Battery Energy Storage System Security Guide: Protect BMS, EMS and Vendor Remote Access

A battery energy storage system (BESS) is a grid asset whose control electronics can cause fires, outages or equipment damage if they are manipulated, and most sites depend on a vendor cloud connection that the owner did not design. Grid scale and commercial storage sites combine battery racks, a battery management system (BMS), power conversion systems (PCS), an energy management system (EMS) and a site controller, with remote monitoring that usually runs through the integrator or original equipment manufacturer. In 2025 press reports of undocumented communication devices found in imported inverters and batteries pushed supply chain screening onto procurement agendas. This guide covers BESS architecture from a security view, vendor remote monitoring, firmware and update control, supply chain screening, and how cyber controls must respect the safety interlocks. It is written for OT security engineers, asset owners, developers and EPC teams. Inverter fleets and aggregator platforms are covered in the Distributed Energy Resources and Solar Inverter Security Guide, so this page stays on the storage site itself.

Key takeaways

• Treat the BMS and fire safety system as safety critical. Sandia National Laboratories ranks them as the control electronics that need the most rigorous protection, because their compromise can cause injury or equipment damage.
• Vendor remote monitoring is the main attack path. Inventory every cloud connection, cellular modem and support tunnel, and bring each one under owner control with phishing-resistant MFA and least privilege.
• Cyber controls must never weaken hardware interlocks. Keep thermal, voltage and current protection in independent hardware or BMS logic that no EMS command or cloud update can override.
• Screen the supply chain at component level. Ask for hardware and software bills of materials, a full list of radios and communication paths, and inspect delivered units against them before energisation.
• Control firmware and setting changes like safety changes. Signed updates, staged rollout, owner approval for any change to protection limits, and a tested way back to a known good configuration.

BESS architecture through a security lens

Every site differs, but the control stack follows a common layered pattern. Knowing which layer can do what is the starting point for both risk assessment and segmentation. Sandia's 2026 BESS cybersecurity webinar describes the cell, module and rack level BMS (often called Level 1 and Level 2) as safety critical, and the Level 3 BMS or BESS controller and the site controller as operational electronics whose compromise could take the system offline.

The practical point: the further down the stack, the higher the safety consequence and the less the device can protect itself. CAN buses inside a container usually have no authentication, so the defence is to make sure nothing untrusted can reach them. Map the site against IEC 62443 zones and conduits, with the BMS and protection zone at the highest security level target. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.

Safety interlocks and where cyber controls stop

Storage safety codes assume the protection layer works. NFPA 855 governs the installation of stationary energy storage, and its 2026 edition adds minimum emergency response plan and training requirements, makes a hazard mitigation analysis the default for most installations, and ties fire testing to UL 9540A with large scale fire testing. UL 9540 is the system safety listing. None of these replace cyber controls, and cyber controls must not undermine them.

• Independent protection: Over temperature, over voltage and over current protection should act in hardware or in BMS firmware below the EMS, so that a compromised EMS or cloud command cannot push cells outside their envelope. Ask the vendor to document which limits are enforced where.
• Protection limits are not remote settings: Require that changes to protection thresholds need local presence or a separate, logged, owner approved change, never a routine cloud push. Sandia highlights malicious cloud delivered updates that remove safety limits as a scenario to guard against.
• Fire systems stay separate: Keep fire detection, gas detection, ventilation and suppression on hard wired or dedicated controls, monitored but not controllable from the EMS network.
• Emergency stop works without IT: Confirm that local emergency stop and manual isolation work when every network link is down. CISA's primary mitigations for OT call for the ability to operate manually and for testing fail safes and standby systems.
• Cyber in the hazard analysis: Add cyber initiated scenarios (false sensor data, suppressed trips, unsafe setpoints) to the hazard mitigation analysis. See the OT Cyber Physical Risk and Safety Guide.

Sensor integrity matters as much as access control. Sandia's work describes false data injection, man in the middle and replay attacks against BMS measurements, and proposes model based anomaly detection that compares estimated cell behaviour with reported values and flags large residuals. Where a vendor offers this kind of plausibility checking, enable it and route its alarms to the security monitoring team as well as operations.

Vendor remote monitoring and access

Most BESS contracts include long term service agreements with remote monitoring by the integrator or manufacturer. That connection is often installed with the equipment, over a cellular router inside the container, and may never pass through the owner's firewall. The 2025 reports about undocumented communication devices are a reminder that the owner needs to know every path out of the site.

• Owner controlled access broker: Terminate all third-party access on an owner run remote access service in the site DMZ rather than vendor tunnels straight to the controller. CISA advises a VPN with phishing-resistant MFA where remote access is unavoidable, least privilege and disabling dormant accounts. See the OT Remote Access Guide.
• Read versus write: Separate monitoring (read) from control (write). Many service tasks need only telemetry. Grant write access to the EMS or PCS only for an approved change window.
• Contract terms: Write into the service agreement which connections exist, who can use them, where the data is held, how access is logged and how quickly the vendor reports a security incident.
• Fleet scale risk: A vendor platform that manages many sites can change many sites at once. Ask how the vendor separates customers, protects its own administrator accounts and approves fleet wide changes.

Where identity fits: accounts, certificates and API keys

A BESS carries a surprising number of non-human identities: device certificates for cloud telemetry, API keys between the EMS and trading platforms, service accounts for SCADA historians, and shared local accounts on PCS and BMS web interfaces. Default and shared credentials on these interfaces are a common commissioning shortcut.

• Change every default: CISA lists replacing default and guessable passwords among its primary OT mitigations. Make it a commissioning gate, with evidence.
• Name the humans: Replace shared vendor logins with named accounts, removed when the engineer leaves the contract.
• Own the machine credentials: Record each API key and certificate, its owner, expiry and scope; rotate them on contract change and keep them out of configuration exports.

See the Energy Sector Identity and OT Access Guide and the OT and ICS Identity and Access Guide.

Firmware, software and setting change control

BMS, PCS and EMS firmware is updated across the life of a 15 to 20 year asset, often by the vendor remotely. Sandia's guidance is to keep systems updated, test new software rigorously before deployment, understand software dependencies and build security in across the lifecycle.

1. Baseline: Record firmware versions, configuration files and protection settings for every BMS, PCS and controller at commissioning. Store hashes and copies offline. See the OT Backup, Recovery and Golden Image Guide.
2. Signed updates only: Require cryptographically signed firmware and ask the vendor how signature checks are enforced on each device.
3. Owner approval: No firmware or setting change reaches a site without an owner change ticket that states what changes, why, and whether any protection limit moves.
4. Staged rollout: Test on a lab unit or a single string first, then one site, then the fleet. Watch BMS alarms and state of charge behaviour for a defined soak period.
5. Rollback: Confirm before each update that the previous firmware can be restored and that restored settings match the baseline.
6. Verify after change: Compare running settings with the approved values after every vendor visit or remote session.

For vulnerability handling, subscribe to vendor and CISA ICS advisories and triage by safety consequence. See the ICS Advisory Triage and OT Vulnerability Management Guide and the OT Patch Management Guide.

Supply chain screening for storage equipment

A Reuters report of 16 May 2025 said US experts examining grid connected equipment had found undocumented communication devices in some imported inverters, and that undocumented devices including cellular radios had been found in some batteries; the manufacturers were not named. In Europe, the European Solar Manufacturing Council responded by calling for audit tools, transparent software bills of materials and limits on remote access. Whatever the origin of any given device, the defensive lesson is the same: the owner should know every radio and communication path in the equipment.

The US Department of Energy's Supply Chain Cybersecurity Principles, developed by CESER with Idaho National Laboratory for both suppliers and end users, give a structure for these requirements, covering ten areas from impact driven risk management and transparency to lifecycle support and proactive vulnerability management. Sandia adds practical warnings about white labelled components and counterfeit parts. See the OT Product Procurement Guide and the SBOM Guide.

Implementation roadmap

1. Inventory (weeks 1 to 4): List every BESS controller, PCS, BMS gateway, modem, SIM and cloud connection per site. Passive network capture during normal operation shows actual flows. See the OT Asset Visibility Guide.
2. Close direct exposure (weeks 2 to 6): Remove any controller reachable from the internet, disable unused modems, and move vendor access behind the owner's broker. Test in one site first and keep the old path documented, but disabled, as a fallback for the first month.
3. Segment (months 2 to 4): Establish zones for protection and BMS, PCS, EMS and site control, DMZ and vendor access, with allow lists per conduit.
4. Change control (months 2 to 4): Baseline firmware and settings; agree the owner approval process with each vendor.
5. Monitor (months 3 to 6): Deploy OT network monitoring at the site DMZ and EMS zone; forward remote access and controller logs centrally. See the OT Network Security Monitoring Guide.
6. Exercise (every year): Run a joint cyber and fire scenario with operations, the vendor and local responders, aligned with the NFPA 855 emergency response plan review cycle.

Decision guidance: A single commercial behind the meter system with one vendor may rely on a well configured vendor platform plus owner controlled access and change approval. A fleet of grid scale sites, or any site under NERC CIP or national critical infrastructure rules, needs owner run segmentation, monitoring and an access broker, because fleet wide vendor access concentrates risk. Where a vendor platform cannot place remote access under owner control, add a compensating owner run gateway and record the residual risk.

Detection and measurement

• What to log: remote access sessions (who, when, what was changed), controller configuration changes, firmware version changes, BMS protective trips and alarm suppressions, new outbound destinations from the site, cellular modem activity.
• What to alert on: writes to protection settings outside a change window, PCS setpoints outside the agreed envelope, new device MAC addresses on control zones, outbound traffic to destinations not in the declared list, sensor readings that disagree with model estimates.

Framework mapping

IEC 62443 provides the zone and security level structure (62443-3-2 for risk assessment, 62443-3-3 for system requirements) and supplier process requirements (62443-4-1). See the IEC 62443 Guide and the Energy Sector Cyber Regulation Map for jurisdiction specific rules.

Common failure patterns

• Cellular modem nobody owns: The integrator fits a router for commissioning and it stays live for years, outside the owner's firewall and monitoring.
• Protection limits editable from the cloud: Charge and temperature limits sit in a configuration that the vendor platform can change without local approval.
• Shared vendor accounts: One login used by every field engineer and never rotated after staff or contracts change.
• Acceptance testing ignores communications: Factory and site acceptance cover electrical and fire performance but nobody captures the traffic or checks the boards against the declared bill of materials.
• EMS on the corporate network: The EMS or historian sits on the business network for convenience, giving a direct route from a phished laptop to dispatch control.
• No manual fallback rehearsed: Staff have never isolated a site manually because the vendor normally does it remotely.

Practitioner checklist

• Inventory every communication path at each site, including cellular modems, SIMs and vendor tunnels, and confirm it against a network capture.
• Confirm in writing which protection limits are enforced in hardware or BMS firmware and that no remote path can change them without local, owner approved action.
• Move all vendor access to an owner controlled broker with named accounts, phishing-resistant MFA, session recording and per session enablement.
• Require a hardware bill of materials listing all communication modules and an SBOM for BMS, PCS and EMS software in every tender.
• Add board inspection, RF survey and traffic capture to factory and site acceptance testing.
• Baseline firmware, configuration and protection settings at commissioning, store copies offline and verify after every change.
• Segment protection, BMS, PCS, EMS and vendor access into IEC 62443 zones with allow listed conduits.
• Replace every default and shared credential and record each machine credential with an owner and expiry.
• Add cyber initiated scenarios to the hazard mitigation analysis and exercise them with fire responders each year.

Standards and references

• Sandia National Laboratories: Cybersecurity Considerations for Battery Energy Storage Systems
• US Department of Energy CESER: Supply Chain Cybersecurity Principles
• CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
• NIST: IR 8498 Cybersecurity for Smart Inverters
• NIST: Cybersecurity Framework 2.0
• MITRE ATT&CK for ICS: Loss of Safety
• Energy-Storage.news: NFPA 855 2026 edition updates and what they mean for energy storage projects
• Reuters (via Insurance Journal): Rogue communication devices found in Chinese solar power inverters, 16 May 2025
• PV Tech: Rogue devices found in Chinese solar inverters raises cybersecurity alarm in Europe

Related NHI Mgmt Group resources: Distributed Energy Resources and Solar Inverter Security Guide · Smart Grid Security Guide · OT Third-Party and Integrator Access Guide · OT Security Guide