BESS · Solární Panely.CZ
BESS cybersecurity: access, cloud dependency and responsibility
Assess the control architecture and operating context. Country of origin or a generic “NIS2 ready” label alone does not establish security.
Map who can change operation
A connected BESS needs a map of its control chain: BMS, PCS, EMS, local network, remote portal and service access. The risk is not limited to data disclosure. Inappropriate changes to limits or dispatch priorities can affect energy availability and operating continuity.
Start with accounts, permissions, interfaces and responsible parties. The investor should know who owns the administrator account and what remains available if the integrator changes or a cloud service closes. Access and configuration handover should be part of the project scope.
Czech cybersecurity law is not a battery-brand certificate
The new Czech Cybersecurity Act took effect on 1 November 2025. Applicability and obligations depend on the organisation, regulated service and other conditions. There is no universal requirement for each battery to carry a generic NIS2 certificate.
For a regulated operator, BESS belongs within wider security management where relevant to the service. Organisational duties cannot be replaced by a marketing label on one component. Deadlines for subsequent obligations must be checked against the entity’s situation and registration. This is a Czech-law context, not a claim that all EU countries use identical implementation rules.
Questions for suppliers and operators
- Can default accounts be changed and individual permissions assigned?
- Who may install updates, and how is configuration restored?
- What happens if WAN or control communications are lost?
- Are event logs, change records and local interfaces available?
- How is the operational network separated and service access authorised?
- Who discloses vulnerabilities, and how long is security support provided?
Answers need documentation, configuration evidence or an agreed test. A statement about encryption alone does not explain permission management or the ability to intervene remotely.
Origin is not a substitute for evidence
The manufacturing country or a local logo on a cabinet does not independently prove security or insecurity. We assess architecture, supply chain, access, updates and recoverability while respecting applicable legal and contractual requirements.
Communications-loss and recovery tests must be planned with the responsible parties in a safe operating mode. This article is not an instruction to disconnect a live installation. An assessment should produce risks, mitigations, task owners and required verification.
Sources and limits
Sources describe their own scope. A general document is not a project-specific certificate or evidence of our own physical test.
Advice before investment
Agree the assessment before choosing equipment.
This is a paid advisory service. Scope, fee, delivery date, named specialists and exclusions are agreed in a written proposal before work begins. Sending an enquiry is not an order or an obligation to purchase equipment.