Notifications
Clear all
Topic starter
14/07/2026 4:27 pm
TL;DR: EV charging infrastructure now sits under CRA and NIS2 pressure, with requirements spanning secure updates, access control, logging, communication security, and incident reporting across charge points, backend systems, APIs, and mobile interfaces, according to Upstream Security. The practical challenge is less about single-tool visibility and more about governing identities, interfaces, and update trust across a distributed ecosystem.
NHIMG editorial — based on content published by Upstream Security: Cybersecurity EV Charging Beyond the Cyber Resilience Act
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should organisations govern remote access in EV charging environments?
A: Organisations should treat remote access to EV charging infrastructure as privileged access, not routine administration.
Q: Why do signed updates matter for connected charging systems?
A: Signed updates matter because EV charging fleets depend on software and firmware changes being trustworthy at scale.
Q: What breaks when access logging is not tied to individual identities?
A: When access logging is not tied to individual identities, breach investigation becomes ambiguous and accountability weakens.
Practitioner guidance
- Map every remote control path Inventory APIs, mobile apps, device interfaces, and third-party integrations that can alter charger state, session data, or backend configuration.
- Enforce signed and verified update delivery Require cryptographic signing, anti-rollback protections, and post-deployment validation for firmware and software updates.
- Treat access anomalies as operational events Alert on default credentials, unusual local port use, suspicious API sequences, and privilege escalation attempts across chargers and backend systems.
What's in the full article
Upstream Security's full article covers the operational detail this post intentionally leaves for the source:
- Specific monitoring logic for suspicious API activity, brute force patterns, and lateral movement across charging services
- Detailed validation checks for firmware and software updates, including version mismatch handling and rollback resilience
- Protocol-level inspection approaches for OCPP traffic, TLS anomalies, and replay attack detection
- SOC workflow integration for triage, forensic reporting, and compliance-oriented incident handling
👉 Read Upstream Security's analysis of CRA-driven cyber resilience for EV charging →
EV charging cyber resilience, access control, and CRA compliance?
Explore further
14/07/2026 4:35 pm
EV charging resilience is becoming an identity governance problem, not just a device security problem. The article shows that charge points, backend systems, mobile interfaces, and APIs all depend on controlled access paths. That puts remote administration, service credentials, and third-party integrations squarely into IAM and PAM territory. Practitioners should govern charging infrastructure as a high-risk machine access estate, not as a narrow compliance checklist.
A question worth separating out:
Q: Who is accountable when EV charging security failures trigger reporting obligations?
A: Accountability usually sits with the manufacturer, operator, or service provider depending on which party controls the affected component or process. Under CRA and related regimes, organisations need clear ownership for vulnerability handling, incident reporting, secure updates, and access control. Shared responsibility only works when the boundaries are documented before an incident occurs.
👉 Read our full editorial: EV charging cyber resilience is now an identity and access problem
