As noted above, we will not require compliance with PAS 1878 in Phase One legislation, and as such chargepoints will not need to meet the cyber security characteristics set out in PAS 1878. However, the legislation will introduce requirements based on ETSI EN 303 645, a European cyber security standard, with which compliance was required in PAS 1878. EN 303 645 will not be mandated in full, but all key cyber and data requirements from the standard will be mandated where implementable within the limits of this legislation. Requirements will be enforced in line with the approach set out later in this response.
EN 303 645 outlines an outcome-based set of requirements for consumer Internet of Things (IoT) devices, with the UK government contributing significantly to its development. This EN sets an appropriate level of basic cyber security and data privacy requirements for smart chargepoints. While the Department for Culture, Media and Sport (DCMS) has consulted on mandating that IoT devices comply with security requirements aligned with three of the provisions in EN 303 645 3 , smart chargepoints pose additional cyber security risks which warrant more extensive mitigation than other IoT devices.
Government will therefore mandate requirements that go further than the current intended scope of the DCMS legislation, in line with EN 303 645. As noted in the smart charging consultation, cyber-attacks on smart chargepoints, such as the hacking of devices, their control systems or the communications between them, have the potential to threaten the stability of the electricity system. Additional requirements on the entities and systems involved in EV smart charging will therefore be vital to deliver the level of cyber security needed to appropriately mitigate these risks.
A long-term, comprehensive approach to cyber security will be brought forward as part of Phase Two legislation (see chapter 3). Interoperability In the consultation, Government proposed that smart chargepoints should be capable of retaining smart functionality if the chargepoint operator were to be changed, without requiring a visit to the premises, termed smart interoperability. The consultation also noted Government’s concern that consumers could face barriers to switching energy supplier due to a lack of interoperability of their smart chargepoint, for example as a result of the bundling of chargepoints with supply contracts.
Many respondents agreed with the proposed requirement of chargepoint operator interoperability, with many suggesting it is important to ensure a positive consumer experience. Some respondents suggested caution in implementing the proposal, warning that, though interoperability was desirable, it would be hard to implement, and would add costs to the chargepoint in the short term. Supplier interoperability generally received more support than chargepoint operator interoperability. In 2021 legislation, the Government will not include a requirement for chargepoints to be capable of retaining smart functionality in the event that the chargepoint operator were to be changed.
Smart service offerings remain nascent, and Government intends to gather more evidence on this issue before proceeding with any intervention. 3 An initial consultation was published in May 2019 , and was followed by a call for views in July 2020 . The Government’s response was published in April 2021 . The three requirements proposed were: Banning universal default passwords Implementing a means to manage reports of vulnerabilities Providing transparency on for how long, at a minimum, the product will receive security updates 15