This document gives security requirements for charging stations that Charge Point Operators (CPO) can use during procurement.
CPOs are controlling more and more electrical load. To support the rapid growth in electric vehicles (EVs), hundreds of thousands of charging stations are being placed throughout Europe, most of them being remotely controlled by CPOs. In this way, larger CPOs are already controlling hundreds of megawatts of demand, comparable to a large gas power plant. And the controlled load will only grow in the future.
The cyber-attacks on Ukrainian grid operators have shown that there are hackers that have the skills and motivation to disrupt the power grid. But this also means that CPOs are a target for cyber-attacks. If attackers gain control of a CPO’s infrastructure, they could switch the power on the connected charging stations. Such an attack would not only hurt the CPOs themselves. The switching could also cause grid imbalances in the supply and demand for electricity and, possibly, power outages. If smart charging is used, attackers may force charging stations to use more power than assigned to them, which could damage transformers and power lines.
To mitigate these risks, grid operators as members of ENCS and ElaadNL have asked these organizations to develop a harmonized set of requirements that CPOs can use in their procurement documents for charging stations.
Harmonizing the requirements allows CPOs to get secure charging stations more cost-effectively: It should reduce time and effort in developing requirements, as they are already freely available. It ensures the requirements are feasible, as they have been tested in a market survey and in previous tenders by other operators. It also reduces implementation costs, because vendors get a common baseline from the clients to aim at and only need to implement the security requirements once.
This document specifies security requirements for charging stations that charge point operators can use when procuring them. The requirements can be used directly in tender documents. They cover the technical security features that the charging station should have, and the measures vendors should take to ensure the correct implementation of these features.
The document is an update of the EV Charging Systems Security Requirements from 2016. ENCS has created this document together with ElaadNL.
ENCS members can review the newest version of the security requirements for charging stations in the draft page.