Sources and links on page 476 (13)
Links embedded in the original report PDF, including citations and other references. These destinations have not been independently reviewed. Links open in a new tab.
- https://www.energy-storage.news/strengthening-cybersecurity-in-energy-storage-is-a-critical-imperative/?utm_source=chatgpt.com
- https://blog.fluenceenergy.com/cybersecurity-battery-energy-storage-mitigating-risks-changing-policy-landscap?utm_source=chatgpt.com
- https://cellectenergy.com/blog/it-security-bess?utm_source=chatgpt.com
- https://industrialcyber.co/expert/bess-cyber-physical-risk/
- https://www.ul.com/resources/your-guide-battery-energy-storage-regulatory-compliance
- https://eticaag.com/cybersecurity-in-battery-energy-storage/
- https://arxiv.org/pdf/2501.05923
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ%3AL_202402847
- https://www.federalregister.gov/documents/2025/09/23/2025-18395/virtualization-reliability-standards
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-171-01
- https://www.energy.gov/sites/default/files/2025-01/BESSIE_supply-chain-battery-report_111124_OPENRELEASE_SJ_1.pdf
- https://www.brattle.com/insights-events/news/new-brattle-dragos-white-paper-provides-critical-cybersecurity-guidance-for-battery-energy-storage-systems/
- https://www.brattle.com/wp-content/uploads/2025/12/Securing-Battery-Energy-Storage-Systems-from-Cyberthreats_Final.pdf
Text on page 476
BESS: Vulnerabilities & Possible Solutions - Software as a Core Risk and Safety Layer Regulation Now Targets Software
Software-Centric Vulnerabilities
Virtualization Reliability Standards (2025) Modernize NERC CIP to cover virtual cyber assets, shared cyber infrastructure and management interfaces, directly addressing software-defined and cloud-like environments.This is relevant for all software systems that support the operation of BESS and are not on-prem.There is a growing distrust in the US against foreign entities of concern (FEOC), leading to an increased scrutiny in technology usage and communication oversight.
Remote Access Control: Most BESS cyber risks originate from remote-access weaknesses such as OEM support tunnels, VPNs without MFA, or over privileged accounts.
EU NIS2 + Cyber Resilience Act (CRA, 2025) “Secure-by-design” for software: BESS OEMs and software providers must demonstrate that security is built into their development process. This applies to EMS, BMS firmware, PCS firmware, cloud platforms, and all digital interfaces. SBOM (Software Bill of Materials) is required Vendors must provide a complete list of all software components inside their product, including open-source libraries and third-party modules. This allows operators to identify whether a vulnerability affects their BESS.
Firmware Update Risks: Insecure or outdated firmware remains a major theoretical risk for BESS, because BMS and PCS firmware directly control safety limits and grid interaction. Improperly secured update channels could, in principle, allow attackers to modify protection parameters. A public incident (2023) exploited a vulnerability in a communication gateway that was used for software updates in home storage. Cloud Access via API: Cloud-based EMS, fleet platforms, and market-dispatch APIs introduce new digital interfaces that were uncommon in earlier storage installations. As BESS fleets become more software-integrated, API hardening has become an essential cybersecurity focus. PCS highly critical hardware: All BESS hardware components are vulnerable, but since the PCS communicates with higher and lower level components, it is the most critical and vulnerable component.
In 2025, the number of regulations targeting software integrity increased. For a 400 MWh sized storage, an outage can cost up to $ 1.2 million in monthly losses. Software is a core safety layer in BESS, as EMS/BMS/PCS firmware control BESS performance and grid reliability. Software comes with cyber risk (via risks like remote access, outdated firmware, weak APIs), operators must evaluate vendors on software maturity (an example checklist on how to implement cybersecurity measures is given here).
Source: energy-storage.news, Fluence, Cellect, Industrialcyber, UL, Eticaag, Öhrström et al, Cyber Resilience Act, Federal Register, CISA, DOE, Brattle
Extracted from the PDF; charts and images may read imperfectly.
More in Industry (22)
Page 476 · 22/31