PV & BESS risk assessment before procurement

What you can commission

An integrated view, not a certificate

We do not assume that every municipality, school or battery is subject to the same cyber rules. Applicability is checked for the organisation, service, assets and procurement regime. Legal opinions, authorised design, fire engineering and intrusive security tests require separately agreed qualified specialists.

A deliverable you can use with your administrator

• An executive summary: proceed, revise the concept, obtain evidence or defer the investment.
• A risk and findings register with sources, uncertainty, priority, proposed action and residual risk.
• A comparison of viable architectures and operating-cost assumptions—not a preselected winner.
• A requirements-to-evidence matrix and proposed technical inputs for evaluation and contract preparation.
• A next-step plan identifying who must verify unresolved questions.

See an illustrative report structure →

Minimum requirements are not bonus points

First separate essential conditions from qualities worth comparing. A mandatory safety function must not be traded for a lower price. For scored quality, state the measurement boundary, evidence, scoring rule and how the promised performance becomes enforceable in the contract. We propose project-specific criteria, not universal percentages.

• Qualification: evidence that a supplier and its team can deliver the task; avoid cumulative references without a reason tied to the project.
• Technical minimum: the functions, access controls and evidence the site cannot operate without.
• Quality evaluation: compare supported differences such as lifecycle costs, recovery arrangements and service commitments; do not score vague “security quality”.
• Contract requirements: evidence at handover, response and restoration targets, update support, data export, responsibility for gaps and a workable exit plan.
• Acceptance: who tests what, under which conditions, with what threshold and what happens if a requirement is not met.

Final procurement wording, legal proportionality and contract clauses are reviewed by the contracting authority’s administrator or lawyer. We supply the technical rationale and evidence requirements, not a guarantee that the tender cannot be challenged.

Current guidance: evidence before procurement conditions

The June 2026 ICT guidance was prepared with NÚKIB, ÚOHS and the Association for Public Procurement. We apply its risk-led logic to the controls and communications of PV/BESS; it is not a dedicated solar standard. NÚKIB, 11 June 2026.

AVZ stresses that the guidance is neither a universal specification nor a new list of duties. It primarily addresses regulated-service providers, with useful principles for other contracting authorities. AVZ: purpose and scope.

ÚOHS explains in its May 2026 IT-procurement case that a justified, proportionate restriction is not automatically unlawful. That case is not blanket permission to exclude a brand or impose the same requirements on every solar project. ÚOHS, 6 May 2026.

Different organisations, different consequences

• Municipalities and public bodies: budget accountability, understandable procurement and long-term operation.
• Hospitals and care providers: define the relationship with critical loads and existing backup; no claim that a standard battery is a medical UPS.
• Water utilities and wastewater plants: process continuity and separation of energy controls from operational networks.
• Schools: seasonal demand, clear responsibility for access and support, and proportionate protection of the school network.
• Businesses: operating losses, demand peaks, contractual risk and a defensible lifecycle business case.

How the engagement starts

This is a paid advisory service. Scope, fee, delivery date, named specialists and exclusions are agreed in a written proposal before work begins. Sending an enquiry is not an order or an obligation to purchase equipment.

Tell us your organisation type, site, project stage, decision and target date. We then agree which documents are needed and a suitable transfer channel. A site visit, laboratory work, penetration test or legal opinion is included only if expressly listed in the proposal.

Independent judgement, disclosed interests

Not tied to one manufacturer does not mean free of commercial interests. We disclose any supply, integration or supplier relationships relevant to the engagement. Advisory work is separately commissioned and does not oblige the client to buy equipment from us. If we might bid for a later supply contract, the contracting authority and its administrator must first address conflicts and any information advantage; a separate invoice alone is not enough.

No authority endorsement or accreditation is claimed. Our internal critical review tests alternatives, uncertainty and adverse scenarios; it is not an accredited certification.