Energy utilities & municipal providers · EnWG § 5c · KRITIS · NIS2

Grids that can't go dark need more than a firewall.

Administrative IT and grid operations sit side by side. We test both sides and the crossing in between.

Documentation suited to the IT-Sicherheitskatalog
Experience with OT and SCADA
Free initial consultation

Section 5c EnWG

Not one-off evidence, but a cycle

Since 2018-01-31
Electricity and gas networks have to be certified against the IT-Sicherheitskatalog.
Every 3 years
The catalogue requires recertification. A pentest beforehand finds the gaps first.
Section 5c EnWG · KRITIS · NIS2
KRITIS installations (power plants from 104 MW): duties via the IT-Sicherheitskatalog.

Attack surface

One grid area, two tracks, three crossings

Amber marks the places where IT and OT sit against each other. That is where testing happens least often.

1
Customer portals
Contract data and meter readings, publicly reachable.
2
Administrative IT
Office network, email, billing. An attack spreads from here.
3
Remote maintenance access
VPN and vendor access points are the bridge from IT into OT.
4
Control room & data centre
Control and data storage, barely staffed at night.
5
SCADA & remote control systems
Legacy protocols without segmentation from IT.
6
Unmanned installations
No staff on site: fence, gate and access control decide.

Why IT concepts don't carry over to OT

The two worlds follow different priorities. An assessment that only applies IT concepts to OT misses the real risks.

	Conventional IT	OT, SCADA & remote control systems
Priority	Confidentiality of data	Availability of supply
Patches	Can usually be rolled out promptly	Often impossible to apply for years (certification, vendor support)
Protocols	Standard protocols (TCP/IP, HTTPS)	Proprietary and legacy protocols with no built-in security
Maintenance windows	Short maintenance windows are feasible	Only in tightly planned windows, downtime is not an option

Timeline

Three incidents, three entry points

2023-08-24

Stadtwerke Neumünster

Cyberattack

According to media reports, all systems were shut down after a cyberattack.

2025

Stadtwerke Schwerte

Cyberattack

The internal network and customer portal went offline; according to reports, the data later surfaced on the dark web.

01/2026

Lichterfelde power plant, Berlin

Physical, not a cyberattack

According to reports, an arson attack on power cables affected around 45,000 households.

Based on public reporting. Access Granted was not involved in these incidents.

Our approach

Two test tracks, one report

Supply reliability always comes first. That is why we test OT and remote control components noticeably more carefully than plain IT.

IT track

Scoping & reconnaissance

Customer portals, administrative IT and remote maintenance.

Active testing

Manual: authentication, access rights, segmentation, hardening.

Rating

Every finding by severity and impact on supply.

OT track

Scoping with grid operations

Defined together: what gets actively tested.

Passive analysis, fixed windows

We read protocols passively. Active tests only in agreed windows.

Emergency contact & hard stop

A fixed contact accompanies every test and can stop it immediately.

One final report, mapped to the IT-Sicherheitskatalog

Recommendations, a management summary and every finding mapped to the catalogue.

What you get at the end

Final report listing all findings, each rated by severity, exploitability and its impact on the reliability of supply
Every finding mapped to the IT-Sicherheitskatalog, supplemented by KRITIS and NIS2 as far as they are relevant to you
Management summary for leadership, IT management and grid operations
Certificate naming the client, test period, scope and a reference code, verifiable at access-granted.de/verify

Relevant modules

Physical Pentest

Access to substations, control rooms and data centres.

OT/ICS Pentest

SCADA, remote control technology and control systems, availability first.

Infrastructure Pentest

Segmentation of IT/OT/administration, access rights, hardening.

Frequently asked questions

Is a penetration test mandatory under section 5c EnWG?

The IT-Sicherheitskatalog does not name any particular test method explicitly, but it does require a certified information security management system and regular proof of adequate protective measures. In practice, a penetration test is the standard instrument for backing up this proof on the technical side.

What is different about OT and SCADA tests compared to a conventional IT pentest?

OT systems prioritise availability over confidentiality, often run on legacy protocols without any security mechanisms and do not tolerate aggressive scans. That is why we test far more carefully: mostly passively, actively only in tightly agreed windows outside critical operating hours, and always with a defined emergency contact.

Do you also physically test unmanned substations?

Yes, as part of the Physical Pentest module. We check access control, the security of fences and gates, and whether someone could convincingly pass themselves off as a maintenance technician and get in without being noticed. Who on your side is in the know, and who calls the test off if in doubt, we agree together beforehand.

Is a one-off pentest enough as evidence for the Federal Network Agency?

No. The IT-Sicherheitskatalog requires recurring recertification on a three-year cycle. We recommend building the pentest firmly into your certification rhythm instead of only kicking it off shortly before the next audit.

Your next recertification is bound to come.

In 30 minutes we clarify your scope and what counts for the IT-Sicherheitskatalog. Free of charge.

Read more online: access-granted.de/en/branchen/energy

Book an initial consultation Get in touch

hello@access-granted.de

+49 9281 5918506

Not one-off evidence, but a cycle

One grid area, two tracks, three crossings

Customer portals

Administrative IT

Remote maintenance access

Control room & data centre

SCADA & remote control systems

Unmanned installations