BSI tells small plant operators to take control systems off the open internet

Serguey Asael Shinder16 October 2026, 14:122 min read

Germany's Federal Office for Information Security (BSI) has published cyber-security recommendations for industrial control systems that can be reached from the internet, pv magazine reported on 16 October. The guidance (BSI-CS 154, published through the Alliance for Cyber Security) is aimed at operators of small and very small facilities: hydropower plants, wind farms, waste-to-energy plants and PV installations of all sizes.

The central demand. The BSI's main recommendation is that plant control systems should not be directly accessible from the internet. In a PV plant, pv magazine lists what that covers: industrial controllers, communications equipment, monitoring gateways, inverters, SCADA systems and remote-monitoring platforms. Systems reachable over public networks, the report says, are exposed to unauthorised login attempts, exploitation of known vulnerabilities and manipulation of operating parameters, and an incident in operational technology can disrupt control of the plant itself, not just cut off monitoring data.

What should replace direct access. Remote access should run through encrypted VPN connections combined with multi-factor authentication, so that a stolen or weak password is not enough on its own. The report adds that these measures reduce the risk rather than remove it.

Patching and inventory. Operators are told to install security updates promptly on supervisory systems and on connected field devices — routers, firewalls, controllers, inverters and communications gateways — because unpatched equipment stays open to flaws for which fixes already exist. They should also run periodic checks for devices exposed to the internet, keep an inventory of connected assets and their communication interfaces, and confirm that remote services are not reachable without need; where exposed systems turn up, mitigation should follow.

What it means for PV operators. For solar plants, the report highlights separating office and operational networks, limiting remote access to authorised staff and service providers, and building updates and security reviews into routine operation. The BSI's text is a recommendation, not a binding rule; pv magazine does not report any deadline or enforcement attached to it.

Source: pv magazine — https://www.pv-magazine.com/2026/10/16/germany-recommends-eliminating-direct-internet-access-to-pv-plant-control-systems/ ; BSI-CS 154: https://www.allianz-fuer-cybersicherheit.de/SharedDocs/Downloads/Webs/ACS/DE/BSI-CS/BSI-CS_154.html