Cybersecurity at renewable plants: ten checks to protect your plant while Spain transposes NIS2

ATA Cybersecurity is the cybersecurity division of ATA Renewables, the engineering consultancy with more than 409 GW of experience in over 80 countries. It advises developers, owners and operators of renewable assets (wind, solar, batteries, hydrogen, biomethane and hydro) and stays with them from start to finish on everything they need in cybersecurity. That covers governance, risk and compliance, meaning who does what, how it is reported and what each regulation requires; technical advice, from security by design to choosing equipment and suppliers; and the engineering that puts protection, detection and response in place at the plant. It can come in before a plant is designed, which is the ideal, or once it is already producing. Its base is engineering: it knows how each process in a plant works and understands what the teams who run it need.

On 29 December 2025 at least 30 wind and solar farms in Poland were hit by a destructive attack. At each affected site, according to CERT Polska, one of Poland's national incident response teams, a single device served as both VPN and firewall, with its VPN interface exposed to the internet and no multi-factor authentication. Once inside, says CISA, the US cybersecurity agency, the attackers used default credentials to reach the HMIs (the operators' control screens) and the RTUs (remote terminal units), and damaged the RTUs' firmware. Both weaknesses they exploited, remote access without a second factor and a factory password, are on any basic security checklist.

ATA Cybersecurity's advice starts with distrusting three phrases it still hears at solar plants, wind farms and substations: we're isolated from the internet, we have a firewall and nothing has ever happened to us. None of them amounts to being secure, because an attacker needs only a single point of access. The good news is that all three can be tested. These are its ten checks, in four groups. They can be worked through in phases, and nearly all of them without stopping production.

First, know what you have

1. Take an inventory of everything that is connected

The equipment in a modern plant is smart, and that means some part of it can be connected to the internet. It might be the 4G router the maintenance contractor installed, a turbine's data card or the monitoring system's web portal. Even SCADA, the software that monitors and controls the plant, is now an application with code of its own. At a plant already running, everything starts with a list of what is there and how each piece communicates. Without it, the other nine checks are done without knowing what needs protecting.

2. See your plant as the internet sees it

We're isolated is the most comfortable phrase, and the easiest to test. On 6 October a Dutch analytics firm and the Netherlands' National Cyber Security Centre (NCSC-NL) presented a count of wind and solar farm systems that should not have been reachable from the internet but were: 8,547 of them, in 35 countries in and around Europe. That is a floor, since only systems that could be traced to a specific farm were counted. Some 2,766, almost 35% of the solar cases, were in Spain. Across the whole count, at 181 sites, the researchers reckoned, the exposure would have allowed full operational control. If researchers could find these systems from outside, so can an attacker. Better to look first.

Then, lock down access

3. Change the factory passwords, and use a different one at each plant

Default credentials were the second weakness exploited in Poland, and the Polish report adds that reusing passwords across sites is common in the sector. Usernames and passwords on sticky notes, and HMIs left on their default passwords, still turn up in plants. Changing them is the cheapest item on the list, and doing it site by site has an advantage: if every plant has its own, passwords stolen at one cannot be used to get into the others.

4. Give every remote connection a second factor and a time limit

We have a firewall is less reassuring than it sounds. In Poland the attackers got in through the firewall itself, and sometimes it need not even be attacked: one phishing email is enough to get past every firewall in a company. Hence ATA Cybersecurity's argument that what matters most today is controlling identities: who gets in, and with what permissions. In practice, that means replacing suppliers' always-on VPNs with access that is multi-factor, time-limited and logged. The technician gets in when there is work to do, and what they did is on record.

5. Separate the plant from the office, and the plants from each other

Segmenting the network, meaning dividing it into zones that cannot talk to each other without controls, makes it harder for a malicious email opened in the office to give access to the plant's control screens. Groups with assets on both sides of the Atlantic face a less obvious risk: a badly configured plant in a lightly regulated country can be used to get into the corporate network and, from there, into the group's European plants. A group is only as well protected as its least protected plant.

6. Control USB sticks and maintenance visits

The network is not the only way in. The manufacturer's technician who turns up to update a controller with a USB stick may unknowingly bring in malicious software that no firewall has checked. Knowing who plugs what in, and with which kit, starts with a written procedure.

7. Have a plan for whatever is out of support

A plant runs for twenty years or more and much of its equipment is never replaced in that span, so unsupported operating systems sit alongside industrial protocols designed when nobody was thinking about cyberattacks. And the older the technology, the easier it is to attack. In 2024 around 800 solar monitoring devices in Japan, carrying a known and unpatched flaw, ended up working for bank fraudsters. Whatever cannot be patched should be isolated, and whatever cannot be isolated belongs on the replacement schedule.

Next, monitor the plant

8. Set up the monitoring that lets you report in time

An empty incident log can mean that nothing has happened, or that nobody has noticed. That is the flaw in nothing has ever happened to us, the phrase heard most often, and the second reading now carries legal consequences. For a significant incident, the EU's NIS2 directive requires an early warning within 24 hours, a notification within 72 and a final report within a month, while Chile allows three hours for the first alert. Nobody can report within 24 hours an incident they have not detected. Without monitoring at the plant, there is no way to be sure of meeting the deadline.

9. Rehearse running the plant without remote control

In February 2022, at the start of the invasion of Ukraine, a cyberattack on a satellite network left 5,800 turbines from a single manufacturer, some 11 GW in central Europe, without remote monitoring and control. Two months later an attack led a German wind maintenance firm to cut remote monitoring of some 2,000 turbines for a day or two as a precaution. In Poland generation carried on, but communications and remote control between the farms and the DSO, the local distribution system operator, were lost. None of the three cases has any record of the attack stopping generation. In all three, remote visibility went, and that forces operators to make decisions without information.

The rehearsal has to start with what is being protected. In an office, keeping information confidential comes first; at a plant, keeping it running and, if it stops, getting it producing again as fast as possible. And doing harm can be as easy as falsifying a light sensor's reading: tell the plant it is night and it stops generating. A good plan answers three questions: how to operate without remote control, how to spot false data, and whom to call first.

Finally, require security when you buy

10. Write cybersecurity into every contract

The Cyber Resilience Act (CRA) applies directly across the EU and falls on the manufacturers of products with digital elements, such as inverters, controllers or battery systems. Since 11 September 2026 they have had to report, within 24 hours, actively exploited vulnerabilities and severe incidents affecting their products, including those already on the market; the remaining obligations apply from 11 December 2027. For an owner, the CRA becomes a procurement clause. By one ATA Renewables engineer's count, a solar plant has at least seven major equipment suppliers: seven possible ways in, each worth securing by contract. For a new plant this is the best-value check on the list: before construction, demanding a certification from a supplier costs one line in the contract.

When the rules apply

Put the same solar plant, with the same inverters and the same SCADA, on either side of a border and its obligations are very different. In the European Union, NIS2 lists electricity among the sectors of high criticality and reaches well beyond generators, taking in suppliers, DSOs, TSOs (transmission system operators), market operators, aggregators, storage providers and charge-point operators, generally from medium-sized companies upwards. For essential entities, the more tightly supervised of NIS2's two tiers, the ceiling on fines is no lower than €10 million or 2% of worldwide turnover, whichever is higher.

What varies from country to country is the timetable. Italy has applied its decree since 16 October 2024, with October 2026 set as the deadline for basic security measures. Carlos Ramírez of ATA Cybersecurity describes the Italian model as a countdown: as soon as the national agency, ACN, sends you the requirements, “you're already up against the clock”. Germany's law has been in force since 6 December 2025, Poland's and Portugal's since 3 April 2026.

Spain is lagging. On 8 July 2026 the European Commission took Spain, France, Ireland and the Netherlands to the Court of Justice of the EU (CJEU) for failing to notify full transposition (the Netherlands has had its law in force since 15 August). Spain's Law on the Coordination and Governance of Cybersecurity is still an anteproyecto, a draft bill approved by the Council of Ministers on 14 January 2025 that has yet to reach the Cortes, Spain's parliament. The delay buys time, though not much. The law will also apply to plants already in operation, and the usual pattern, according to Ramírez, is an adaptation period of a year or a year and a half, during which a roadmap can serve as the response. Anyone who arrives with the ten checks done will have much of that roadmap written already.

Latin America is more uneven. Chile, with its three-hour alert, is ahead, and so is Brazil, which has required electricity-sector players to have a cybersecurity policy since 2022. Ecuador published its law in May 2026, with 24 months to adapt. Mexico has a policy only for the federal public administration, and Argentina goes no further than defining critical infrastructure. Ramírez warns against reading the absence of rules as reassurance. A country having no specific regulation, he said, “doesn't mean they can't hack your plant”.

Where to start

A new plant starts with the design, choosing equipment, protocols and network architecture with security in mind before construction. That is the phase ATA Cybersecurity recommends, though it can come in at any other, because, in Ramírez's words, “what we're after is to be a partner for our client's whole life”. Plants already running start with the inventory and the quickest wins: segmentation, and the factory passwords and remote access that were the two weaknesses exploited in Poland. Groups with international portfolios would do well to do it the same way everywhere. Ramírez has seen large operators apply the European minimum at all their plants, including those outside Europe where nobody asks them to, for reasons of plain economics. Twenty firewalls bought at once cost less apiece than two, and with the same solutions everywhere a single security operations centre can watch over the lot.

Beyond the fines lies what no regulation puts a number on. A shutdown costs revenue and reputation, but a plant also has people working beside electrical equipment. “For me the main impact is always people,” Ramírez said.

The list on one page

• Take an inventory of everything that is connected and how it communicates, so you know what you are protecting
• Look at your plant from the internet to learn whether it really is isolated, and close what is exposed before someone else finds it
• Change the factory passwords and use a different one at each plant, so that one stolen password cannot open the whole portfolio
• Add a second factor and a time limit to every remote connection, and no supplier will keep permanent access to your plant
• Separate the plant from the office and the plants from each other, and a malicious email will find it far harder to reach the controls
• Control USB sticks and maintenance visits to know what comes into your plant along with the technician
• Patch, isolate or replace whatever is out of support, so that nobody can get in through a known flaw
• Set up monitoring that detects incidents, because without it there is no way to report within the legal deadline
• Rehearse running the plant without remote control, so that on the day it fails your team knows how to keep it going
• Write cybersecurity into every supplier contract before construction, while adding it costs little