Solar and BESS Inverter Cybersecurity Acceptance Checklist for India

Do not accept a solar or BESS remote-monitoring system because the dashboard loads and the EPC can log in. Acceptance should prove who owns each account and asset, how remote access is controlled, what crosses the plant boundary, how software is maintained, and whether the owner can operate and investigate after the vendor leaves. The checklist below turns those questions into commissioning evidence without assuming that one cyber rule applies identically to every Indian facility.

Key Takeaways

• Build an asset, software, account and data-flow inventory before testing controls.
• Give the owner administrative control; remove shared defaults and require multi-factor authentication for remote access wherever supported.
• Segment inverter, BESS and monitoring networks from business and safety-critical systems, allowing only documented flows.
• Obtain firmware provenance, backups, logs, vulnerability handling and vendor-offboarding evidence at handover.
• Determine Indian legal applicability entity by entity and system by system; CEA and CERT-In instruments have defined scopes and cannot be applied by slogan.

What should be inventoried before cyber acceptance?

Record every inverter, data logger, plant controller, BMS, energy-management server, gateway, network switch, firewall, engineering laptop, cloud tenant, mobile application and remote-support tool. Include manufacturer, model, serial number, hardware revision, firmware, IP and MAC address, physical location, owner and support status. Map removable media and temporary commissioning devices too.

Create a data-flow diagram showing endpoints, ports, purpose, authentication and encryption. Identify traffic to vendor clouds, time servers and update repositories. “Internet required” is not a sufficient rule. The owner should approve each external dependency and understand what happens when it is unavailable.

Tie cyber inventory to the as-built single line and control architecture. For operational context, see the solar monitoring guide, solar inverter selection guide and solar battery storage guide.

Who should own accounts, credentials and cloud tenants?

The owner should control the primary tenant, billing, administrator recovery and export rights. Use named, least-privilege accounts for operations, engineering, audit and support; disable defaults and dormant or departed-user accounts.

Require MFA for cloud and privileged remote access where supported, preferably phishing-resistant for administrators. Control recovery codes, token replacement and break-glass access; never tie recovery solely to an EPC employee's phone.

Require unique vaulted credentials and rotation of service and device secrets. A web-password change does not rotate API keys or certificates. List every credential type and prove contractor-only secrets were removed or controlled.

How should remote access and network segmentation be designed?

Route remote support through an owner-controlled access path such as a managed VPN or zero-trust gateway with MFA, named users, approval, time limits and logging. Avoid direct port forwarding to inverters, BMS devices or web interfaces. Vendor access should be disabled by default or enabled only for an approved service window where operationally feasible.

Separate operational technology from corporate IT, guest wireless, CCTV and public internet using security zones and deny-by-default policy. Within OT, consider zones for plant control, BESS, monitoring, protection interfaces and vendor gateways based on consequence and required flows. Segmentation is more than VLAN labels; test firewall enforcement from both directions.

Do not disrupt safety functions to satisfy a generic network template. Define which controls continue locally during communications loss. Test loss of cloud, DNS/time and remote sessions. The plant should reach a defined state without bypassing electrical protection.

Which protocols and encryption should be accepted?

Prefer authenticated, encrypted protocols for management and external communications. Disable unused services and insecure legacy management methods where technically possible. If an operational protocol lacks encryption or authentication, contain it within a controlled segment, restrict endpoints, monitor it and document the residual risk and upgrade plan.

Check certificate identity, validity, trust chain, renewal and private-key protection. Encryption without endpoint verification can permit interception. Record the renewal owner and pre-expiry alarm. Confirm firmware and configuration packages are signed or otherwise verified by manufacturer-approved methods.

What firmware and vulnerability evidence is needed?

Freeze each asset's approved firmware baseline and preserve the approved installation package. Obtain release notes, supported versions, update method, rollback limits and vendor security contact, with named owners and review dates. Verify authoritative downloads and preserve hash or signature evidence. Stage updates with approval, backup and rollback rather than testing first in production.

Require vulnerability reporting, support-life, end-of-life notice and remediation processes. Track unapplied patches and compensating controls; “no known vulnerabilities” is not a warranty.

CEA publishes information on testing imported power-system equipment for malware and cyber threats. Check applicability and required evidence for the procured equipment and governing directions; a webpage title is not a universal certificate requirement.

How should backups, logs and incident response be tested?

Back up inverter, controller, BMS/EMS, firewall, switch, account-role and cloud configurations, plus exportable certificates. Keep protected offline or immutable copies with version, date and checksum. Witness restoration in an approved environment; downloading is not a restore test.

Synchronise clocks and record timezone. Capture authentication, privileged actions, configuration and firmware changes, alarms, remote sessions and security decisions. Set retention for applicable legal, operational and investigation needs, with owner-usable export.

The incident plan should name operational, IT, EHS, legal, vendor and regulatory contacts. Cover isolation authority, evidence preservation, safe manual operation, credential reset, recovery and communications. Tabletop-test a compromised vendor account or malicious setpoint; cyber response must not create an electrical hazard.

For maintenance governance, integrate these controls with the solar panel maintenance guide rather than treating cyber handover as a one-time IT task.

What should vendor offboarding include?

At commissioning close, remove temporary accounts, revoke tokens and VPN certificates, rotate transferred secrets, control engineering laptops, and confirm domain and cloud ownership. Document remaining vendor access, justification, approver and expiry. Require notice of subcontractor changes.

Deliver architecture, inventories, backups, licences, support contacts, vulnerability notification, breach cooperation, data return and secure deletion. Confidentiality must not prevent the owner from operating or investigating its plant.

Which Indian cyber requirements apply?

CEA cyber-security material, sectoral guidelines and ISAC-Power resources must be assessed against the facility's role, connectivity, ownership and notified obligations. CERT-In directions issued under section 70B have defined requirements and applicability; entities should review the official directions, FAQs or verification methods and obtain legal advice where needed. Reporting, time synchronisation and log-retention duties should not be paraphrased without checking the current instrument.

A factory behind-the-meter system, generating company, distribution-connected resource and protected system may not have identical duties. Contractual controls can exceed minimum law, but contracts should identify them as such. NREL guidance is useful international technical guidance, not Indian law or certification. Passing a checklist is site acceptance evidence, not a guarantee that a system is secure against all threats.

FAQ

Is a vendor cloud security certificate enough for plant acceptance?

No. It may support assurance for a defined cloud scope, but does not cover field devices, owner accounts, network rules, configurations or operational response.

Should vendors keep permanent remote access for faster support?

Not by default. Use owner-controlled, named, MFA-protected and logged access with explicit approval and time limits where feasible.

Must every legacy inverter protocol be encrypted?

Not always technically possible. Document the limitation, isolate the protocol, restrict endpoints, monitor traffic and maintain an upgrade or replacement plan.

Does this checklist prove compliance with all Indian cyber law?

No. Applicability depends on the entity and system. Map current CEA, CERT-In, contractual and sector-specific duties with qualified legal and technical review.

Sources

• CEA: Cyber Security
• CEA: ISAC-Power
• CEA: Testing imported power-system equipment for cyber threats
• CERT-In: Directions under section 70B
• CERT-In: Methods of Verification
• NREL: Cybersecurity for Distributed Energy Resources