Combatting renewables cyber threats with certification

Cybersecurity attacks targeting power grids across the globe have surged, with average frequency of attacks rising 100% every week, according to the International Energy Agency.

Motivated by financial gain and political disruption, attackers continue refining their tactics to exploit renewable systems like photovoltaics (PVs) and wind turbines. These attacks can disrupt independent buildings that rely on renewable power supply. The attacks also have the potential to disrupt entire regions that are dependent on the grid.

Renewables systems and equipment that are not exposed to testing and certification for cybersecurity resilience can be designed without properly prioritizing protection against these threats. These systems are attractive targets due to their vulnerabilities, including:

• Gateway to the local grid. Renewable systems connect to the local grid, potentially providing hackers that exploit them a single point of access into a municipality or utility’s back-end infrastructure.
• Increased connectivity of IoT. Internet connected IoT devices, together with weak authentication protocols and lax access controls in renewables and legacy communications systems, potentially provide multiple entry points for attackers.
• Lack of physical security. Wind farms and PV installations are often in remote, open areas with minimal physical barriers, leaving connected equipment exposed to tampering and physical attacks.

Strengthening cyber protection with third-party testing and certification

As cyber threats grow more frequent and sophisticated, regulatory mandates are evolving to ensure cybersecurity resilience across industries. The Cyber Resilience Act (CRA), which entered into force in December 2024, requires manufacturers of hardware and software products with digital components—including renewables like PV systems and wind turbines—to address cybersecurity risks throughout a product's lifecycle.

By mandating integrated protection during design and development, the CRA establishes a global benchmark for securing critical infrastructure. This precedent is encouraging other world powers to adopt similar measures, ensuring renewable systems meet rigorous standards for resilience in an interconnected world.

At the core of these regulatory changes is the ISA/IEC 62443 series of standards. These standards were originally designed to secure industrial automation and control systems but are continuously being revised to address a broader range of systems and industries. These standards provide a framework for implementing and maintaining electronically secure systems, establishing best practices, and assessing a high level of security performance.

These standards, as the basis of an FM Approvals certification, include the following key controls:

• Identification and authentication control (IAC): Ensures only authorized users and devices access the system
• Use control (UC): Defines user roles to prevent unauthorized actions
• System integrity (SI): Protects system data from unauthorized modifications
• Data confidentiality (DC): Protects sensitive information from unauthorized access
• Restricted data flow (RDF): Limits data transmission to essential pathways, reducing exposure points
• Timely response to events (TRE): Ensures systems can detect and respond to security incidents promptly
• Resource availability (RA): Maintains operational resilience during security events

Third-party testing and certification ensure these standards are effectively integrated across a system’s lifecycle, providing robust protection against physical and digital threats. To strengthen PV systems, wind systems, and other connected equipment in general, manufacturers and operators could implement the following actions.

• No unauthenticated services: All services must require authentication to prevent unauthorized users or devices from accessing critical systems
• Deployment behind a firewall: Firewalls serve as a first line of defense, filtering and monitoring traffic to block unauthorized access or malicious activity
• No unauthorized access permitted: Strict access controls should be implemented, ensuring that only approved personnel can make changes to system configurations or access sensitive data

Combined with third-party testing and certification, these best practices create a strong framework for mitigating cybersecurity risks in renewable systems, safeguarding both their reliability and sustainability.

FM Approvals Certification: addressing cybersecurity for renewables

FM Approvals offers testing and certification to a comprehensive set of diverse standards that – when combined – address cybersecurity challenges. FM Approvals’ standing as a certification body for ISA/IEC-62443 standards that address cybersecurity challenges and the development and implementation of our own standards (FM 6550 for Acoustic Condition Monitoring of Wind Turbines and FM 6530, for Rotating Machinery), emphasize robust renewables testing capabilities that confirm resilience to both physical and digital threats.

FM Approvals’ certification process evaluates the entire product lifecycle—from design to final production— requiring cybersecurity to be embedded at every stage. By integrating security from the ground up, an FM Approvals certification ensures manufacturers avoid inefficiencies of retrofitting to address cybersecurity measures. We work directly with manufacturers who prioritize delivering resilient, secure systems ready for the challenges of modern energy infrastructure.

Check out FM Approvals to learn more about certifying renewable products. Visit the Approval Guide to gain access to tens of thousands of FM Approved products and services with essential engineering data, technical information and use categorization. FM Approved products are available worldwide.