Ten security questions for your charging back-end supplier
What to ask before you sign or renew, why each question matters, and what a good answer sounds like.
For charge point operators
NIS2 lists operators of recharging points, subject to size rules. You’re expected to know your chargers, act without stopping sessions, and show what happened.
What’s being asked of you
You answer for it, whoever runs the back-end
NIS2 duties stay with the operator in scope. The Open Charge Alliance’s guide also says the charge point operator shall set up security monitoring.
24 hours to send an early warning
The clock runs from when you become aware of a significant incident. Someone has to decide, and record why.
You inherit your supplier’s design
CISA issued at least 15 advisories on charging back-ends in 2026. The six from 26 February all list missing authentication on charger connections.
What we’re building for you
Each item carries its status today. The first GridSEAL release is targeted for about Q2 2027.
A register of chargers and identities
What’s connected, on which OCPP version and security profile, with a source beside each field.
Roadmap, first releaseRules that explain themselves
Detections on back-end events, such as an unsigned firmware job. Each alert names the rule that fired.
Research pilot, rules engine laterA person approves each action
A check for active sessions comes first, and a named person approves. Actions go through your own back-end.
Isolation lab-tested, approval laterEvidence an auditor can check offline
A sealed record with a signature, which your auditor can verify without an account on our system.
Roadmap, first release
Where this sits in the charging chain
Vehicle to charger
In a study of 325 DC chargers, 12% supported TLS on this link.
ISO 15118-20 applies to new or renovated points from 1 January 2027.
The charger
It’s a networked computer on a public site, and its firmware is an update path.
The Cyber Resilience Act binds charger makers.
Charging back-end
GridSEAL starts hereCISA issued at least 15 advisories on these platforms from January to October 2026.
NIS2 binds operators, including their supplier risk.
The grid
Vehicle-to-grid adds commands that move real power, so each one needs limits.
GridSEAL Grid is on our roadmap.
Read next
NIS2 incident reporting: preparing for the 24-hour clock
What counts as significant, what’s due and when, and what a charge point operator should set up before an incident.
OCPP security profiles in plain English
How a charger proves who it is to your back-end, what each profile protects, and what no profile covers.
Start with a free health check
One to two weeks: an outside-in scan plus one read-only export. You get a written report, and nothing is installed.