General Cybersecurity Statement by FENECON

As with any security or safety issue, there is no such thing as 100% protection; vulnerabilities and "weak points" can be hidden in any component. However, PV systems, battery inverters, and energy management systems are key components because they combine three unfavorable characteristics at the same time:

A standard battery storage system—consisting of a battery inverter, BMS, and battery modules—is structured as follows and typically uses the communication devices shown:

(1) BSI-compliant (Federal Office for Information Safety) communication and control via market communication, metering point operators, smart meter gateway infrastructure (SMGW), and the FNN control box:

(2) A permanent, bidirectional internet connection to the cloud of the inverter and/or BMS manufacturer:

(3) Manufacturer clouds are largely unregulated, without requirements such as KRITIS, ISO 27001, possibly NIS2, etc.

(4) Internal communication between components, not cloud-connected:

(5) Passive components such as battery cells/modules:

Depending on the intended use or system size, additional networked components may be required. For example, wallboxes and heat pumps in residential applications, hyperchargers in industrial settings, or cooling systems in outdoor battery storage systems. In such cases, there may be a similar risk of impact on the energy system if these devices are connected to unregulated manufacturer clouds.

Regulatory requirements for the cybersecurity of interconnected energy systems are increasing significantly across Europe. With regulations such as the NIS2 Directive, the Cyber Resilience Act (CRA), the Radio Equipment Directive (RED), IEC 62443, and ETSI EN 303 645, information security, secure software development, vulnerability management, and transparency throughout the entire product lifecycle are increasingly subject to mandatory regulations.

At the same time, topics such as digital sovereignty, resilient supply chains, and the management of critical components are becoming increasingly important. Heckert Solar welcomes uniform European standards that promote security, transparency, traceability, and fair competition, thereby strengthening confidence in the digital energy transition.

Connecting energy storage systems to the internet makes sense for many reasons. It enables active monitoring and supervision of the system even outside the local network. It also allows connection to external services—e. g. retrieving electricity prices—and facilitates quick service by the installer or manufacturer.

At the same time, it is precisely this internet connection that also creates vulnerabilities.

Cybersecurity by Design therefore means that an internet connection is always optional and that all functions must—as far as possible—work even without an internet connection: "Those who think offline also think defensively."

As a German company, we are subject to German liability law, German courts and German and European cybersecurity regulations (e. g. GDPR, NIS2, CRA)

In the event of a disaster, authorities have far-reaching access to companies — this reliability can only be practically implemented with German companies.

Buying from a German manufacturer like FENECON not only supports Germany as a business location with local added value, but also makes a direct contribution to internal and external safety and energy sovereignty.

Source code auditing is an essential component of the compliance assessment for operators of critical infrastructure (KRITIS) pursuant to Section  8 a of the BSI Act (BSIG).

FENECON takes this a step further: by developing OpenEMS—together with a global community—as the “open-source operating system for the energy transition,” we are making a significant commitment to continuously improve the safety of the software in use.

However, OpenEMS is not a monoculture; rather, it is designed so that various integrators can use it to build their own solutions. This leads to diversity among manufacturers, hardware, and operating models, and prevents the creation of a single point of failure or a central vulnerability.

"Isn’t open source insecure?"
Security vulnerabilities arise not from openness, but from a lack of testing.

As part of our growth and professionalization strategy, we are actively pursuing official certification of our processes and measures.

Information security is an integral part of FENECON’s corporate strategy. The goal is to continuously protect the availability, integrity, and confidentiality of information and to minimize risks to customers, partners, and the company.

Cybersecurity is not a static state, but an ongoing process that is fully integrated into the development processes at FENECON. Updates for FEMS are released regularly, typically every two weeks. When vulnerabilities are discovered, there are clear reporting chains—and organizational mechanisms in place to quickly allocate development resources to address them. FEMS is developed and operated by a dedicated in-house team of software developers and DevOps engineers in Germany. Further developments and bug fixes are fully traceable through company-wide task management and source code versioning, unique identification of release versions, and clear changelogs.
This ensures that identified security vulnerabilities are addressed promptly.