How should your business manage smart charger cyber security?

Treat your chargers, management accounts and network connection as a connected business system. For relevant private chargers sold in Great Britain, the security requirements took effect on 30 December 2022 [S1]. Obtain compliance evidence, agree who installs updates and test account recovery and loss of connectivity. Public chargers require a separate scope assessment. Checked October 2026.

Last checked 16 October 2026

What is a smart charger security assessment checking?

Start with the whole charging service: the equipment, remote management platform, administrator accounts and connection to your site. Ask the seller for a diagram showing which organisation controls each part. Keep a copy with your operating contract so later changes can be checked against it.

Private workplace chargers within the Great Britain smart charger regulations must meet device requirements, including security provisions. The published scope excludes public and rapid charge points. Confirm the classification of your proposed equipment rather than assuming every charger in a business car park has the same obligations. [S1]

Public access is a separate question. DfT guidance includes publicly accessible chargers in privately owned car parks, including customer car parks. Ask your adviser to assess mixed staff and public arrangements. This is general regulatory information; check legal interpretation with your solicitor. [S6]

Read public versus private chargepoints before writing the procurement brief. Describe who will use the bays and when, including any change in access outside working hours.

Who manages the software on your smart chargers?

Put a named organisation against firmware updates, platform security and remote access. Firmware is the software running inside the charger. Schedule 1 of the private charger regulations addresses secure updating, including checks on an update’s origin and integrity. Ask the seller to explain how its update process meets those requirements where they apply. [S2]

NCSC advises keeping business devices and apps up to date because updates fix weaknesses criminals could exploit. Apply that advice to the laptop or tablet used to manage charging, alongside the charger’s own maintenance arrangements. [S4]

Request a written support end date for the proposed equipment and platform. Ask what happens if an update fails, how the previous operating state is recovered and who checks charging afterwards. Treat these as contract questions rather than accepting an undefined promise of ongoing support.

Use the maintenance guide to compare responsibilities for software and physical faults together. Ask how an urgent update would be scheduled around your fleet’s departure time.

How should you protect charger management accounts?

NCSC recommends strong, separate passwords and additional sign-in protection for important online accounts. Use multi-factor authentication where the platform supports it: this adds a check beyond the password. Protect the email account used to reset platform access too. [S3]

Ask for individual administrator accounts and access levels suited to each job. Your reception team may need to view a charging fault without being able to alter tariffs or remote access settings. Have the platform demonstrate the permissions you intend to use.

Keep an access list covering your staff and contractors. Include a removal step when someone leaves or a maintenance agreement ends. Store account recovery arrangements where the authorised deputy can find them, and rehearse recovery before the original administrator is unavailable.

What does OCPP mean for charger cyber security?

Open Charge Point Protocol (OCPP) is a communications protocol between chargers and their management system. The Open Charge Alliance’s security guide covers encrypted communications using Transport Layer Security (TLS), certificate management and restrictions on critical operations. A technical capability needs an operating process behind it. [S5]

Ask your IT team to approve the proposed network connection before installation. Request an explanation of which systems the charger can reach and which remote parties can reach it. Do not give a contractor general access to your business network simply because connectivity is needed.

Read OCPP and OCPI explained when comparing platform specifications. Ask for the configuration you are buying, rather than relying on a protocol name in a brochure.

What should happen if connectivity or the platform fails?

Agree an outage demonstration with the installer. Record whether an authorised driver can start a session, how it is recorded and how site power limits remain controlled. Ask the electrical designer to approve the test method before anyone disconnects equipment.

Keep the intended result alongside the commissioning record. Where private charger rules apply, continued charging capability after communications loss is a requirement, but that does not describe every billing or fleet-management feature you rely on. [S1]

NCSC’s smart-device advice recommends checking support and update arrangements before purchase. Extend that procurement question to loss of the remote service: ask how you would regain control or move management without replacing usable hardware. [S7]

What should your incident and handover plan contain?

Request a contact route for suspected account compromise and a process for preserving relevant logs. Ask who can suspend remote access, who authorises restoration and how drivers will be informed. Make these tasks part of the operating arrangement, including arrangements outside your normal office hours.

Use driver data protection guidance to prepare a separate response for any incident involving personal information. Ask your insurer what evidence it expects before an incident, including support contracts and records of access changes.

What should you do next?

Bring your access policy, IT contact and unanswered support questions. Read how we work and get matched with an installer that covers your area.

Piggy Pineapple Ltd operates this advice and referral service. We refer enquiries and may be paid a fee. Before sharing your details, we will name the proposed installer and disclose any shareholding the owner holds in it.