Solar plant is a computer now?-What NIS2 means for PV cybersecurity

Introduction

Europe has built a large part of its energy transition on solar power, with around 270 GW of capacity installed by early 2025 [1]. Every one of those plants depends on inverters, data loggers and monitoring platforms that talk to the outside world. That connectivity makes solar cheap to run and easy to manage. It also makes it a target. Regulators have noticed. In June 2026 the European Commission named the digital infrastructure of solar and wind generation a growing cybersecurity priority and launched a risk assessment of EU installations [2]. At the same time, the NIS2 Directive, the EU’s main cybersecurity law, already applies to many electricity producers, aggregators and storage operators [3]. This article explains, in plain language, where solar plants are vulnerable, who falls under NIS2, what the law requires, which new rules target inverters and their makers, and five practical steps operators can take now. Czech rules serve as a worked example throughout.

800 solar monitors and a bank heist

In May 2024, criminals quietly took over about 800 remote-monitoring boxes at solar plants across Japan. They did not steal electricity or break a single panel. They used the devices, Contec SolarView Compact units with a known flaw left unpatched, as hidden relays for stealing money from bank accounts [4]. The grid never noticed. But the attackers were sitting inside equipment that, in many plants, can also switch production on and off. That is the uncomfortable truth behind this article: a modern solar plant is a network of computers that happens to produce electricity. Since NIS2, protecting that network is no longer just good practice. For many operators in the EU, it is the law.

Where attackers get in

Panels are passive glass and silicon. The risk lives in everything that connects them: inverters, data loggers, routers, vendor clouds and the remote-access paths used by installers and O&M teams. When Forescout catalogued 93 known solar vulnerabilities in 2025, the most affected components were monitoring devices (38%) and cloud back-ends (25%); only 15% sat in the inverters themselves. The same researchers then found 46 new flaws in Sungrow, Growatt and SMA products, some of which allowed fleet-wide takeover through the vendor cloud [1]. Hardware is part of the story too. In May 2025, Reuters reported that US experts had found undocumented communication components inside some Chinese-made inverters and batteries, channels that could slip past a plant’s firewall [5].

One plant is a nuisance. A fleet is a grid problem.

A single hacked rooftop changes nothing for the grid. Thousands of inverters steered through one cloud platform are a different matter. Forescout cites earlier research showing that an attacker controlling about 4.5 GW of generation could drag European grid frequency down to 49 Hz, the level at which emergency load shedding begins. With roughly 270 GW of solar installed in Europe at the time, that is less than 2% of inverter capacity, in a market dominated by a handful of vendors [1].

Control under 2% of Europe’s solar inverters, and you could push the grid into emergency load shedding.##

Concentration adds a geopolitical layer: according to the same research, 53% of inverter manufacturers and 58% of storage-system makers are based in China. That is why regulators now talk about suppliers, not just passwords.

NIS2 in plain words

NIS2 is the EU’s baseline cybersecurity law for 18 critical sectors, and energy is one of them [3]. Its electricity chapter explicitly names producers, grid operators and companies offering aggregation, demand response or energy storage. The rule of thumb: if your company, counted together with its group, is at least medium-sized (50 or more staff, or both turnover and balance sheet above EUR 10 million), you are probably in. Two more groups will feel it. Companies running monitoring or O&M platforms for other businesses can qualify as managed service providers in their own right. And EPCs, installers and inverter vendors will receive NIS2 requirements through their customers’ contracts, because the law makes operators answer for their suppliers.

The Czech angle. Czechia transposed NIS2 through the Cybersecurity Act No. 264/2025 Coll., in force since 1 November 2025 and supervised by NÚKIB. Its decree on regulated services leaves renewable plants of up to 1 MW outside the electricity-production service [6]. A large company, or one running a plant of 100 MW or more, lands in the stricter higher-obligations regime. Providers must register within 60 days of meeting the conditions, then have a year to put measures in place, with fines of up to CZK 250 million or 2% of turnover [7].

What the law actually asks

Strip away the legal language and NIS2 comes down to four duties: • The board owns it. Management must approve the security measures, oversee them and can be held liable for failures; board members must also be trained (Art. 20) [3]. • Ten minimum measures. Risk analysis, incident handling, business continuity, supply-chain security, secure maintenance and patching, effectiveness checks, cyber hygiene and training, encryption, access control, and multi-factor authentication (Art. 21) [3]. • Report fast. Significant incidents run on a fixed clock, shown below (Art. 23) [3]. • Register and cooperate. Sign up with the national authority and respond to its audits and instructions. For a PV fleet, a “significant incident” is not hypothetical. A ransomware attack that blinds your monitoring platform, or unauthorised curtailment across dozens of sites, would very likely qualify.

The rules are closing in on the inverter

NIS2 regulates operators. A second wave of rules now targets the equipment itself, and who is allowed to make it: • Cyber Resilience Act. Since 11 September 2026, makers of inverters, loggers and other connected products must report actively exploited vulnerabilities, including for products already sold. Full security requirements and CE marking follow in December 2027 [8]. • Radio Equipment Directive. Since August 2025, devices with Wi-Fi or cellular links must meet a baseline of network, data and fraud protection [9]. • EU money. The Commission has barred EU funding, including EIB loans, for solar, wind and storage projects using inverters from suppliers in, or controlled from, China, Russia, Iran or North Korea. Only projects approvable by 1 November 2026 can be grandfathered [10], and Wood Mackenzie expects the curb to touch about 14% of EU solar demand to 2030 [11]. • National action. Lithuania now requires plants above 100 kW to block remote access by Chinese manufacturers, and grid operators may disconnect sites that do not comply [12]. • What’s next. A proposed Cybersecurity Act 2 would let the Commission order phase-outs of high-risk suppliers’ components, or the disabling of remote access to key assets, in critical sectors [13].

Five things to do this quarter

1. Check whether you are in. Map each company, its group size and its activities in every country where you own assets. In Czechia, register with NÚKIB if you meet the conditions.
2. Find every door. List every inverter, logger, router, cloud account and remote-access path, and hunt for devices exposed to the internet or still on default passwords.
3. Build one front door. Segment each plant’s network and route all remote access through a single gateway with multi-factor authentication and logging. Make sure you can cut a vendor’s control channel without losing monitoring.
4. Write security into contracts. Ask EPCs, O&M providers and vendors for vulnerability notification, patch timelines, remote-access rules and CRA and RED conformity.
5. Rehearse the bad day. Prepare a runbook for the 24-hour, 72-hour and one-month reports and test it in a tabletop exercise.

Conclusion

Solar plants have quietly become some of the most connected assets on the grid. The Japanese attackers wanted bank accounts, not blackouts [4], but research on inverter fleets shows what a more ambitious attacker could do with the same kind of access [1]. The weak points are rarely the panels; they are the clouds, remote-access paths, loggers and routers that surround them. NIS2 turns that risk into legal duties: managers who answer for security, ten minimum measures, a 24-hour reporting clock and fines for essential entities of up to EUR 10 million or 2% of global turnover, whichever is higher [3]. Around it, the Cyber Resilience Act, the radio-equipment rules and the EU’s curbs on high-risk inverter suppliers are reshaping what operators can buy, and from whom [8][9][10]. The first steps are not exotic. Know your fleet, close the remote doors, write security into contracts and rehearse the bad day. Operators who start now will meet today’s rules and be ready for the tougher ones still being negotiated in Brussels [13].

References

1. Forescout Research – Vedere Labs. Grid security: new vulnerabilities in solar power systems exposed. Forescout, 27 March 2025.
2. Jowett, P. European Commission to conduct risk assessment of EU solar, wind installations. pv magazine, 4 June 2026.
3. European Parliament and Council. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive). Official Journal of the EU, L 333, 27 December 2022.
4. Brumfield, C. Hijack of monitoring devices highlights cyber threat to solar power infrastructure. CSO Online, 23 May 2024.
5. Lynas, M. Hidden devices found in Chinese-made inverters in the US, reports Reuters. pv magazine, 14 May 2025.
6. NÚKIB. Decree No. 408/2025 Coll. on regulated services (in Czech). Collection of Laws of the Czech Republic, in force 1 November 2025.
7. Čapek, M., Tichá, S. and Vanek, M. New cybersecurity law will affect thousands of organisations. KPMG Czech Republic, 29 August 2025.
8. Hanssen, H. EU Cyber Resilience Act: vulnerability and incident reporting obligations now apply and ENISA’s Single Reporting Platform is live. Hogan Lovells Cadwalader, 11 September 2026.
9. Derby, M. Cybersecurity and the RED Article 3.3 essential requirements. Element Materials Technology, updated 6 September 2023.
10. Rayner, T. EU funding ban on high-risk inverters, including Chinese suppliers, extends to BESS PCS. ESS News, 4 May 2026.
11. Jowett, P. Ban on high-risk PV inverters to impact 14% of EU solar demand to 2030. pv magazine, 9 July 2026.
12. Jowett, P. Lithuania’s grid operators can now disconnect solar plants without cybersecurity measures. pv magazine, 5 June 2026.
13. Riede, L., Werkmeister, C. et al. EU cybersecurity package: Commission proposes targeted NIS2 amendments and a revised Cybersecurity Act. Freshfields, 27 January 2026.