An EV charger is an internet-connected payment terminal and grid load controller, and its security rests almost entirely on how the charger, the back end and the vehicle prove who they are to each other. Charge point operators run thousands of stations that connect to a charging station management system (CSMS, also called CPMS) over OCPP, talk to vehicles over ISO 15118, take payments, and exchange data with mobility operators through roaming hubs. Weak charger credentials, unsigned firmware and loosely governed Plug and Charge certificates become fraud, outages and grid risk. This guide covers the charging ecosystem, OCPP security profiles, ISO 15118 Plug and Charge PKI, the UK smart charge point and EU AFIR rules, back-end and fraud controls, monitoring and common failures. It is for charge point operators, CSMS developers, hardware manufacturers, fleet depots and energy security teams. Regulatory sections are summaries, not legal advice.
Key takeaways
- Use OCPP security profile 2 or 3 in production. Profile 1 sends HTTP Basic credentials without TLS and is only acceptable on a private network; profile 3 adds TLS client certificates so each charger has a cryptographic identity.
- Plug and Charge is a PKI programme, not a feature flag. ISO 15118 contract certificates, charger (SECC) leaf certificates and operator sub-CAs need issuance, renewal and OCSP checking that the CSMS usually performs on the charger's behalf.
- Regulation now sets minimums. The UK Electric Vehicles (Smart Charge Points) Regulations 2021 Schedule 1 bans shared default passwords and hard-coded credentials and requires secure updates and a security log; AFIR and Delegated Regulation (EU) 2025/656 mandate ISO 15118 support on new public chargers.
- The back end is the crown jewel. A CSMS can change tariffs, start and stop sessions, push firmware and shape load across every connected charger, so its admin accounts, API keys and roaming credentials are privileged identities.
- Fraud and cyber controls overlap. Cloned RFID tokens, abused roaming credentials and promotion abuse share detection signals with account takeover; treat them in one programme.
The charging ecosystem and its trust relationships
| Link | Protocol | Who authenticates whom | Main risk |
|---|---|---|---|
| Vehicle to charger | ISO 15118-2 or -20 over power line communication; IEC 61851-1 PWM for basic signalling | Charger (SECC) proves identity via TLS certificate; vehicle proves contract via contract certificate in Plug and Charge | Forged or cloned contract credentials, downgrade to unauthenticated modes |
| Charger to CSMS | OCPP 1.6J, 2.0.1 (IEC 63584) or 2.1 over WebSocket | Charger by password or client certificate; CSMS by server certificate | Impersonated chargers, rogue CSMS, credential reuse across a fleet |
| CSMS to roaming hubs and mobility operators | Roaming protocols and hub APIs (for example OCPI) | API tokens or certificates between businesses | Leaked tokens used to authorise free sessions or harvest session data |
| CSMS to grid and energy management | Demand response and DER interfaces | Varies by market | Coordinated load changes affecting the electricity system |
| Driver to operator | Apps, RFID cards, ad hoc payment (card, contactless, QR) | Account credentials, token UIDs, payment schemes | Account takeover, RFID cloning, payment fraud |
NIST IR 8473 profiles this ecosystem in four domains: the vehicle, the extreme fast charger, cloud and third-party operations, and utility and building networks. It is a useful scoping tool even outside fast charging. See the Smart Grid Security Guide for the grid side.
OCPP security: profiles, certificates and messages
The Open Charge Alliance publishes OCPP. Version 1.6 (2015) is still widely deployed; 2.0.1 (2020) added device management, security and ISO 15118 support and its third edition was approved as IEC 63584 in 2024; 2.1 (2025) adds ISO 15118-20, bidirectional charging, DER control and secure dynamic QR codes for ad hoc payment. OCPP 1.6 and 2.0.1 are not compatible, so migration is a project, not an upgrade. Security for 1.6 was added through a separate security extension; 2.0.1 builds it into the core.
| Security profile | Charger authentication | CSMS authentication | Transport | Use |
|---|---|---|---|---|
| 1: Unsecured transport with Basic authentication | HTTP Basic: charger identity as username plus a password (a 20-byte key in common implementations) | None | Plain WebSocket | Only inside a private APN or VPN; plan migration |
| 2: TLS with Basic authentication | HTTP Basic inside TLS | TLS server certificate | WSS | Minimum for internet-reachable chargers |
| 3: TLS with client certificates | TLS client certificate | TLS server certificate | WSS, mutual TLS | Target state; gives each charger a revocable identity |
- Certificate management messages: SignCertificate (charger sends a CSR) and CertificateSigned (CSMS returns the certificate) let chargers rotate their own keys; InstallCertificate, GetInstalledCertificateIds and DeleteCertificate manage trust anchors. Restrict who in the CSMS can trigger these, because installing a root certificate changes what the charger trusts.
- Trust anchors: keep separate roots for the CSMS server, the manufacturer (firmware signing) and the V2G and mobility operator PKIs, so compromise of one does not let an attacker impersonate another.
- Signed firmware: use SignedUpdateFirmware (1.6 security extension) or the signed UpdateFirmware flow in 2.0.1, with the charger verifying the signature against the manufacturer root before install. The MSI signing keys leak shows why firmware signing keys belong in an HSM: once leaked, they are very hard to revoke from devices in the field.
- Security events and logs: SecurityEventNotification reports events such as failed authentication, tamper detection, firmware and certificate changes; GetLog and LogStatusNotification retrieve security logs. Forward them to your SIEM rather than leaving them in the CSMS.
- No silent downgrade: configure chargers so the security profile can only be raised, and alert if a charger reconnects at a lower profile.
- Unique passwords: where Basic authentication is still used, generate a random password per charger and rotate it through the CSMS; never derive it from serial number or charger ID.
ISO 15118 and Plug and Charge PKI
ISO 15118-2 (first generation) and ISO 15118-20:2022 (second generation, which adds bidirectional power transfer) define vehicle to charger communication, including automatic authentication known as Plug and Charge. ISO 15118-20 Amendment 1:2026 adds AC DER and megawatt charging services and an improved security concept. In Plug and Charge, several PKIs meet:
| Certificate | Issued by | Held by | Lifecycle point to control |
|---|---|---|---|
| V2G root | V2G PKI operator | Trust stores in chargers and vehicles | Root distribution and replacement across the fleet |
| CPO sub-CA (Sub1, Sub2) | V2G root, operated for the charge point operator | PKI operator on behalf of the CPO | Sub-CA access control, CSR approval |
| SECC leaf certificate | CPO Sub2 CA | Charger | Key pair generated on the charger; CSR via the CSMS; renewal, with one operator guide suggesting new keys and CSRs every two to three months |
| OEM provisioning certificate | Vehicle manufacturer PKI | Vehicle | Used to request contract certificate installation |
| Contract certificate | Mobility operator PKI | Vehicle | OCSP status check before authorisation; revocation when the contract ends |
- OCSP on behalf of the charger: chargers often lack direct internet access, so the CSMS checks contract certificate status (RFC 6960) using messages such as Authorize and GetCertificateStatus. A CSMS that skips this accepts revoked contracts.
- Registration of chargers: at least one PKI operator only lets audited charger models request SECC certificates and requires the SECC ID to be registered first. Treat charger onboarding as identity proofing.
- Client secrets to the PKI operator: the CSMS's credentials for the PKI operator's API can mint charger certificates. Store them in a vault, restrict who can use them and log every CSR. See the Secrets Management Guide.
- Protocol versions: OCPP 2.0.1 carries ISO 15118 certificate messages natively; with 1.6J they travel inside DataTransfer, which some PKI operators accept. Validate message length handling for large EXI payloads.
- Driver choice: AFIR Article 5(2) requires that where operators offer automatic authentication, end users can decline it and use ad hoc or another contract option.
See the Machine Identity, PKI and Certificate Lifecycle Guide and Certificate Expiry Outages and 47-Day TLS Certificates Guide; an expired SECC or CSMS certificate takes chargers offline as surely as an attack.
Regulation: UK smart charge points and EU AFIR
UK: Electric Vehicles (Smart Charge Points) Regulations 2021
The Regulations (SI 2021/1467) came into force on 30 June 2022 and apply to relevant charge points sold in Great Britain, mainly home and workplace chargers; the Schedule 1 security requirements applied from 30 December 2022. Schedule 1 reads like an IoT baseline applied to chargers:
| Schedule 1 paragraph | Requirement (summary) | Engineering implication |
|---|---|---|
| 1 General principles | Protect against harm to the electricity system, the charge point and personal data | Threat model includes grid impact, not just device compromise |
| 2 Passwords | Unique per charge point, not based on public information or set by the owner; no reset to a shared default | Per-unit credential provisioning at manufacture |
| 3 Software | Securely updatable with cryptographic protection; checks for updates; verifies authenticity and integrity; detects unauthorised changes and notifies | Signed updates, verified boot, update notification |
| 4 Sensitive security parameters | Robust protection of stored credentials; no hard-coded credentials | Secure element or protected storage; no keys in firmware images |
| 5 Secure communication | Communications sent from the charge point are encrypted | TLS to the back end (OCPP profile 2 or 3) |
| 6 Data inputs | Validate type and format of inputs from interfaces, APIs and networks | Input validation on OCPP, local web UI and apps |
| 7 Ease of use | Minimal setup inputs; owner can delete personal data | Data deletion function |
| 8 and 9 Protection against attack and configuration | Resist physical damage; tamper-protection boundary with owner alerts; least privilege; unneeded interfaces disabled; test interfaces not exposed | Tamper switches, disabled debug ports, minimal services |
| 10 Security log | Electronic log of security events, including tamper and unauthorised access attempts, timestamped in UTC | Log retention and upload to the back end |
| 11 Provision of information | Vulnerability reporting contact, software update support period, secure setup guidance, data deletion instructions | Published vulnerability disclosure policy |
Schedule 2 gives the enforcement authority civil sanctions of up to 10,000 pounds per affected charge point for breaches of regulation 4. In 2026 the UK government was also consulting on a load control licence for operators and flexibility providers; check current DESNZ and OPSS publications before relying on scope. See the ETSI EN 303 645 Consumer IoT Guide for the overlapping consumer IoT baseline.
EU: AFIR and Delegated Regulation (EU) 2025/656
- Ad hoc payment (AFIR Article 5(1)): chargers deployed from 13 April 2024 must accept electronic card payment through card readers, contactless devices or, below 50 kW, a secure internet-based method such as a QR code; 50 kW and above on the TEN-T network must comply by 1 January 2027 including existing points.
- Connectivity (Article 5(7) and 5(8)): all publicly accessible points digitally connected by 14 October 2024; new or renovated points capable of smart recharging.
- ISO 15118 (Annex II as amended by 2025/656): public AC and DC points installed or renovated from 8 January 2026 comply with EN ISO 15118-1 to -5; from 1 January 2027 with EN ISO 15118-20:2022, and points offering automatic authentication such as Plug and Charge must support both -2 and -20 for interoperability and security.
- Status: industry bodies including CharIN asked in 2026 for a phased approach to the 1 January 2027 date, and the Commission set up a working group to clarify compliance. As of October 2026 no postponement had been adopted; confirm on EUR-Lex before planning.
- NIS2: the delegated regulation notes that NIS2 treats recharging point operators as part of a high-criticality sector, so operators in scope also carry NIS2 risk management and incident reporting duties. See the NIS2 Directive Guide.
Securing the charging back end and charger identity
A CSMS is a fleet command system. Its non-human identities matter as much as its human administrators.
| Identity or credential | What it can do | Control |
|---|---|---|
| Charger OCPP identity (password or client certificate) | Connect as that charger, report sessions and meter values | Unique per charger, profile 3 certificates, revocation on decommission or theft |
| CSMS admin and support accounts | Remote start and stop, reset, firmware push, tariff and configuration changes | SSO with phishing-resistant MFA, role separation, approval for fleet-wide actions |
| Roaming and hub API tokens | Authorise sessions for partner customers, exchange CDRs and tariffs | Per-partner tokens, rotation, IP allowlisting or mTLS, anomaly monitoring |
| PKI operator client secrets | Request SECC certificates | Vaulted, limited operators, CSR logging |
| Payment and app back-end keys | Charge cards, issue credits | Separate from charger operations, scoped and vaulted |
| Firmware signing keys | Sign updates trusted by every charger of that model | HSM, split approval, separate keys per product line |
- Network: prefer chargers on a private APN or VPN even with TLS, and expose no inbound services on chargers. Disable local web configuration interfaces after commissioning, in line with UK Schedule 1 paragraph 9.
- Fleet-wide actions: require two-person approval for firmware campaigns, mass reset, tariff changes and load curtailment, and rate-limit them, because a stolen admin session can affect every site.
- Decommissioning: revoke the charger certificate, delete its OCPP credentials and remove its SECC registration when a unit is replaced, stolen or sold.
- Hardware: generate keys in a secure element at manufacture and avoid fleet-wide factory secrets. See the Device and IoT Identity Guide and Embedded Device Security Guide.
Fraud in EV charging
- RFID token cloning: many charging cards authenticate by UID alone. Prefer cards with cryptographic authentication, and detect the same token in two places within an implausible time.
- Roaming abuse: sessions authorised via a partner token the partner does not recognise, or CDRs that do not reconcile. Reconcile daily and alert on volume spikes per partner.
- Account takeover and loyalty abuse: credential stuffing against driver apps to spend stored credit or loyalty points, and multi-account sign-up abuse of free-charging promotions. See the Account Takeover Prevention Guide and Promotion and Bonus Abuse Guide.
- QR code substitution: stickers that redirect ad hoc payment to a fraudulent site. Use dynamic QR codes shown on the charger display where available (an OCPP 2.1 feature), and inspect sites.
- Meter and tariff manipulation: changes to tariffs or meter configuration through the CSMS. Log and approve tariff changes, and compare billed energy with metered energy.
Choosing approaches: decision guidance
- Profile 2 vs profile 3: profile 2 is quick to adopt on existing hardware; profile 3 needs a CSMS PKI and certificate rotation but removes shared passwords and makes theft response a revocation. New deployments should start at profile 3.
- OCPP 1.6J with security extension vs 2.0.1: stay on 1.6J only where hardware cannot move, with the security extension enabled; plan 2.0.1 or 2.1 for new estates, especially where Plug and Charge and AFIR ISO 15118-20 support are needed.
- Private APN vs internet: a private APN reduces exposure and is worth the cost for public estates; small workplace and home deployments rely on TLS and unique credentials instead.
- Small operators: outsourcing the CSMS moves operations, not accountability. Ask the provider for security profile support, certificate management, SSO and MFA, audit logs and an incident notification commitment. See the IoT Security Buyer's Guide.
- Depots and fleets: depot chargers often sit on corporate networks. Segment them from IT, and treat the depot energy management system as OT. See the OT Security Guide.
Detection, monitoring and metrics
- Charger events: SecurityEventNotification types for failed authentication, tamper, firmware change and certificate changes; reconnections at a lower security profile; chargers connecting from unexpected networks.
- CSMS events: admin sign-ins, fleet-wide commands, firmware campaign creation, tariff edits, InstallCertificate calls and new API clients.
- Commercial signals: token reuse velocity, roaming CDR mismatches, sessions with zero energy, promotion redemptions per device.
| Metric | What it shows | Target direction |
|---|---|---|
| Chargers on OCPP security profile 3 | Charger identity maturity | Rising towards 100 percent of new estate |
| Chargers still on profile 1 outside a private network | Exposed plaintext credentials | Zero |
| Chargers on current signed firmware | Patch reach | Above 95 percent within the campaign window |
| Certificates expiring within 30 days without renewal scheduled | Outage risk | Zero |
| Plug and Charge authorisations with OCSP checked | Contract revocation enforcement | 100 percent |
| Roaming CDR reconciliation exceptions per week | Fraud exposure | Falling |
Framework mapping
| Topic | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A | MITRE ATT&CK |
|---|---|---|---|---|
| Charger and back-end identity | PR.AA | IA-5, SC-17 | A.5.17 authentication information | T1078 Valid Accounts; ICS T0859 Valid Accounts |
| Encrypted OCPP and ISO 15118 links | PR.DS | SC-8, SC-12 | A.8.24 use of cryptography | T1557 Adversary-in-the-Middle |
| Signed firmware and verified boot | PR.PS | SI-7, SI-7(15), CM-14 | A.8.32 change management | T1195.002 Compromise Software Supply Chain |
| Minimal interfaces and exposure | PR.PS | CM-7 | A.8.20 networks security | ICS T0883 Internet Accessible Device; ICS T0886 Remote Services |
| Security logging and monitoring | DE.CM | AU-2 | A.8.15 logging | n/a |
| Supplier and CSMS provider risk | GV.SC | SR-3 | A.5.21 ICT supply chain | n/a |
Common failure patterns
- Profile 1 on the open internet: chargers sending Basic credentials in clear because the private APN was dropped to save cost.
- Shared or derived charger passwords: one password per model, or one derived from the serial number, which UK Schedule 1 paragraph 2 prohibits for relevant charge points.
- Keys in firmware images: hard-coded back-end or update credentials extracted from one charger and reused across the estate, contrary to Schedule 1 paragraph 4.
- Unchecked contract certificates: Plug and Charge accepted without OCSP, so revoked or cloned contracts keep charging.
- Over-powered CSMS accounts: support staff who can push firmware or change tariffs fleet-wide without approval, and shared vendor accounts with no MFA.
- Certificate expiry: SECC or CSMS server certificates expiring unnoticed and taking sites offline.
Implementation roadmap
- Inventory: list every charger with model, firmware, OCPP version, security profile, network path and certificate expiry; list every CSMS account, API client and partner token with an owner.
- Remove plaintext and shared credentials: move internet-reachable chargers to profile 2 with unique passwords, starting with a pilot site, and keep the previous configuration ready to restore if chargers fail to reconnect.
- Introduce profile 3: stand up the CSMS charger CA, issue certificates via SignCertificate on a pilot ring, then expand; monitor reconnection rates and roll back per site if needed.
- Lock down the CSMS: SSO and MFA for all admins, role separation, two-person approval for fleet-wide actions, and vaulting of roaming, PKI operator and payment credentials.
- Secure firmware: HSM-held signing keys, signed update flows only, staged campaigns with a canary group and a tested rollback image.
- Plug and Charge readiness: confirm OCSP checking, certificate renewal automation and ISO 15118-2 and -20 support against AFIR dates.
- Monitor and exercise: ship charger and CSMS security events to the SIEM, add fraud reconciliation, and run a tabletop on a compromised CSMS admin account.
Practitioner checklist
- No internet-reachable charger uses OCPP security profile 1, and profile downgrades raise an alert.
- Every charger has a unique credential, ideally a profile 3 client certificate generated on the device.
- Firmware is signed with HSM-held keys and verified on the charger before install.
- CSMS administrators use SSO with phishing-resistant MFA, and fleet-wide actions need approval.
- Roaming, PKI operator and payment credentials are vaulted, scoped and rotated.
- Plug and Charge authorisations check contract certificate status via OCSP.
- Certificate expiry for chargers, CSMS and SECC certificates is monitored with 30-day alerts.
- Security logs (SecurityEventNotification, GetLog) reach the SIEM with UTC timestamps.
- UK Schedule 1 and AFIR obligations are mapped to products and sites, with dates.
- Fraud signals (token velocity, CDR mismatches, promotion abuse) are reviewed alongside security alerts.
Standards and references
- Open Charge Alliance: Open Charge Point Protocol
- ISO: ISO 15118-20 Road vehicles, Vehicle to grid communication interface, Part 20
- legislation.gov.uk: The Electric Vehicles (Smart Charge Points) Regulations 2021, Schedules
- EUR-Lex: Regulation (EU) 2023/1804 on the deployment of alternative fuels infrastructure (AFIR)
- EUR-Lex: Commission Delegated Regulation (EU) 2025/656
- NIST: IR 8473, Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure
- Hubject: Plug and Charge requirements for CPMS
- CharIN: Position paper clarifying ISO 15118 implementation under AFIR
Related NHI Mgmt Group resources: IoT Security Guide · Device and IoT Identity Guide · OT Security Guide · Machine Identity, PKI and Certificate Lifecycle Guide · Connected and Autonomous Vehicle Security Guide. This guide summarises the UK Electric Vehicles (Smart Charge Points) Regulations 2021, AFIR and Delegated Regulation (EU) 2025/656 and is not legal advice.