 3. A conceptual perspective showing the thesauri approach. Class Main DMTF:: CIM_PhysicalComputerSystemView AlignmentModel:: NetworkRouter DMTF:: CIM_OSPFAreaConfiguration AlignmentModel:: Physical Computer AlignmentModel:: NetworkWIFI IEC TC 57 CIM SCADA:: CommunicationLink +CommunicationLinks DMTF:: CIM_WiFiEndpoint 1..- +RemoteUnits IEC TC 57 CIM +RemotePoints SCADA:: RemotePoint 0.. IEC TC 57 CIM SCADA:: RemoteControl 1 +RemoteUnit 0..- IEC TC 57 CIM SCADA::RemoteUnit IEC TC 57 CIM SCADA:: Remote Source figure 4. A composite diagram of alignment between the SCADA model and DMTF model. january/february 2016 ieee power & energy magazine 99