EU Subsidy Cybersecurity Requirements (CRA, ETSI EN 303 645) - OpenEMS Compliance?

English Forum
1

Guten Tag :slight_smile:

I’m wondering if OpenEMS (Edge) could be potentially used as the EMS qualified for a national subsidy program in Poland.
The EMS must officially comply with recent EU cybersecurity regulations.

Has anyone analyzed OpenEMS against these specific standards?

  1. CRA (Cyber Resilience Act)

  2. ETSI EN 303 645 (Consumer IoT security)

  3. NIS2 and RED-DA

Specifically, I am trying to figure out the dividing line between software and hardware/OS:

  1. Which of these requirements (e.g., no default passwords, secure updates, vulnerability reporting) are covered natively by the OpenEMS software architecture?

  2. Which ones fall entirely on the underlying hardware/OS (e.g., Debian on an IPC or Raspberry Pi, firewall rules, radio modules)?

Are there any official statements or community guidelines on deploying OpenEMS in compliance with these EU directives?

Thanks in advance!
Marcin

2

Hi Marcin,

unfortunately there is not yet an official statement on those EU directives, but several companies are selling OpenEMS based Energy Management Systems in the EU, so it should definitely be possible. It might be worth joining forces among the members of the OpenEMS Association.

Some notes on your questions:

  • no default passwords: depends on the actual device configuration in UserService
  • secure updates: OpenEMS itself does not provide production ready artefacts that can be directly updated. It’s usally handled in a private deployment system.
  • vulnerability reporting is available. See our Security Policy