A charge point
is part of a service.

THE BACKSTORY / APRIL 2024

Why the management system deserves attention.

Dark Reading’s 9 April 2024 report highlighted weak authentication, exposed management software, inadequate separation between networks, and risks to customer information. Its examples ranged from altered charger displays to database exposure. Those examples show that a charging service has several different points of failure; they are not interchangeable evidence of grid compromise.

The reporting also drew attention to the cloud software coordinating access, billing, and charging. The business question is therefore wider than whether a particular box in a car park has been tested. It includes the service behind it and the people who administer it.

The underlying ChargePrint research, published at NDSS 2023, identified 27,439 online stations associated with 44 management systems. Its analysis reported 120 previously unknown vulnerabilities and coordinated disclosure with vendors. These are historical research findings, not a count of unpatched chargers operating in the UK today.

A vulnerability disclosure establishes a weakness in a defined system or version. Whether your service is exposed depends on its software, configuration, access, and remediation. Ask the supplier to show how it tracks relevant advisories and verifies fixes across the installed estate.

THE OPERATING VIEW

One installation. Several different loss scenarios.

NIST’s extreme-fast-charging project considers charging equipment, vehicles, cloud or third-party operators, and utility/building networks. Its Cybersecurity Framework profile is a risk-management reference for that environment. It is not a universal certification requirement for all chargers.

The electricity connection matters, but it does not make every device weakness a route to a blackout. Establish which commands an attacker could actually issue, how many assets could be affected, and which independent protections remain. Use qualified electrical and security specialists where the consequence could involve physical safety.

BEFORE DEPLOYMENT / DURING OPERATION

Connect the purchase decision to continuing assurance.

A charger may be supplied by one company, installed by another, and remotely managed by a third. Assign the continuing service owner before handover. Record the models, software, support period, management accounts, and suppliers that can reach the installation.

During selection, ask for evidence relevant to the proposed configuration: supported updates, controlled administrator access, secure communications, vulnerability handling, and recovery arrangements. A test report for another version or a product badge alone does not explain the service you are buying.

Before deployment, review physical access, network separation, and the information shared with the platform. Confirm that maintenance access cannot unnecessarily reach unrelated business systems. Coordinate any technical testing with the supplier and site owner; intrusive testing can interrupt a physical service.

After handover, keep the record current. Check that patches reach the estate, review supplier and administrator changes, and remove obsolete accounts. Agree which logs and alerts are available, who examines them, and how an urgent report reaches the responsible person.

Customer-account abuse also deserves a response route. Establish how suspicious charging sessions are checked, how credentials or access are revoked, and how customers receive reliable advice. Anonymising a report does not replace protecting the underlying information and account access.

UK & EUROPE / SCOPE MATTERS

A legal baseline is not assurance of the whole service.

In Great Britain, the Smart Charge Points Regulations cover relevant private domestic and workplace charge points. The main commencement was 30 June 2022; Schedule 1 security requirements followed on 30 December 2022. The guidance excludes, among other categories, public and rapid charge points and products sold in Northern Ireland.

In the EU, the Cyber Resilience Act has a separate product-security framework. Article 14 reporting obligations apply from 11 September 2026; the main provisions apply from 11 December 2027. Scope, classification, and conformity assessment must be checked for the actual product and economic operator.

The original article’s suggestion of a blanket January 2024 third-party certification requirement for every EU charging provider was incorrect and is not retained. Product rules should not be conflated with every obligation that may apply to a network operator. Obtain a scoped compliance review for the countries, products, and services involved.

EXERCISE THE INTERRUPTION

Plan for a platform outage before it delays the fleet.

Choose a credible scenario: the charging platform is unavailable overnight, while vehicles are expected to depart in the morning. Ask what still works, who can confirm safe operation, how drivers are informed, and whether an alternative location has sufficient capacity.

Include the equipment supplier and site or fleet owner in the discussion. Verify any claimed offline capability rather than assuming that loss of cloud connectivity has no effect. Restoring the network connection is not the same as confirming that normal service and trustworthy account records have returned.

CyberSolace can help frame supplier assurance, review readiness before deployment, and assess how the programme matures through operation and response exercises. Agree the required specialist testing and ongoing service responsibilities explicitly; an advisory review is not itself continuous monitoring or a guarantee of safe operation.