The multiplication of access interfaces and technologies in Electric Power Utilities (EPUs) communication architectures and the smart grid developments, which will enable numerous new services with new traffic patterns, will change radically both network accesses and core architectures. This evolution could introduce new vulnerabilities to the reliability of electricity supply, based on the introduction and exposure of vulnerabilities in digital systems, architectures, and communications. This situation calls for new security requirements for digital systems and the underlying architecture used in EPUs. Security requirements have to be derived from appropriate risk assessments and general architectural decisions. Numerous existing cyber security standards provide guidance and use-cases which represent valuable inputs for the development of such requirements. The proliferation of standards suggests, however, that the existing documents either do not meet completely the needs of EPUs or are difficult to combine together. This paper focuses on two weak points of the existing cyber security standards in the area. Initially, the paper addresses the characterization, categorization and modeling of malicious cyber threats, which represent key steps in a risk assessment process. The paper presents a conceptual model expressing the meaning and the links between the key concepts of cyber security risks. Following this, the work examines attack modeling, addressing some pertinent technical and architectural issues. In addition, the paper explains why attack modeling is central to risk assessment and present graphical approaches to attack modeling. The second part the paper addresses the use of security architecture principles, notably the graded security approach as a fundamental framework to classify and structure a process of risk mitigation by security controls in both current and future EPU architectures. This discussion starts with the clarification of the terminology related to a graded security approach and then gives a general overview of the characteristics of known standards and best practices of graded security architectures. Following this, the paper presents an outlook of classification criteria to enable the implementation of a graded security approach in a real world environment and then illustrates the effectiveness and adaptability of a graded security approach in a real-world attack case.