Cyber risk assessment for battery storage
Why now
Batteries are now targets
In under a year, attackers took renewable and storage sites offline in two countries, and new modeling puts a coordinated attack on battery fleets close to certain within five years.
Coordinated attack on 30+ sites
Attackers corrupted RTU firmware, wiped controllers and deleted system files. The farms lost communication with the grid operator. They got in through internet-facing firewalls and VPNs, many without MFA.
Solar and BESS taken offline
A 103 MW solar plant with a 98 MW / 312 MWh battery asked for a forced disconnection after a cyberattack during commissioning. Two months later both were still at 0% availability.
Fleets can move the grid
10,000 simulations of a coordinated attack on cloud-controlled battery fleets. Compromising about 1,500 units in ERCOT could disrupt power for up to 30 million people.
What we find on client sites
When Fractal takes on existing assets or supports a new procurement, we find the same problems again and again. The attackers in Poland used several of them.
Vendor and maintenance accounts that are shared or over-privileged, with no oversight of technician access
One admin login used by everyone, so there is no record of who changed what
Internet-facing firewalls and VPNs with local accounts, no MFA and unpatched firmware
Firewalls with no self-protection rules, no geographic blocking and broad access rules
Field devices on default passwords, without TLS, with SSH exposed and open MQTT or REST endpoints
Security cameras and other peripherals sharing the control network
Office computers that connect to plant controls, with no phishing training or audit logging
The cheapest security licenses, which limit what can be detected or blocked
Patches put off because they affect schedule and support
Monitoring and patching that stop when an asset is sold
How the assessment works
Find every way in, then close it
We map every path into the plant, test each one the way an attacker would, and hand you the corrective action for every gap we find.
Two ways to assess your site
For new and existing assets, including plants that came with someone else's network.
Remote assessment
A less intrusive review with no site visit.
On-site assessment
A full penetration test and cybersecurity assessment. The most thorough option.
What you receive
Either way, you receive an outline of our findings and the corrective actions needed to close each gap and harden the site.
Current policy and its gaps
Rules focus on who made the equipment
Federal policymakers acted this year and Texas has tightened its rules since 2021, but both focus on who owns the equipment and where it was made, not on how the site is secured.
Executive Order 14421
Declared a national emergency over the bulk power system supply chain. Covers inverters, storage and control systems, and their software, firmware and remote access, when tied to covered countries. DOE rules are due December 24 and can reach equipment already in service.
FCC Covered List
Foreign-made inverters and BESS equipment with remote or wired communications are blocked from new equipment authorizations. Models already certified can still be sold and installed.
Texas Lone Star Infrastructure Protection Act
Bars grid contracts that give designated foreign companies remote access or control. Compliance is by attestation, and access for warranty and support is allowed.
What none of them cover
No rule yet sets a baseline for how a site is networked: protocols, encryption, credentials or who watches remote sessions. Equipment that passes every origin test can still sit on a flat network with default passwords.
Risks inside the equipment
Some of the biggest exposures ship with the equipment itself.
Undisclosed communication devices
Equipment from foreign and U.S. suppliers alike ships with data acquisition systems and cellular modems that let the manufacturer push remote updates. Most buyers don't know they are there, no one monitors them, and they connect around the owner's firewall.
Supplier-controlled EMS and PPC
The EMS and PPC issue the charge and discharge commands. A coordinated fleet attack depends on those commands, so a supplier that controls them can control the plant.
Battery management systems
Backdoors can be added to BMS firmware during manufacturing, shipping or service, and time signals can be spoofed to line up commands across a fleet. Traffic is often unencrypted, and many systems cannot check whether their firmware has been altered.
Coordinated fleet attacks
An attacker who controls enough batteries can take them offline together, or charge and discharge them in sync to push frequency outside limits, tripping relays and risking blackouts.
Contract requirements
Write security into the purchase
Our consultants review commercial and technical exhibits and help buyers secure terms like these.
No undisclosed cellular modems, data acquisition systems or radio hardware; every communication path disclosed
No vendor remote access except through an owner-controlled gateway with named accounts, MFA and session logging
No firmware or software update without owner approval and signature checks
Encrypted protocols, unique credentials and segmented networks from the start
Managed switches, firewalls and other network equipment from domestic sources
Monitoring and patching obligations that transfer with the asset when it is sold
Owner or independent control of the EMS and PPC
Suppliers that follow NIST CSF 2.0, ISO/IEC 27001 and IEC 62443, including 62443-2-4 and 62443-4-1
ISO 9001 quality management for manufacturing, configuration and change control
No terms that give a specified foreign entity effective control of the facility, which can put the Section 48E credit at risk
Why Fractal EMS
In-house penetration testing
Our own team assesses new and existing assets, remotely or on site.
Cybersecurity built in
Fractal EMS builds security into its controls, with its own cyber and IT teams.
Domestic controls and BMS
Our controls, including our three-level BMS, are domestic and free of foreign entities of concern.
Standards-based
Engineered to NIST 800-53 and IEC 62443, with ISO 27001 and a NERC CIP Medium operations center.
24/7 operations center
Our Austin ROC monitors sites around the clock. In-house, never off-shored.
Contract review
Subject-matter experts in commercial and technical exhibits for equipment purchases.