Energy Utilities & Municipal Providers · EnWG § 5c · KRITIS · NIS2

Grids that can't go dark need more than a firewall

As a network operator, you fall under Section 5c EnWG (Section 11 (1a) until December 2025): certification against the German Federal Network Agency's IT-Sicherheitskatalog has been mandatory since January 31, 2018, with recertification every three years. Larger installations additionally fall under the KRITIS regulation, on top of NIS2. We test where the real risk sits for utilities: OT and remote control systems alongside conventional IT, unmanned substations, and customer-facing portals with wide reach.

Get your energy IT assessed See the three crossings
  • Documentation suited for the IT-Sicherheitskatalog
  • Experience with OT/SCADA & remote control systems
  • Free initial consultation

Attack surface: energy sector

Two worlds, row by row

Utilities combine conventional IT with operational technology spread physically across an entire grid area, often at sites without permanent staff. Each track has its own entry points, and at three spots they sit right next to each other.

ITAdministration & customer interfaces

Facing

OTGrid operations & installations

Remote maintenance access

VPN and vendor access points connect the office network to control technology. Without multi-factor authentication and segmentation, they're the bridge from IT into OT.

Access

Substations & unmanned installations

Many substations and secondary sites run entirely unmanned. Access control and physical hardening directly define the attack surface there.

Administrative IT

Office network, email, billing. An attack here can quickly spread to the entire operation, not just administration.

Core

Control rooms & data centers

Central control and data processing come together here, a high-value target that's often thinly staffed outside core hours.

Customer portals

Portals for contracts, meter readings and billing are publicly reachable and therefore a direct entry point from outside.

Free security check for your customer portal

Reach

SCADA & remote control systems

Control systems and remote control technology run decentralized grid operations. Legacy protocols and missing segmentation from IT are the typical weak points here.

Each row holds the same job on both sides. It gets done under different rules: administration cares that data stays confidential, grid operations that nothing comes to a halt.

The core of the assessment

Three crossings where the two worlds touch

An attacker doesn't need direct access to control technology to end up there. They need a foothold in office IT and a connection that leads on from it. Almost every grid area has three such connections, and they aren't there by accident: without them the grid couldn't be operated.

Office IT Control technology Priority: confidentiality of data Priority: availability of supply Crossings from outside 1 2 3 Customer portal Office network Remote maintenance Control room Data center SCADA Substation unmanned Substation unmanned Route from outside

The schematic walks through the three crossings by itself. One click stops it.

  1. 01

    Remote maintenance

    Access

    Why it exists

    Vendors and service providers need access to components spread across half the grid area. Without it, every fault report would mean sending someone out.

    How it becomes a route

    That access doesn't stop at the office network, it reaches into control technology. Without multi-factor authentication and segmentation, a stolen provider password takes exactly the same route.

    What we check there

    We look at who uses these access paths, how they authenticate, how far into the network they reach, and whether their use is logged in a way you can follow afterwards.

    Infrastructure Pentest
  2. 02

    Control room and office under one roof

    Core

    Why it exists

    Control, data storage and administration share a site, often the same part of the building. That saves space, staff and travel.

    How it becomes a route

    An attack on administrative IT then doesn't stay in administration. Outside core hours the site is thinly staffed, and whoever gets in stands next to both.

    What we check there

    We check access on site and in the network: doors, access control and visitor handling, along with rights, separation and hardening of the central systems.

    Physical Pentest
  3. 03

    Segmentation towards remote control systems

    Reach

    Why it exists

    Control systems and remote control technology report readings back and accept commands. To do that they have to be reachable, including from the control site.

    How it becomes a route

    The protocols commonly used for this come from a time when nobody expected an attacker on the same network. Whoever stands there is never asked who they are.

    What we check there

    We passively observe which protocols are in use and which paths between IT and OT are genuinely open. Anything active happens only where you have cleared it beforehand.

    OT/ICS Pentest

All three crossings belong in scope, even though no network diagram lists them as crossings. They are tested least often, because they sit between two areas of responsibility.

IT vs. OT

Why IT concepts don't carry over to OT

A complete picture of your attack surface only emerges once IT and OT security are assessed together. Both follow different priorities, and that gap between them is exactly what gets tested least in practice.

IT vs. OT ITConventional IT OTOT/SCADA & remote control systems
Priority Confidentiality of data Availability of supply
Patches Patches can usually be rolled out promptly Patches often untouched for years (certification, vendor support)
Protocols Standard protocols (TCP/IP, HTTPS) Proprietary and legacy protocols with no built-in security
Maintenance windows Short maintenance windows are feasible Maintenance only in tightly planned windows, downtime is not an option

An assessment that just applies IT concepts to OT misses the real risks. Our tests account for both worlds and their very different tolerances.

This table also explains why a crossing stays open for so long. A gap in the office network can often be closed the same day. The same gap on a control system waits for the next maintenance window, sometimes for the vendor's next release approval.

Section 5c EnWG

The 3-year cycle behind the IT-Sicherheitskatalog

Since January 31, 2018, operators of electricity and gas supply networks have had to certify their IT security against the Federal Network Agency's IT-Sicherheitskatalog. Section 5c EnWG additionally covers operators of energy installations that are particularly important or important entities under Section 28 BSIG. Until a new catalogue is issued, the existing IT-Sicherheitskataloge continue to apply. This isn't one-off evidence: operators have to be reassessed on a recurring basis.

Audit rhythm 3 years until the next certification

  1. Since 2018-01-31

    Operators of electricity and gas networks have to be certified against the IT-Sicherheitskatalog.

  2. Every 3 years

    The catalogue requires reassessment. A pentest beforehand finds the gaps before the auditor does.

  3. Section 5c EnWG · KRITIS · NIS2

    Installations above the KRITIS threshold count as particularly important entities under section 28 BSIG. Their duties still come from the IT-Sicherheitskatalog under Section 5c EnWG; section 28(5) BSIG exempts them from the core BSIG duties (including sections 30, 31, 32 and 39).

Every 3 years. The IT-Sicherheitskatalog explicitly requires regular recertification, not a one-off exercise. If you can't keep the evidence current, you risk regulatory consequences from the Federal Network Agency.

The same evidence, two different jobs

IT

In administrative IT, the evidence is a question of configuration and documentation. Much of it can still be straightened out shortly before the audit.

OT

In control technology, the same evidence hangs on devices that have been running for years and won't be restarted for an audit date. Look at it only in the audit year and there is no time left to react.

Larger installations, such as power plants at or above 104 MW, additionally fall under the KRITIS regulation and count as particularly important entities. Their obligations still run through the IT-Sicherheitskatalog under Section 5c EnWG; section 28(5) BSIG exempts them from the core BSIG duties (including sections 30, 31, 32 and 39).

Check your NIS2 status Continuous testing between two certifications

Timeline

Three incidents, three entry points

Two cyberattacks that crippled business operations via administrative IT, and one physical attack on cables. A utility's attack surface doesn't end at the network.

2023-08-24

Stadtwerke Neumünster

Cyberattack

Stadtwerke Neumünster reportedly shut down all systems as a precaution after detecting a cyberattack.

What was hitAdministrative IT

2025

Stadtwerke Schwerte

Cyberattack

At Stadtwerke Schwerte, the internal network and customer portal were reportedly taken offline; the stolen data is said to have later surfaced on the dark web.

What was hitInternal network and customer portal

01/2026

Lichterfelde power plant, Berlin

Physical, not a cyberattack

An arson attack on power cables near the Lichterfelde power plant reportedly affected around 45,000 households and 2,200 businesses. Not a cyberattack, but a reminder that physical security still matters alongside IT security.

What was hitPhysical infrastructure

Based on public reporting. Access Granted was not involved in these incidents.

How we work, on real engagements

Our approach

Two test tracks, one report

Supply reliability always comes first. That's why we test OT and remote control components noticeably more carefully than plain IT.

ITIT track

  1. 01

    Scoping & reconnaissance

    Customer portals, administrative IT and remote maintenance access go into scope. We gather information from public sources and scan the networks.

  2. 02

    Active testing

    We test manually against the agreed scope: authentication, access rights, segmentation from OT, and the hardening of your central systems.

  3. 03

    Rating

    We rate every finding by severity, exploitability and impact on supply reliability.

In the office network, active testing is routine. What we do there, an attacker does too, just without an agreement.

OTOT track

  1. 01

    Scoping with grid operations in mind

    Together we define which OT and control systems get actively tested and which are analyzed passively only.

  2. 02

    Passive analysis, agreed windows

    We analyze protocols and network traffic passively. Active tests run only in pre-agreed windows outside critical operating hours.

  3. 03

    Emergency contact & immediate stop

    A defined emergency contact accompanies every test. If grid operations or supply are affected unexpectedly, we stop immediately.

In control technology, every active step is decided case by case. The decision is made up front, and you can withdraw it at any time.

Both tracks come together

One final report, mapped to the IT-Sicherheitskatalog

Complete documentation with recommendations, a management summary for leadership, IT management and grid operations, and every finding mapped to the IT-Sicherheitskatalog.

Relevant modules

These tests bring your grid IT up to the state of the art

IT and OT can't be covered by a single test. For network operators, this is the combination we rely on.

  • 01

    Physical Pentest

    Simulated access attempts on substations, control rooms and data centers. Covers the physical attack surface that matters most at unmanned sites.

    Learn more
  • 02

    OT/ICS Pentest

    Targeted testing of SCADA, remote control systems and control technology, with particular care for supply availability.

    Learn more
  • 03

    Infrastructure Pentest

    Network segmentation between IT, OT and administration, access rights, and hardening of your central systems.

    Learn more
  • 04

    Web App Pentest

    Customer portals for contract data, meter readings and billing, tested from the position of an outside visitor and from that of a logged-in customer.

    Learn more

Which modules you need depends on what is actually connected at your end. In the first call we cut the combination to fit your grid area. What to look for when picking a provider

Frequently asked questions

Pentesting for energy utilities: your questions

01IT-Sicherheitskatalog & KRITIS

The Federal Network Agency's IT-Sicherheitskatalog doesn't name a specific test method, but it does require a certified information security management system and regular proof of adequate protective measures. In practice, a penetration test is the standard way to back that up technically and to find weaknesses before certification.

Certification against the Federal Network Agency's IT-Sicherheitskatalog runs on a recurring three-year cycle, mandatory for network operators since January 31, 2018. A regular pentest ahead of each recertification helps catch gaps early instead of during the audit itself.

The BSI-Kritisverordnung sets sector-specific thresholds, for example based on generation or supply capacity (power plants at or above 104 MW, for instance). Above that threshold your installation counts as a particularly important entity; for energy installations the duties still run through the IT-Sicherheitskatalog under Section 5c EnWG, as section 28(5) BSIG exempts them from the core BSIG duties (including sections 30, 31, 32 and 39). Not sure where you stand? We can work that out in a free initial consultation.

No. The IT-Sicherheitskatalog requires recurring recertification on a three-year cycle, not a one-time project. We recommend building the pentest permanently into your certification rhythm rather than scheduling it right before the next audit.

Having both sides tested on their own leaves the crossings between them open. That is exactly where testing happens least, because each side assumes the other is responsible. So we take both tracks into one engagement and one report, even when the contacts on your side are different people.

02OT & operations

OT systems prioritize availability over confidentiality, often run on legacy protocols with no built-in security, and don't tolerate aggressive scanning. We test more carefully there: usually passive analysis with tightly scoped active testing outside critical operating hours, always with a defined emergency contact.

Yes, as part of our Physical Pentest module. We check access control, fencing and gate security, and whether someone could convincingly pose as a maintenance technician and gain unnoticed access. Before we start, we agree who on your side is in the know and who can call the test off if needed.

Before every test we jointly define which systems get actively tested and which are only analyzed passively. For production OT and control systems, the rule is: test more cautiously or skip it if in doubt. A defined emergency contact and an immediate stop on any unexpected impact are a fixed part of every assessment at network operators.

It depends heavily on scope: number of sites, whether OT/SCADA is included, whether physical testing and customer portals are in scope. Once the free initial call has settled the scope, you get a fixed-price quote with no open items.

A final report with every finding, rated by severity, exploitability and impact on supply reliability, each one mapped to the IT-Sicherheitskatalog. Alongside it, a management summary for leadership, IT management and grid operations, plus a certificate naming the client, test period, scope and a reference code that can be verified online.

Your next recertification is already on the calendar.

In 30 minutes we'll talk through your scope and clarify what matters for the IT-Sicherheitskatalog and KRITIS. You'll walk away with a no-obligation, free quote.

Book your free consultation Get in touch

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

Networks & trust seals
Trust Seal of the IT Security Association Germany (TeleTrusT)
Participant in the Alliance for Cyber Security
© AccessGranted X GmbH Last updated: September 18, 2026