Remote support can shorten a service investigation, especially when the supplier and the installation are in different countries. It can also leave the owner uncertain about who can change dispatch, update firmware or reconnect a stopped system. The practical question is not whether the BESS has a cloud portal. It is whether the owner can govern the access that portal provides.
Build BESS remote access security into the purchase specification. Identify users, permitted actions, approval requirements, local operating responsibilities and the records available after a service session. A password handover without that information leaves important decisions unresolved.
Current guidance: a new draft is not a new compliance certificate
NIST SP 800-82 Revision 3, published in September 2023, is the final OT security guide identified on NIST’s publication page at this review. OT means operational technology: systems that monitor or affect physical processes. A storage control system should be assessed with those operating consequences in mind.
NIST published the Revision 4 initial public draft on September 21, 2026, with comments due November 30, 2026. It remains a draft, not a final replacement or a product-certification scheme. The announcement highlights expanded cloud-convergence and governance coverage. Buyers should track the development without presenting a draft reference as proof of compliance.
For a project owner, the immediate implication is contractual: ask the integrator which guidance and requirements the delivered design addresses, what evidence is available and which functions depend on third-party services. Avoid vague claims such as “secure cloud” without a defined scope. A well-written access schedule is more useful than an unexplained security logo.
Separate looking at the battery from commanding it
A monitoring account, a dispatch account and a maintenance account should not be treated as the same role. Viewing an alarm does not require permission to change a protection-related configuration. Downloading operating data does not necessarily require permission to issue a power command. Ask the supplier to demonstrate the actual permission boundaries.
When evaluating commercial energy storage equipment, request the remote service architecture alongside the electrical and controls scope. Confirm whether access is through an owner-managed gateway, a supplier portal, a local interface or several paths. Document any path that remains active when the main portal account is disabled.
| Role | Typical business need | Permission to verify explicitly |
|---|---|---|
| Owner operations | Read status, alarms and operating history | Whether operational commands are allowed and logged |
| Energy manager | Manage approved dispatch schedules | Which settings can change without engineering approval |
| Supplier diagnostics | Inspect faults and export service evidence | Whether the session can remain read-only |
| Authorised maintenance | Perform an approved change during a service window | Who grants, limits and revokes elevated permission |
| Account administrator | Manage users and access policy | Whether identity administration also permits plant commands |
Specify a service session from request to closure
The NIST OT security guide recommends justified, limited remote access that does not negate safety controls, and discusses authentication, temporary access and logging. It also stresses the operational implications of disabling access. Use those principles to ask for a demonstrable service workflow, not merely a VPN connection.
Start with a named engineer and an identified service ticket. The owner should know what the engineer intends to inspect or change, whether local personnel must be present, and who is authorised to approve the work. Specify stronger authentication for privileged remote access and identify any device that cannot support it directly so the security team can assess the proposed alternative.
Agree the session’s end condition. Access should not remain elevated simply because the engineer did not log out. If the platform cannot enforce the desired expiry, require a documented owner-controlled process and assess whether it is sufficient for the site’s risk. Avoid using shared credentials as the normal method of identifying the person who performed a change.
The closure record should identify the approved work, actual changes, configuration backup, resulting alarms and return-to-service decision. A remote reboot that restores communication is not evidence that the energy service or safety-relevant configuration has been verified.
Keep the local operating decision visible
Ask what happens when the internet link, cloud platform or remote support service is unavailable. The answer must describe the delivered control architecture and approved local functions. Do not assume that a system needs the cloud for every action, or that every system can continue all services without it.
Our BMS, PCS and EMS responsibility guide helps separate battery limits, converter actions and supervisory dispatch. The remote-access specification should preserve that distinction. A remote account’s permission to request discharge does not mean it may override a battery protection decision or the site’s approved interlocks.
| Unavailable function | What the owner should establish | Evidence to request |
|---|---|---|
| Internet connection | Which local controls and records remain available? | Approved connectivity-loss demonstration |
| Cloud portal | How does the owner confirm actual plant state? | Local interface and operator procedure |
| Remote service account | Can support access end without unintended plant commands? | Revocation test under an approved operating plan |
| Central identity service | What controlled emergency access is available? | Owner-approved recovery and audit process |
| Dispatch data feed | Which restricted operating policy takes effect? | Control narrative and associated event records |
Data ownership matters when the warranty starts
NLR’s DER cybersecurity standards overview describes work spanning device, network, application and system requirements. That scope is important: a protected device is not the same thing as a fully governed service chain. The page does not establish that HMX products hold any of the certifications it discusses.
Ask who owns the operational data, who can export it, which formats are available and what remains accessible if a subscription ends. A cloud-only screenshot is a weak basis for reviewing repeated outages or a warranty dispute. Define retention and export requirements according to the owner’s operating and legal needs; do not insert an arbitrary retention period because another site’s contract used it.
The owner should retain the device inventory, approved firmware and settings revisions, network architecture, service contacts and recovery material in a controlled location. Store passwords and other secrets in the organisation’s approved security system, not in a shared maintenance report. Avoid placing detailed live network diagrams in public marketing material.
Include an exit plan, not just an onboarding plan
The maintenance provider may change while the battery remains in service. Specify how accounts are revoked, customer administrators transferred, records exported and replacement support brought in. Clarify the supplier’s security-update support period and how the owner receives vulnerability or service notices. A warranty duration does not automatically define software support.
| Deliverable | Responsible party to name | Acceptance evidence |
|---|---|---|
| Access architecture and role list | Integrator with owner IT/OT review | Documented paths and role demonstration |
| Service-session approval process | Owner operations and supplier service | Sample authorised session with closure record |
| Data export and configuration recovery | Platform provider and integrator | Readable export and approved recovery demonstration |
| Security support and notifications | Device and platform suppliers | Defined scope, contacts and end-of-support conditions |
| Contract termination handover | Owner and outgoing service provider | Revocation, ownership transfer and retained records |
Place these deliverables in the BESS purchase and acceptance checklist. The objective is accountable service access: the right person can do approved work, the owner can see what happened, and the installation retains a defined operating path when remote support is unavailable. Require the supplier to demonstrate that arrangement before handover.