EU Subsidy Cybersecurity Requirements (CRA, ETSI EN 303 645) - OpenEMS Compliance?

English Forum
1

Guten Tag :slight_smile:

I’m wondering if OpenEMS (Edge) could be potentially used as the EMS qualified for a national subsidy program in Poland.
The EMS must officially comply with recent EU cybersecurity regulations.

Has anyone analyzed OpenEMS against these specific standards?

  1. CRA (Cyber Resilience Act)

  2. ETSI EN 303 645 (Consumer IoT security)

  3. NIS2 and RED-DA

Specifically, I am trying to figure out the dividing line between software and hardware/OS:

  1. Which of these requirements (e.g., no default passwords, secure updates, vulnerability reporting) are covered natively by the OpenEMS software architecture?

  2. Which ones fall entirely on the underlying hardware/OS (e.g., Debian on an IPC or Raspberry Pi, firewall rules, radio modules)?

Are there any official statements or community guidelines on deploying OpenEMS in compliance with these EU directives?

Thanks in advance!
Marcin

2

Hi Marcin,

unfortunately there is not yet an official statement on those EU directives, but several companies are selling OpenEMS based Energy Management Systems in the EU, so it should definitely be possible. It might be worth joining forces among the members of the OpenEMS Association.

Some notes on your questions:

  • no default passwords: depends on the actual device configuration in UserService
  • secure updates: OpenEMS itself does not provide production ready artefacts that can be directly updated. It’s usally handled in a private deployment system.
  • vulnerability reporting is available. See our Security Policy
3

As far as I understand CRA, and related norms, it is less about what project does, and more about default configuration, procedures and maintenance done by publisher/manufacturer of the system.

Given that openems is software, hardware part remains sole responsibility of system builder who decides which platform will be used for final product assembly. As most of systems will be some flavor of linux, whole thing becomes a regular security hardening of distribution used to run applications, including openems.

Cheers,
Łukasz

4

Thank you Stefan, Lukasz - makes sense! Marcin