A solar plant has more entry points than a conventional substation: inverters, dataloggers, the manufacturer's cloud, the plant controller (PPC), the SCADA, trackers and cameras. It is protected in layers: an inventory of what is connected, separate zones with a firewall, a single controlled path for remote access by manufacturers and maintenance providers, personal accounts with no factory passwords, managed firmware and reviewed logs. Larger plants are usually treated as critical assets by national cybersecurity rules.
Why a solar plant is different
A substation has relays, bay controllers, a gateway and a link to the control center. A solar plant has all of that in its connection substation. It also has hundreds or thousands of programmable devices spread over the field: inverters, dataloggers or inverter controllers, the plant controller (PPC), the SCADA, the weather station, tracker controllers, cameras and, more and more, a battery system. Many of these devices come ready to talk to their manufacturer’s cloud.
That connectivity is useful: it lets the manufacturer give support, the maintenance provider diagnose without traveling, and the owner see production from anywhere. But every connection is also an entry route, and the plant is part of the power system: the PPC receives setpoints from the grid operator and the inverter decides how much power it injects.
What technical sources have documented
The risk is neither theoretical nor sensational, and it is documented in recent technical sources:
- SolarPower Europe, the European industry association, published a risk analysis commissioned from DNV on April 29, 2025. It assessed 14 risk areas (3 critical, 6 high and 5 medium) and concluded that a targeted compromise of 3 GW of generation could have significant implications for the European grid. It named direct commands to inverters and updates as sources of risk, and considered utility-scale plants safer because they are operated by experienced companies and subject to regulation.
- Forescout, a security company, published research in March 2025 with 46 new vulnerabilities in devices and cloud platforms of three inverter manufacturers, which according to the report have since been fixed.
- NIST, in its report NIST IR 8498 of December 2024, tested five small inverters against the seven baseline practices it proposes: none offered multi-factor authentication, only one logged security events and only one allowed its configuration to be backed up and restored. Its scope is residential and light commercial, but it warns that if a manufacturer shares software across product lines, a weakness found in a small inverter can be used against larger commercial inverters.
None of these sources justifies alarmism. What they show is that the inverter and its cloud ecosystem deserve the same care as a protective relay.
Where the interfaces are
| Device | Who it talks to | What can be done from outside |
|---|---|---|
| Inverter | Datalogger, PPC, sometimes the cloud directly | Read data, change parameters or curtail power, depending on the model |
| Datalogger or inverter controller | Inverters, SCADA, manufacturer cloud | Forward setpoints, update inverter firmware |
| PPC | Point-of-interconnection meter, inverters, SCADA, control center | Change active and reactive power setpoints for the whole plant |
| Plant SCADA | All of the above, corporate network | Commands, alarms, historians |
| Trackers, weather station, cameras | Field network, sometimes the cloud | Table positions, irradiance data, video |
| Substation relays and gateway | Station bus, control center | Protection settings and commands |
Details of the physical network (fiber, rings, switches) are in solar plant communications, and the role of the PPC in the plant controller. The security of that controller and the SCADA is covered in PPC and SCADA cybersecurity, and that of the battery system in BESS cybersecurity.
Controls by layer
- Inventory. What devices there are, with what firmware and what they connect to
- Zones and conduits. Control, substation, field, surveillance and DMZ separated with a firewall
- Remote access. A single path for manufacturers and maintenance providers, authenticated and logged
- Hardened devices. No factory passwords, unused services closed, logs active
- Operation. Managed firmware, backups and log review
Inventory. You cannot protect what you do not know. The first deliverable is the list of programmable devices with their model, firmware, address and connections, including the exits to the internet that nobody documented (a cellular modem in a datalogger, for example).
Zones and conduits. The IEC 62443 series proposes grouping devices by security need and controlling traffic between groups. In a plant, a reasonable split separates the control network (inverters, PPC, protection), the substation, camera surveillance, the office and a DMZ through which everything going outside leaves. The concept is in IEC 62443 in substations and the equipment that implements it in industrial router and firewall.
Remote access. The connection of the manufacturer and the maintenance provider arrives at a single point in the DMZ, with multi-factor authentication and sessions authorized for each task. It is the same architecture as secure remote access to substations. How to organize manufacturer entry is in manufacturer remote access to inverters, and what other countries require is in remote access to solar plants: rules around the world.
Hardened devices. Change the factory credentials, create role-based accounts, disable the services and interfaces that are not used (including the inverter’s maintenance Wi-Fi if it is not needed) and turn on logging. These are practices that NIST IR 8498 recommends for inverters and that IEEE 1686 asks of IEDs.
Operation. Update firmware with a procedure, back up the approved configuration and review the logs. For large plants, an intrusion detection system on the control network gives visibility of what no device reports by itself.
What the regulations require
Requirements depend on the country and on the size of the plant. In North America, NERC CIP applies to generation assets according to their impact category on the bulk electric system. In Europe, the NIS2 Directive and the network code on cybersecurity for electricity set obligations for operators and for the entities that connect to the grid. Many national frameworks work with a size threshold: larger generating units are treated as critical assets, and smaller plants have lighter minimum requirements.
For remote access, the common expectations are multi-factor authentication, monitoring, encryption, authorization control and an intermediate system outside the security perimeter. New plants usually get a period after registration to comply, and incident reporting follows the procedure and format of the grid operator or regulator. The design and settings are adapted to the local code and the requirements the utility gives you.
For distributed generation, the technical reference is IEEE 1547.3, and the standards map for substations and plants is in substation and plant cybersecurity. The regional picture is in electrical cybersecurity regulation in Latin America. What each standard covers (NERC CIP, IEC 62443, IEC 62351 and NIST) is summarised in Power Sector Cybersecurity Standards.
Frequent mistakes
- Dataloggers with their own cellular modem, outside the plant network, that nobody included in the inventory.
- The same installer password on all inverters, years after commissioning.
- Cameras and trackers on the same network as the PPC, with no firewall between them.
- Supply contracts without remote access clauses: they do not say who at the manufacturer comes in, from where, or what they can change.
- Firmware updated from the cloud without notice, changing network parameters approved by the grid operator.
We can help you protect your plant
At Tiza Group we securely configure the gateways, switches, firewalls and remote access of the control system and SCADA of solar plants. We also organize manufacturer access so that inverter manufacturers come in through a controlled path. All of this is part of our substation and plant cybersecurity service. We also configure the relays of the connection substation remotely through remote relay configuration, in sessions that you authorize and that are logged. Write to us with your plant’s architecture.
Related guides
- Solar plant communications
- Solar plant controller (PPC): what it is and what it controls
- Secure remote access to relays and substations
- IEC 62443 in substations: zones, conduits and SL levels
- Intrusion detection (IDS) in substation networks
- Substation and plant cybersecurity: standards and map
- Manufacturer remote access to solar inverters
- Inverter firmware: secure updates
- NIST IR 8498: smart inverter cybersecurity
- IEEE 1547.3: cybersecurity of distributed energy resources
- Remote access to solar plants: rules around the world
- Cybersecurity of the PPC and SCADA of a solar plant
- BESS cybersecurity: BMS, PCS and EMS
- CNO Agreement 1960: cybersecurity guide for the Colombian grid
- Power Sector Cybersecurity Standards: A Map
References
- SolarPower Europe and DNV, Solutions for PV Cyber Risks to Grid Stability, April 29, 2025.
- Forescout Vedere Labs, SUN:DOWN, March 2025.
- NIST IR 8498, Cybersecurity for Smart Inverters: Guidelines for Residential and Light Commercial Solar Energy Systems, December 2024.
- IEC 62443 series, Security for industrial automation and control systems.
- NERC CIP standards; Directive (EU) 2022/2555 (NIS2).
Frequently asked questions
Do cybersecurity regulations apply to a solar plant?
Usually yes, depending on size and country. Many regimes (NERC CIP in North America, the NIS2 Directive and the network code on cybersecurity in Europe) treat larger generating plants as critical assets, and smaller plants often have lighter minimum requirements. The obligation normally rests with the plant owner or operator. We adapt the design to the local code and the requirements the utility or regulator gives you.
What is the most particular risk of a solar plant compared with a substation?
The permanent connection of inverters and dataloggers to the manufacturer's cloud. From there data can be read and, depending on the equipment, parameters or power can be changed. If that path does not go through the plant's controlled network, the owner does not know who comes in or what changes.
Do you have to disconnect the plant from the manufacturer's cloud?
Not necessarily. Warranty and support often depend on it. What matters is that the connection leaves through a controlled point of the plant, that you know what the manufacturer can do from there, that it is logged, and that the contract regulates it.