Analysis of Cybersecurity Requirements for Battery Management System in Energy Storage Systems: Integrating International Standards and Domestic Technical Specifications ^†

Abstract

This research addresses the cybersecurity requirements of battery management systems (BMSs) in energy storage systems (ESSs) through a dual-track methodology. First, it aligns with the existing domestic process control system cybersecurity framework to ensure regulatory consistency. Second, it incorporates analysis of international industrial control system standards, such as International Electrotechnical Commission 62443. By applying gap analysis and threat modeling, this study proposes a tailored set of cybersecurity requirements specifically for BMS devices. The results enhance the cybersecurity resilience of ESSs and provide a critical technical foundation for regulatory authorities to develop testing standards and verification methodologies for BMS cybersecurity.

1. Introduction

As a result of the global transition to green energy, the share of renewable energy sources such as solar and wind has increased significantly. Their intermittent and unpredictable nature poses challenges for frequency and voltage stability during large-scale grid integration, potentially leading to supply–demand imbalances. In this context, energy storage systems (ESSs) have become indispensable, providing frequency regulation, peak shaving, valley filling, and ancillary services to ensure the stable operation of power infrastructure. Securing critical control components within ESSs is therefore a crucial issue for national power security and critical infrastructure protection (CIP).

ESSs comprise four subsystems: battery modules, the battery management system (BMS), the power conversion system (PCS), and the energy management system (EMS) [1]. The PCS is responsible for bidirectional AC/DC conversion and power scheduling, while the EMS enables monitoring, control, and data acquisition functions. The BMS acts as the goalkeeper of the battery modules, directly measuring voltage, current, and temperature at the cell level, calculating state of charge and state of health, and executing balancing and exception protection from overcharge, over-discharge, and overheat cutoff.

Although BMSs and PCSs collaborate closely, they present different attack surfaces and protection priorities. PCS are exposed to risks from external networks and grid dispatch commands, whereas BMSs, typically located within the internal control network, face cybersecurity risks such as hijacking of internal communication protocols, such as controller area network (CAN) bus, Modbus, data spoofing, and malicious firmware replacement. A successful false data-injection (FDI) attack causes the BMS to transmit incorrect voltage or temperature data to the PCS or EMS, leading to erroneous charging/discharging decisions. Such breaches could damage battery modules, shorten their lifespan, or render them inoperable when grid support is required. Constructing end-to-end defense-in-depth for BMS devices is therefore critical.

To address power-side protection, the Bureau of Standards, Metrology, and Inspection (BSMI) announced the Technical Specification for Security Testing of Energy Storage and Power Conversion Systems in 2024 [2]. Through Voluntary Product Certification (VPC), stationary energy-storage equipment is being gradually incorporated into mandatory inspection, effective from 1 July 2027 [3]. The Cybersecurity Technical Specification for Power Conversion Systems in Energy Storage (2024 Edition) requires cybersecurity capabilities for PCS with capacities exceeding 20–100 kW. However, no equivalent cybersecurity requirements currently exist for BMS devices, leaving a significant regulatory gap.

This research aims to bridge that gap through a dual-track methodology. First, in the methodology, the architecture of the domestic PCS cybersecurity specification is adopted as a baseline, ensuring policy continuity and minimizing industry impact. Second, we conduct a comparative analysis of international Industrial Automation and Control System (IACS) cybersecurity standards, the International Electrotechnical Commission (IEC) 62443 series (Chinese National Standards 62443-4-2), National Institute of Standards and Technology Special Publication 800-82 Revision 3, and National Institute of Standards and Technology Interagency Report 7628: Guidelines for Smart Grid Cybersecurity 7628. On the basis of gap analysis and threat modeling, a tailored set of cybersecurity requirements for BMS devices is established. These requirements are specific, measurable, and incorporate security leveling. The result fills the gap in cybersecurity standards for underlying control components in domestic ESS, providing actionable technical guidelines for original equipment manufacturers (OEMs), system integrators (SIs), and testing laboratories, serving as a technical reference for authorities in developing future BMS cybersecurity standards and verification methodologies.

2. Literature Review

Comparing international standards and domestic regulations helps to establish BMS cybersecurity requirements that align with global frameworks and existing domestic inspection systems. This study benchmarks core standards spanning general industrial control systems and smart grid applications.

BSMI announced the Technical Specification for Security Testing of Energy Storage and Power Conversion System (2024 Edition) [2] to standardize domestic energy storage cybersecurity policies. This specification divides technical requirements into five dimensions: physical protection; identification, authentication, and authorization security; data storage security; data transmission security; and system security. This structure covers the hardware, data flows, and system operations. Appendix D of Ref. [2] outlines inspection methods for third-party laboratories. Although PCSs and BMSs have different communication interfaces and control targets, both function as critical control components of ESSs. Therefore, we adopt these five dimensions and integrate international frameworks to construct specific BMS requirements.

IEC and the International Society of Automation developed the IEC 62443 series, Security for Industrial Automation and Control Systems, which governs operational technology environments. Chinese National Standards 62443-4-2 harmonize the specific component standard, IEC 62443-4-2 [4,5]. The standard classifies industrial components as software applications, embedded devices, host devices, or network devices. Because a BMS interacts with physical systems, runs a real-time operating system, and operates with limited computational resources, it qualifies as an embedded device. This standard enforces seven Foundational Requirements (FRs):

• FR 1 (identification and authentication control): authenticates users and software processes (CR 1.1, CR 1.2) using password strength metrics, Public Key Infrastructure, and untrusted network access controls;
• FR 2 (use control): enforces least privilege and role-based authorization to restrict parameter modifications;
• FR 3 (system integrity): prevents malicious tampering. For embedded devices, Embedded Device Requirements (EDRs) 3.10 and 3.11 mandate secure update verification and physical tampering detection;
• FR 4 (data confidentiality): mandates cryptographic algorithms to protect data at rest and in transit (CR 4.1, CR 4.3);
• FR 5 (restricted data flow): requires network segmentation to block lateral traffic movement in the OT network;
• FR 6 (timely response to events): generates and protects audit logs (CR 2.8, CR 2.9) for incident forensics;
• FR 7 (resource availability): ensures deterministic output and preserves a degraded operational mode during denial of service attacks.

NIST IR 7628, the Guidelines for Smart Grid Cybersecurity, outline a security framework for interconnected power systems where ESS units act as critical nodes [6]. The guide divides requirements into governance, risk, and compliance; general technical requirements; and domain-specific technical requirements. It assigns low, medium, or high impact levels to logical interfaces across confidentiality, integrity, and availability. When this methodology is followed, BMS control logic interfaces carry a high impact level for integrity and availability because BMS battery data and control commands directly dictate grid stability. The guide’s provisions for Access Control (SG.AC), Audit and Accountability (SG.AU), Configuration Management (SG.CM), and System and Communication Protection (SG.SC) translate general security principles into grid-specific practices.

NIST SP 800-82, the Guide to Operational Technology Security, covers industrial control systems, building automation, and transportation [7]. The guide separates IT security priorities from OT environments; IT focuses on confidentiality, whereas OT prioritizes safety and system availability. To protect these systems, NIST SP 800-82 details an in-depth defense architecture that layers physical, network, hardware, and software security. This study incorporates these OT constraints, such as real-time performance requirements, legacy equipment limitations, and fault-tolerance mechanisms, to ensure that the proposed specifications protect critical BMS control functions without interrupting availability.

3. Cybersecurity Requirements for BMS in Energy Storage Systems

Synthesizing the aforementioned domestic regulations and standard alignment, cybersecurity requirements for BMS in ESS are identified. BMS receives commands from the EMS and provides appropriate responses based on these instructions to manage the storage batteries. Figure 1 shows the scope of technical testing, covering both BMS with and without TCP/IP network communication capabilities.

Figure 1. Scope of technical testing for BMS.

We define five cybersecurity dimensions for BMS: (1) physical protection security, (2) identification and authentication security, (3) data storage security, (4) data transmission security, and (5) system security. The objectives of these cybersecurity dimensions are described as follows:

• Physical protection security: The physical enclosure of BMS shall possess fundamental defensive capabilities. For instance, the system implements barriers against enclosure removal and disables unnecessary physical ports to reduce the risk of attackers infiltrating the operating system or tampering with data using physical interfaces;
• Identification and authentication security: The BMS must uniquely identify and authenticate users, incorporating credential management mechanisms to prevent unauthorized access to sensitive data or privilege escalation;
• Data storage security: BMS must employ approved cryptographic techniques and key management mechanisms to protect sensitive data at rest;
• Data transmission security: BMS must establish secure network communications to protect sensitive data in transit from unauthorized access;
• System security: The system must minimize exploitable operating system vulnerabilities and ensure integrity through network port minimization, secure logging, and automated security updates.

Table 1 shows the alignment between core BMS cybersecurity requirements and international standards. Each dimension delineates its protection objective and specific technical requirements, mapping them precisely to the corresponding international standard clauses to ensure the credibility and traceability of this framework.

Table 1. Mapping of BMS cybersecurity requirements to international standards.

Dimension	Item Number	Cybersecurity Technical Requirements	IEC 62443-4-2	NISTIR 7628	NIST SP 800-82
Physical protection	6.1.1.1	Removal or disabling of unnecessary physical communication interfaces and serial ports	CR 7.7	SG.CM-7	6.2.11 (Rev. 2)
	6.1.2.1	Mandatory authentication prior to physical interface access	CR 1.1	-	6.2.7 (Rev. 2)
	6.1.2.2	Physical tampering detection and alerting mechanisms	EDR 3.11	6.5.1.6	-
Identification and authentication	6.2.1.1	Ensuring unique identification for users, processes, and devices	CR 1.2	SG.IA-2	-
	6.2.2.1	Implementation of Role-Based Access Control (RBAC)	CR 1.7	SG.AC-21	6.2.7.1 (Rev. 2)
	6.2.2.2	Enforcement of high-strength authenticator management (e.g., password complexity)	CR 1.5	-	-
	6.2.2.3	Forced change and management mechanism for factory default credentials	CR 1.5	SG.CM-10	-
Data storage	6.3.1.1	Encryption protection for sensitive data at rest (e.g., credentials)	CR 4.1	-	6.2.16.1 (Rev. 2)
	6.3.1.2	Integrity protection and verification for data in non-volatile memory	CR 4.3	4.1.2.2	6.2.16.1 (Rev. 2)
	6.3.2.1	Sensitive data shall be protected using individual keys to ensure key uniqueness		4.1.2.3	-
	6.3.2.2	Secure generation, storage, and lifecycle management of cryptographic keys	CR 4.3	SG.SC-11	6.2.16.1 (Rev. 2)
Data transmission	6.4.1.1	Encryption and confidentiality protection for network communication packets	CR 4.1	-	6.2.16.1 (Rev. 2)
	6.4.1.2	Integrity protection and mechanisms against replay attack for data in transit	CR 4.3	SG.SC-12	6.2.16.1 (Rev. 2)
	6.4.2.1	Access restrictions and source verification for connections across network boundaries.	NDR 1.13	SG.SC-10	-
	6.4.2.2	Must allow the configuration of whitelists, accepting connection requests only from specific entities.		SG.SC-10	-
System security	6.5.1.1	Automated generation of security audit logs (including timestamps and identity).	CR 2.8	SG.AU-3	6.2.3 (Rev. 2)
	6.5.1.2	Audit log storage space management and mechanisms to prevent exhaustion by overwriting.	CR 2.9	SG.AU-4	-
	6.5.1.3	Support for exporting security logs to a remote, centralized log server.	CR 6.2	SG.IR-7	6.2.8 (Rev. 2)
	6.5.2.1	Error handling and fault-tolerance mechanisms for abnormal inputs or attacks.	CR 7.7	SG.RA-6	-
	6.5.2.2	Open necessary network communication ports.		SG.CM-7	-
	6.5.3.1	Must support online or manual soft/firmware update functionality.		SG.SA-7	-
	6.5.3.2	Support for device configuration and data backup, and mechanisms for rapid recovery and restoration.	CR 7.4	SG.CP-10	-
	6.5.3.3	Integrity and authenticity verification prior to soft/firmware updates.	EDR 3.10	SG.SA-7	-
	6.5.3.4	Support online soft/firmware updates. Secure channels shall be established between update servers, complying with specified secure channel versions and cipher suites.	EDR 3.10	-	-

4. BMS Cybersecurity Leveling

The IEC 62443-4-2 Security Level framework categorizes protection intensity across multiple tiers. ESSs have diverse applications, including residential storage, commercial behind-the-meter backup power, and megawatt-scale, front-of-the-meter grid sites. Because threats and compromise impacts vary across these environments, domestic power conversion system cybersecurity standards define three distinct security tiers. We categorize BMS security requirements into Level 1 and Level 2 based on risk impact and technical implementation complexity. Level 1 mitigates unintentional operational errors, low-maturity threats, or deliberate attacks by actors with limited resources, and Level 2 mitigates sophisticated, deliberate attacks by adversaries with sufficient resources.

Table 2 presents the corresponding technical specifications and requirements across these levels. However, info-security requires continuous risk management; compliance with these specifications does not guarantee complete immunity to malicious attacks.

Table 2. Summary of information security dimensions and requirements.

Security Dimension	Requirement	Item Number	Cybersecurity Level
			Level 1	Level 2
6.1. Physical protection security	6.1.1. Physical Interface Minimization Requirements	6.1.1.1	V	V
	6.1.2. Physical Access Control	6.1.2.1	V	V
		6.1.2.2		V
6.2. Identification and authentication security	6.2.1. Device Identification	6.2.1.1		V
	6.2.2. Password Management	6.2.2.1	V	V
		6.2.2.2		V
		6.2.2.3	V	V
6.3. Data storage security	6.3.1. Confidentiality Protection of Sensitive Data	6.3.1.1	V	V
		6.3.1.2		V
	6.3.2. Key Management	6.3.2.1		V
		6.3.2.2		V
6.4. Data transmission security	6.4.1. Protection of Sensitive Data Transmission	6.4.1.1	V	V
		6.4.1.2		V
	6.4.2. Trusted Network Connections	6.4.2.1	V	V
		6.4.2.2		V
6.5. System security	6.5.1. Security Log Management	6.5.1.1	V	V
		6.5.1.2		V
		6.5.1.3		V
	6.5.2. System Security Assessment and Hardening	6.5.2.1	V	V
		6.5.2.2	V	V
	6.5.3. Updating System Security	6.5.3.1	V	V
		6.5.3.2	V	V
		6.5.3.3	V	V
		6.5.3.4		V

5. Conclusions and Future Works

ESSs stabilize renewable energy grid integration, directly supporting national green energy transitions and power grid stability. Although international and domestic cybersecurity standards primarily secure PCS and Energy EMS due to their external communication capabilities, they do not include BMSs, which govern underlying battery layers and physical safety limits. Through a dual-track analytical method, we map international industrial-grade grid security standards onto the five existing dimensions of domestic regulatory protection. The resulting cybersecurity requirements for BMSs in ESSs provide a security implementation pathway that aligns with global standards while ensuring local operational feasibility. The framework can be used to formulate national cybersecurity inspection standards specific to BMSs, strengthening the overall ESS cybersecurity infrastructure in Taiwan.