GOV.UK — Cyber security and data privacy

in Summer 2019, yet is still in a nascent stage. Government’s intention is therefore to mandate a minimum set of requirements in 2021 that support the early smart charging market and mitigate some potential risks where we have sufficient evidence to intervene. Given this change in approach, Government will not be requiring compliance with PAS 1878 in our 2021 smart charging legislation. However, we have ensured that our legislation is compatible with PAS 1878. As described in a later section of the consultation response (Chapter 3), mandating both PAS 1878 and 1879 will be considered as an option for Phase 2 legislation.

The BSI ESA programme work remains an important piece of work for Government, including for smart charging policy. The PAS standards are compatible with international smart grid standards and were developed to address gaps in the current standardisation landscape. Definition of a smart chargepoint The consultation proposed to define a smart chargepoint as one which is communications enabled and able to respond automatically to remote signals by adjusting the electricity consumption flowing through the chargepoint. Many respondents agreed with this definition, though some respondents proposed amendments to give greater clarity.

Government will define smart functionality within the legislation and require private chargepoints sold to include this functionality. Smart functionality will be described as the ability to: (a) send and receive information; and (b) respond to this information by; increasing or decreasing the rate of electricity flowing through the chargepoint; and changing the time at which electricity flows through the chargepoint. The above definition is in line with that included within the consultation but has been expanded to reflect feedback within consultation responses, and to more closely align with the definition of an Energy Smart Appliance in PAS 1878.

Government considers it important that all smart chargepoints are capable of supporting demand side response (DSR) services. We will therefore mandate a high- level outcome within the legislation, which states that smart chargepoints must be capable of supporting DSR. This is an initial step to help address the concern that a chargepoint could meet the above definition of smart functionality but be unable to support DSR services in practice. Cyber security and data privacy In the consultation, Government proposed that smart chargepoints should meet outcome-based security requirements as well as technical security characteristics set out in the BSI standard (PAS 1878).

We proposed that the cyber security standards should also address the protection of any data held by the devices and proposed a mandatory testing and assurance regime for these requirements. Many respondents agreed with this approach. 14