Several countries already regulate who can reach generation control systems remotely. The European Union, with its network code on cybersecurity (Delegated Regulation 2024/1366), asks for controls on vendor access to the assets of critical entities. Lithuania restricted by law the remote access of companies from certain countries to plants above 100 kW. Brazil's grid operator requires that its regulated environment not be reachable from the internet except by VPN for authorized activities. In Colombia, the national cybersecurity guide requires an intermediate system, two-factor authentication and encryption. The trend is clear: remote access is allowed, but controlled and through a single path.
Why remote access became a regulatory topic
A modern solar plant is operated and maintained remotely. The inverter manufacturer sees it from its cloud, the maintainer diagnoses without traveling, and the owner checks production from a phone. That connectivity is a benefit, but it also means someone outside the country can, in principle, change the output of thousands of inverters at once. Regulators have noticed, and since 2021 rules have appeared in several countries. This guide summarizes the ones that could be verified at their official source or in public reference sources. How that access is organized in practice is in manufacturer remote access to inverters.
European Union: the cybersecurity network code
Commission Delegated Regulation (EU) 2024/1366 is dated 11 March 2024 and was published in the Official Journal of the European Union on 24 May 2024. It sets a network code with sector-specific rules for the cybersecurity of cross-border electricity flows. It complements Directive (EU) 2022/2555 (NIS2) for the electricity sector.
It applies to the entities that the regulation itself classifies as high-impact or critical-impact (article 24): electricity undertakings, market operators, critical ICT service providers and managed security service providers, among others (article 2). It asks for entity-level risk management (article 26), minimum and advanced cybersecurity controls (article 29) and supply chain controls (article 33).
What touches remote access directly is in article 33. The minimum supply chain controls must include procurement recommendations that cover, among other points, vendor access to the entity’s assets. They also include a network design in which devices are not trusted even inside a secure perimeter, with verification of every request and the principle of least privilege.
The European solar sector has asked to go further. SolarPower Europe published a risk analysis commissioned from DNV on 29 April 2025. In it, it proposed creating cybersecurity controls specific to remotely controlled photovoltaics and limiting remote access to and control of the Union’s PV systems from outside it through the inverter. This is an industry proposal, not a rule.
Lithuania: restriction by law
In November 2024, the Lithuanian Parliament amended its Electricity Law. The change aims to stop companies from countries that its national security strategy considers a threat from having remote access to the control systems of solar, wind and battery plants above 100 kW. According to government information reported by the public broadcaster LRT, the rule does not ban equipment already installed or force its removal, but it requires operators to put additional cybersecurity safeguards in place. It took effect on 1 May 2025.
Brazil: the ONS operating routine
The National Electric System Operator (ONS) issued the operating routine RO-CB.BR.01, Controles mínimos de segurança cibernética para o Ambiente Regulado Cibernético (minimum cybersecurity controls for the regulated cyber environment), revision 00, in force since 9 July 2021, within submodule 5.13 of its procedures. Its scope is the regulated cyber environment (ARCiber): the operating centers of the agents, the infrastructure equipment that sends or receives data and voice to the ONS or to other agents, and the ONS’s own operating environment.
On access, the routine is direct:
- networks are segmented at least into a supervision zone, an operational DMZ and a corporate zone;
- the ARCiber must not be directly reachable from the internet, even if protected by firewalls, and its assets must not be able to connect to the internet;
- access from external networks is allowed only for authorized activities, by VPN or similar technology, through a gateway or service with security controls.
It also asks for an asset inventory at least every 24 months (with manufacturer, function, address, protocol and firmware version), individual credentials, passwords different from the factory ones, and new assets connected only after available patches are applied. Implementation deadlines were 18 and 27 months from entry into force.
North America: NERC CIP
In the United States and Canada, the NERC CIP standards are mandatory for registered entities. For interactive remote access to high- and medium-impact systems, CIP-005 requires an intermediate system, encryption that ends at it and multifactor authentication. The full context is in electrical cybersecurity regulation in Latin America, which also covers the Chilean standard.
Colombia: the national cybersecurity guide
Colombia’s cybersecurity guide for the grid, updated in 2025, applies to the agents with assets that meet its criticality criteria, among them generating units of 20 MW or more. For remote access it requires two-factor authentication, monitoring, encryption, control of authorization and an intermediate system outside the logical security perimeter. Its supply chain chapter asks you to manage the risk of vendors and contractors who access critical cyber assets. Incidents are reported under a separate 2026 agreement.
What comes next: a 2026 resolution of the Ministry of Mines and Energy ordered the regulator to issue, within 24 months, cybersecurity rules for the transmission and regional grids, with periodic audits and vulnerability assessments, training and the functions of a CSIRT for the power sector, aligned with standards such as those of NERC and IEC. What CIP-013 requires when buying control equipment and software is summarised in NERC CIP-013: Supply Chain Risk Management.
Comparison
| Jurisdiction | Instrument | What it says about remote access |
|---|---|---|
| European Union | Delegated Regulation 2024/1366 | Controls on vendor access to assets of high- and critical-impact entities |
| Lithuania | Amendment to the Electricity Law (2024) | Restricts remote access by companies from certain countries to plants above 100 kW |
| Brazil | ONS RO-CB.BR.01 (2021) | Regulated environment not reachable from the internet; external access only by VPN for authorized activities |
| North America | NERC CIP-005 | Intermediate system, encryption and multifactor authentication |
| Colombia | National grid cybersecurity guide (2025) | Intermediate system, two-factor authentication, encryption, monitoring and control of authorization |
What you can take from all this
The direction is the same everywhere. Nobody bans remote maintenance. What is required is that it goes through one controlled path, with the identity of each person, authorization for each task, encryption and logging, and that the vendor contract says what the vendor may do. A plant that organizes its manufacturers’ access this way today is in a good position against current guidelines and against the rules regulators are preparing. The architecture is in secure remote access to relays and substations, and its application to a plant in solar plant communications.
We help you organize access
At Tiza Group we design and configure remote access for substations and solar plants, with firewall, jump server, individual accounts and logging, also for inverter manufacturers, as part of our substation and plant cybersecurity service, worldwide. Our remote relay configuration follows these same rules: sessions you authorize, encrypted and logged. Write to us and we will review how third parties enter your plant today.
Related guides
- Electrical cybersecurity: NERC CIP and Latin America
- Secure remote access to relays and substations
- Solar plant communications
- Is remote relay configuration safe?
- Industrial substation router and firewall: IEC 62443 and VPN
- Manufacturer remote access to solar inverters
- CNO Agreement 1960: cybersecurity guide for Colombia’s grid
- Substation and plant cybersecurity: standards and map
- NERC CIP-013: Supply Chain Risk Management
References
- Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024, network code on sector-specific rules for cybersecurity aspects of cross-border electricity flows, OJ L, 24.5.2024 (articles 2, 24, 26, 29 and 33).
- SolarPower Europe and DNV, Solutions for PV Cyber Risks to Grid Stability, 29 April 2025.
- LRT (Lithuanian public broadcaster), report on the Electricity Law amendment, 12 November 2024.
- ONS, Rotina Operacional RO-CB.BR.01, revisão 00, Controles mínimos de segurança cibernética para o Ambiente Regulado Cibernético, in force 09/07/2021, Submodule 5.13.
- NERC, CIP-005, Cyber Security – Electronic Security Perimeter(s).
Frequently asked questions
Is there any rule that bans the inverter manufacturer from accessing my plant?
In most countries, not as such. Rules such as Colombia's grid cybersecurity guide do not ban third-party remote access. They require it to go through an intermediate system, with two-factor authentication, encryption, monitoring and control of authorization, and they ask you to manage vendor risk. Some European countries, such as Lithuania, have restricted by law the remote access of companies from certain countries.
What does Brazil require for remote access?
The ONS operating routine RO-CB.BR.01 says that the regulated cyber environment must not be directly reachable from the internet or connect to it, and that access from external networks is allowed only for authorized activities, by VPN or similar technology, through a gateway or service with security controls.
What is coming in Colombia?
In 2026 the Ministry of Mines and Energy ordered the regulator to issue, within 24 months, cybersecurity rules for the transmission and regional grids, with audits, vulnerability assessments, training and a CSIRT for the power sector. In the meantime the national cybersecurity guide applies.