Germany recommends eliminating direct internet access to PV plant control systems

The Federal Office for Information Security (BSI) has issued cybersecurity guidance for industrial control systems accessible online, targeting operators of small and very small energy facilities such as PV installations, hydropower plants, wind farms and waste-to-energy facilities. The agency emphasizes eliminating direct internet access to plant control systems, including industrial controllers, communications equipment, monitoring gateways, inverters, SCADA systems and remote monitoring platforms, to reduce exposure to cyber threats.

Direct internet access increases the risk of unauthorized access, exploitation of known vulnerabilities or manipulation of operating parameters, which can disrupt plant operations beyond mere data loss. The BSI recommends replacing direct connections with secure remote access through virtual private networks (VPNs) and multifactor authentication to mitigate risks associated with stolen credentials or weak passwords.

The agency also advises keeping all equipment updated with the latest security patches and software updates, including supervisory systems, routers, firewalls, controllers, inverters and communications gateways. Failure to apply updates leaves systems vulnerable to known security flaws that already have available fixes, increasing the risk of cyber incidents.

Additionally, the BSI calls for regular checks to identify devices exposed to the internet, maintaining inventories of connected assets and verifying that remote services are not unnecessarily accessible. For PV plants, the recommendations highlight separating corporate and operational networks, restricting remote access to authorized users and service providers, and integrating cybersecurity practices into routine plant operations.