NIS2 does not mention charge points. It does not mention OCPP, back office platforms, or the SIM in the cabinet. It names outcomes, and leaves you to work out which network architecture produces them. That translation gap is where EV charging operators are currently stuck.
Your estate makes the gap wider. Chargers sit in public car parks, unattended, reachable by anyone with a screwdriver. Multiple hardware vendors need remote access to their own units. The units talk to a back office over cellular. And under NIS2, accountability for all of it sits at board level, personally.
NIS2 Article 21(2) asks for access control, network segmentation, incident detection, supply chain access control, audit trails and continuous authentication. For an EV charging estate, that translates into four architectural requirements: device identity issued before deployment, charger traffic that never crosses the public internet, per session policy so a charger reaches the back office and nothing else, and a session record naming every vendor that touched a unit. None of it runs on the charger. All of it runs in the network and cloud.
Enterprise IT security assumes managed endpoints. Someone owns the laptop, an agent runs on it, and the estate sits behind a perimeter in buildings you control.
A charging estate inverts every one of those assumptions. The hardware is in public space. The controller has no room for an endpoint agent and no update path you own after year three. The perimeter is a cellular connection to a device that a member of the public stands next to for 40 minutes. And the estate is a supply chain: the hardware vendor, the installer, the maintenance contractor and the back office provider each need to reach something.
Under AFIR, charge point availability is a regulatory obligation as well as a commercial one. So the security architecture has a second constraint: it cannot be the reason a charger goes offline.
Each measure below follows the same three part structure. What the measure asks for, where IXT contributes, and what stays your responsibility.
What it asks for: identity based access, verified per session rather than assumed after first connection.
Where IXT contributes: the SIM identifies the charger to the mobile core at network attachment, before any application traffic exists. IMEI locking binds that identity to specific hardware, so a SIM pulled from a roadside cabinet and put in a laptop stops working. Above that, the Zero Trust layer checks every session in the network and cloud rather than trusting the connection once.
What stays yours: identity governance for the humans. Which of your staff and which vendor engineers hold which entitlements, and the joiner and leaver process behind that, is your access management work.
What it asks for: containment, so a compromise in one place does not become a compromise everywhere.
Where IXT contributes: SecureNet keeps charger traffic off the public internet with a private APN and private IP addressing, routed into your back office or cloud environment directly. Policy based segmentation from Illumio then divides the estate so a charger reaches the back office and nothing else, and blocks lateral movement between chargers.
The distinction matters here. A private APN hides traffic but does not defend it. Inside a flat APN, a compromised charger reaches every other charger in the estate. Isolation is the first half. Segmentation is the second.
What stays yours: segmentation inside your own data centre and cloud environment, and the design decision about how finely to segment the estate. Per site, per hardware model, per vendor, or per charger.
What it asks for: control and accountability over the access your suppliers hold.
Where IXT contributes: browser based privileged remote access replaces vendor VPN. Each vendor gets an SSH, VNC or RDP session through a browser, time limited, recorded and co-viewable, initiated from the Zero Trust Exchange. No client install on the charger. No IP conflicts between vendors. No network access beyond the specific unit.
A European EV charging operator with eight hardware vendors needed exactly this: each vendor able to reach their own chargers, none able to reach the estate. VPN could not express that distinction. Per session brokering does.
What stays yours: supplier governance. Contracts, security requirements in procurement, vendor risk assessment and the review cadence behind them are yours to build and document.
What it asks for: detection, plus reporting within the directive's timeframes.
Where IXT contributes: real time traffic mapping across every connected charger, with anomaly detection when a unit starts talking to something it has never talked to before.The IXT CMP shows live SIM status, usage, location and session logs. Most connectivity platforms report on a 24 to 48 hour delay, which is longer than the NIS2 early warning window.
What stays yours: the incident response function. Detection is a signal. Triage, decision making, notification to your national CSIRT and post incident review are yours. Zero Trust does not replace a SIEM, a SOC or an on call rota.
What it asks for: evidence, in a form that survives an auditor's questions.
Where IXT contributes: a record of every device, every user and every third party contractor that accessed a charger, and what actions they took in that session, with session recording for privileged access.
What stays yours: retention policy, evidence handling, and mapping the trail to your transposed national obligations.
IXT Zero Trust addresses Article 21(2) technical controls. It does not make you NIS2 compliant on its own, and no connectivity provider does. Risk documentation, incident response plans, staff training and supplier governance frameworks stay with you. So does your compliance posture as a whole.
Two further limits worth stating plainly. Traffic mapping covers IXT connected devices, so chargers on another provider's connectivity are outside it. And not every device type or protocol is supported without a technical assessment first, so an estate with mixed legacy hardware needs that assessment before a design is committed.
NIS2 is transposed into national law country by country, and the detail varies. Verify these claims against your legal and compliance team's interpretation of the transposed legislation in your jurisdiction before using any of it in a tender response.
NIS2 covers operators in the energy sector, and the scope of entities and thresholds is set in each member state's transposition. Where you land depends on your size and the national implementation in the countries you operate in, so confirm classification with your legal team rather than assuming.
No. A private APN isolates charger traffic from the public internet, which addresses part of the segmentation measure. It gives no visibility into what chargers talk to, no segmentation between them, and no audit trail. An isolated flat network still fails an auditor asking who reached which charger last quarter.
No, and it is the reason enforcement belongs in the network. Charge point controllers have no room for an agent and no update path you control. Identity comes from the SIM, enforcement happens in the network and cloud, and the charger does no security work at all.
Browser based privileged remote access, scoped to the specific units that vendor owns, time limited to agreed hours, and session recorded. The vendor reaches one charger. Not the network the charger sits on.
Yes. Because nothing is installed on the device, the controls apply to hardware already in the field. Identity comes from the SIM and enforcement changes in the network, so a unit commissioned three years ago sits behind the same policy as one commissioned next month.
OCPP sits above this layer and continues to work. Device initiated traffic from charger to back office is the normal pattern and fits the model directly. Confirm your specific protocol versions and device types in a technical assessment before committing a design.
Two questions establish where you actually stand. First, if an auditor asked which vendor engineer connected to which charger in March, could you answer with a record rather than an email thread. Second, if one charger in your estate were compromised tonight, what else would it reach before morning.
The answers point at segmentation, visibility and per session access control, in that order. Article 21(2) is asking the same two questions in directive language.
Ask us how it works for your deployment. Book a demo at ixt.io.
devices are deployed across multiple countries and networks
SIM-level identity is enforced at the network edge
third-party access is controlled without VPNs
audit trails are required for regulatory compliance (including NIS2)
The patterns described here reflect how these environments are secured in practice, not theoretical models.