by Dominic Crudden, Practice Lead – Renewables, EMR Integrated Solutions
I’ve just come back from two back to back conferences, Solar Ireland and Intersolar Europe, and one theme ran through nearly every conversation I had. Cybersecurity and compliance are no longer background noise for solar asset owners and O&Ms. They’re top of the agenda, and companies want to talk about it.
“Cybersecurity and compliance are no longer background noise for solar asset owners and O&Ms. They’re top the agenda.”
What struck me most during the four days was the shift in understanding.
A couple of years ago, a lot of conversations at these events were introductory. This time, most of the people I spoke to already knew they needed to act. Some had already started their compliance journey; others knew it was coming and were figuring out where to begin.
The clearest pattern was around scale. Companies managing larger portfolios, more than 20 assets in some cases, had already tasked someone internally with governance and compliance. Smaller operators were further behind, but the direction of travel was the same for everyone.
One conversation in particular stuck with me.
A company was standing exactly where one of our existing clients stood a couple of years back, asking the same questions, facing the same early decisions. That’s valuable for them, because we’re not guessing at what comes next, we already know where the pitfalls sit and roughly how long each stage takes.
A company was standing exactly where one of our existing clients stood a couple of years back, asking the same questions, facing the same early decisions. That’s valuable for them, because we’re not guessing at what comes next, we already know where the pitfalls sit and roughly how long each stage takes.
The trigger for all of this of course is NIS2, the EU directive that raises the bar on cybersecurity risk management and incident reporting for operators of critical infrastructure.
It’s worth being clear about where the pressure originates. It’s mostly driven from the top down. Boards and management are acutely aware of the personal liability attached to non-compliance, including fines and, in some cases, suspension of board members.
“Boards and management are acutely aware of the personal liability attached to non-compliance.”
That pressure then flows down the chain. Asset owners push their legal or compliance teams to get organised, and those teams push it further down to the O&Ms managing individual sites, asking a straightforward question: have you got this in place, and if not, what’s the plan?”
NIS2 has now been transposed into national law in 23 of the 27 EU member states. Ireland, along with Spain, France and the Netherlands, is still working through the draft stage. The UK’s equivalent, the Cyber Security and Resilience Bill, looks broadly similar in scope and, in some areas, slightly more stringent.
Remote access is where the real technical risk sits. Every site needs it. O&M teams, monitoring providers and CCTV operators all need to access to on-site devices. The problem isn’t the need for access, it’s how loosely that access has historically been controlled.
A good example is something we’ve seen repeatedly, particularly on older wind sites but also on solar too. Devices on site, a router, a firewall, a CCTV unit, are exposed to the internet with no central oversight of who holds access to them. People move on from companies and contractors change, and nobody is entirely sure who still has a way in.
“The problem isn’t the need for access, it’s how loosely that access has historically been controlled.”
That’s the gap. There’s no single front door, so there’s no way of knowing whether every door into the site is properly locked.
Instead of scattered public IP addresses and ad hoc VPNs, everything on site, SCADA, CCTV, remote monitoring, routes through one secure, centralised point of access. Only the right people get through, and the asset owner has a clear, consistent view of how every site across the solar or wind farm estate is being accessed.
UniCAS comes in a few configurations depending on the site.
The standard version provides high availability communications over a cellular connection alongside secure access in one product. UniCAS + adds a second, redundant bearer, such as satellite, microwave radio or fibre, for sites that need that extra resilience. For smaller or older sites that need a cost effective way to get reliable connectivity and access control back in place, we also deploy a lighter version built around the modem itself.
High availability cellular comms with secure access, in one product.
Adds a second, redundant bearer for sites needing extra resilience.
Cost effective connectivity and access control built around the modem.
Deploying secure access on site is one piece of a much bigger picture. NIS2 compliance touches the whole organisation, not just the technology sitting on a solar or wind farm somewhere, and that’s where a lot of vendors run out of road.
We’ve been working in operational telecoms across utilities for more than 45 years, and in renewables specifically for over a decade. That means we understand what actually matters to asset managers and O&M companies, not just from a compliance checklist, but from having worked on and maintained the underlying infrastructure.
Our in-house team includes telecommunications engineers, SCADA engineers and cybersecurity specialists, and we’ve deployed solutions across hundreds of sites in multiple jurisdictions.
“We’re not an IT company that turns up to install a box. We understand how SCADA works, how utilities operate, and what happens when the two meet.”
Beyond the site level, we also support organisations working towards full NIS2 compliance, including penetration testing and SOC services.
Years of OT and infrastructure experience
EU states with NIS2 transposed into law
Centralised front door with UniCAS
We’re not an IT company that turns up to install a box. We understand how SCADA works, how utilities operate, and what happens when the two meet, and that depth is what separates a proper compliance partner from a cyber security vendor selling a single product.
Looking ahead 12 to 18 months, I expect things to get busier rather than quieter. Several countries are still rolling out significant volumes of new solar and wind farms, and the wider energy independence conversation across Europe is only adding to that momentum.
More sites means more connections that need securing.
The requirements are also becoming more layered. New sites are increasingly specifying redundancy and high availability from day one, rather than adding it later once something goes wrong. A few years ago, that level of resilience was reserved for the largest, highest value assets. Now smaller developments are asking for it upfront too, because the cost of downtime or a security incident has become too significant to ignore.
For asset owners, that means the compliance and security conversation isn’t something to tick off once and forget. It’s an ongoing part of how a site is specified, built and operated, and the organisations treating it that way from the outset tend to move through the process with far fewer surprises.
If there’s one thing I’d tell an asset owner or investor just starting this journey, it’s to start now rather than later. Full organisational compliance takes time and has more pitfalls than people expect, so the earlier you begin, the more room you have to do it properly.
Deploying something like UniCAS across an estate can happen relatively quickly and gives you an immediate, tangible improvement in how sites are secured. The wider organisational work takes longer, and that’s where it pays to bring in help early rather than trying to work it out as you go.
When you’re choosing a partner for that journey, look for genuine experience in utilities and operational telecoms, not just cyber security in the abstract. You want someone who understands the environment well enough to advise and to deploy, so you’re not managing five different suppliers to get one job done properly.
“The earlier you begin, the more room you have to do it properly.”
NIS2 has moved cybersecurity from an afterthought to a board level priority for solar and wind asset owners, with real financial and personal liability attached to falling short. The biggest gap sits in remote access, where legacy setups leave sites exposed with no central oversight of who still has a way in. Closing that gap needs more than a single product, it needs a partner who understands SCADA and utility operations as well as security, which is exactly where EMR’s 45 years in operational telecoms and UniCAS come in.
Dominic Crudden leads on complete telecommunications and cybersecurity solutions across the renewable energy sector as Practice Lead – Renewables. His technical background coupled with commercial acumen spans the full journey from hands-on engineering to strategic client delivery, giving him a practical understanding of what asset owners and O&Ms actually need on site, not just what compliance frameworks ask for on paper.
