Based on the research work of Dr. iur. Dr. rer. pol. Fabian M. A. Teichmann

The energy transition is decentralizing power generation: instead of a few large power plants, tens of thousands of wind turbines, solar systems, and storage systems now feed into the grids – each of them digitally controlled, networked, and remotely maintainable. What makes the energy supply more flexible also creates an enormous new attack surface. A coordinated cyberattack on networked renewable energy installations could destabilize grids and, in extreme cases, trigger blackouts. Teichmann has analyzed the specific cyber risks and obligations under NIS-2 (Teichmann, Cyberangriffe auf Erneuerbare-Energien-Anlagen – Risikoanalyse und Regulierungsoptionen, REE 2025, pp. 143–150; ibid., NIS-2 in der Energiewirtschaft: Pflichten und Haftungsregime für KRITIS-Betreiber, EnWZ 2025, pp. 248–253).

The New Attack Surface of the Energy Transition

Renewable energies differ fundamentally from classic, centralized power generation. Teichmann identifies several specific risk factors: the sheer number of attack points, as every single installation is a potential gateway; the often inadequate security of the control technology used; the remote maintenance access points indispensable for economic operation, which, however, also open doors for attackers; and aggregation, through which many decentralized systems are bundled via central control systems – anyone who compromises this central system can potentially manipulate thousands of systems simultaneously (Teichmann, REE 2025, pp. 143–150).

The Nightmare Scenario: Coordinated Attack on the Grid

The most serious risk is a coordinated attack that simultaneously manipulates many renewable energy installations. Since these systems account for a growing share of power generation, such an attack could jeopardize grid stability. If a large amount of fed-in power suddenly drops off or fluctuates uncontrollably, frequency deviations and, in the worst-case scenario, widespread blackouts threaten. This scenario is not a theoretical thought experiment – with the increasing share of renewable energies, the systemic importance of their cybersecurity also grows (Teichmann, REE 2025, pp. 143–150).

NIS-2: Expanded Scope for the Energy Sector

NIS-2 has significantly expanded the scope of application in the energy sector. Energy service providers with 50 or more employees or 10 million euros in annual turnover are considered important entities, while larger companies with 250 or more employees are classified as essential entities. This brings numerous previously unregulated actors under the scope of NIS-2. The BSI expects a total of around 29,000 newly obligated entities in Germany. Even smaller operators below the size thresholds can be indirectly affected – via supply chain requirements (Teichmann, EnWZ 2025, pp. 248–253).

The Concrete Obligations

Energy companies falling under NIS-2 must implement comprehensive cyber risk management. Particularly relevant is the protection of operational technology (OT security): instead of just IT, energy companies must also adequately protect their system controls – a distinct technical challenge. Furthermore, NIS-2 requires that cybersecurity risks at suppliers and service providers are systematically assessed. This forces contractual cyber due diligence: when purchasing control technology, partners must be bound to minimum standards. For the heavily supplier-dependent renewable energy sector, this is a significant new obligation (Teichmann, EnWZ 2025, pp. 248–253).

The Liability Regime: Personal Responsibility of Executive Management

For the first time, NIS-2 places personal responsibility on the executive management of energy companies. Board members and managing directors must actively approve and monitor cybersecurity measures and undergo training. Inadequate implementation could lead to fines of up to 10 million euros or two percent of global annual turnover, as well as the personal liability of the governing bodies. Teichmann speaks of a paradigm shift: in the energy sector, cybersecurity is turning from a technical task into an executive responsibility with personal consequences (Teichmann, EnWZ 2025, pp. 248–253).

What Renewable Energy Operators Should Do Now

First, the applicability assessment: does the company fall under NIS-2, and if not – is it indirectly affected via supply chain requirements? Next, the protection of operational technology: OT systems must be separated from general IT and specially secured. Remote maintenance access must be strictly controlled, authenticated, and logged. The supply chain must be secured. Reporting processes and emergency plans must be established, the executive management must be trained, and the entire compliance must be documented (Teichmann, EnWZ 2025, pp. 248–253).

Conclusion: Cybersecurity as a Prerequisite for the Energy Transition

The energy transition and cybersecurity are shifting hand in hand. A decentralized, digitized energy supply is only viable for the future if its digital infrastructure is secure. The networked renewable energy installations that form the backbone of the future energy supply are simultaneously one of its greatest vulnerabilities. Those who invest in the cybersecurity of their installations are not only protecting their own business but are also contributing to the stability of the entire energy system.

All citations refer to published scientific papers by Dr. iur. Dr. rer. pol. Fabian M. A. Teichmann. The complete bibliography is documented in the publication index (as of May 2026).