Your charging back-end can start sessions, change settings and send firmware to your chargers. If it fails, your network fails with it. A supplier review is the cheapest way to find out how it’s protected.
NIS2 also makes this a duty for operators in scope. Article 21 lists supply chain security among the measures, including your relationship with direct suppliers.
Ask these ten questions in writing and keep the dated answers. If a supplier says yes, ask them to show you.
Identity and access
1. Can a charger connect using only its ID?
This is the weakness behind the February 2026 CISA advisories. Charger IDs are often easy to find, so an ID can’t be proof of identity.
A good answer: no. Each charger has its own credential, and a connection with a valid ID and no credential is refused. The supplier can show you that test.
2. Which OCPP security profile do our chargers use today?
Ask for a count of chargers by security profile. A list of supported profiles doesn’t tell you what’s running.
A good answer: a current report with no chargers on Profile 1, and a dated plan for any that are.
3. What happens when two connections claim to be the same charger?
A second connection can mean a reboot, or someone impersonating the charger. CISA lists weak session handling among the flaws, where one ID can hold two connections.
A good answer: the event raises an alert and someone checks it. The back-end doesn’t just swap to the newest connection.
4. Are failed connection attempts limited?
Without a limit, an attacker can keep guessing credentials. A good answer gives the limit, per source and per charger, and says who gets alerted.
5. Who can send a command to the whole network, and who approves it?
One account that can update firmware on all chargers is a single point of failure. A good answer describes multi-factor login, roles per customer, and a second person approving network-wide commands.
Firmware and remote access
6. Is firmware signed, and what refuses a bad image?
A good answer: the charger checks the signature before it installs an update, and it rejects a modified image and logs the event.
7. Which outside parties can reach our chargers remotely?
Include component makers and maintenance contractors. The M11 case shows why a supplier’s access belongs on your risk register.
A good answer: a named list, why each party needs access, and how you’d cut it off.
Logs and incidents
8. Can we export security logs, and how far back do they go?
You can’t write an incident report from logs you can’t reach. A good answer covers an export to your own security tools, synchronised time and a stated retention period.
9. How fast will you tell us about an incident?
Under NIS2, your own 24-hour clock starts when you become aware of a significant incident. A slow supplier leaves you with less to report and little time to do it.
A good answer is a notice period in the contract, with a named contact who is reachable at night.
10. How do you handle vulnerability reports?
Look for a published way to report a flaw, and a clear support period. Since 11 September 2026, the Cyber Resilience Act has required manufacturers to report actively exploited vulnerabilities. This binds product manufacturers. A pure cloud back-end may fall outside it, so ask your supplier which regime they accept.
What to do with the answers
Note each gap, who owns it and the date it’ll be closed. Ask again each year and after any major change. An auditor can check a dated answer with evidence behind it far more easily than a policy statement.
