Czech operators of larger solar plants will have to strengthen cybersecurity

Dozens of operators of larger photovoltaic power plants with a capacity of more than 50 kilowatts will have to put technical and organisational measures in place at their facilities to strengthen the plants’ cybersecurity. They will also have to register with the National Cyber and Information Security Agency (NÚKIB). This follows from an amendment to the law recently approved by the Chamber of Deputies.

"Photovoltaics are vulnerable to cyberattacks," warned Jindřich Stuchlý of Solar Edge.

According to him, the risk lies primarily in the so-called inverter. The vast majority of these devices currently on the market lack basic cybersecurity. "This makes them a gateway for hackers into companies’ internal networks or government systems," Stuchlý said.

In this context, he cited a recent cyberattack on hospitals in Lithuania that was carried out through photovoltaic power plant monitoring systems. He therefore recommends choosing a manufacturer from the European association ESMC when selecting inverter technology.

The amendment responds to the cybersecurity vulnerabilities of solar power plants. Based on a European directive, it introduces new cybersecurity requirements for operators of photovoltaic power plants with an installed capacity of more than 50 kilowatts (kW), as well as for aggregators, battery storage operators and a number of other entities in the energy sector.

"From the date the law takes effect, regulated entities will have 60 days to register with NÚKIB. Following registration, the prescribed technical and organisational measures will need to be implemented within one year," said Luděk Šikola of the law firm Doucha Šikola advokáti.

The new requirements will include introducing internal processes for developing security policies, conducting risk assessments and other cybersecurity analyses within companies and government offices, meeting new requirements for cooperation with suppliers, reporting incidents to the authorities and implementing security measures. Šikola warned that the new measures will increase administrative burdens and costs for many entities.

The amendment has so far been approved by the Chamber of Deputies. It will also be considered by the Senate. Šikola said the law is expected to take effect in July this year.