EV Charging Infrastructure Security: Why Utilities Need More Control Over Their Software Stack

For years, energy security conversations have focused primarily on physical infrastructure: where equipment is manufactured, how supply chains are secured, and how critical assets are protected.

Increasingly, that conversation needs to include software.

A new Executive Order focused on securing the U.S. bulk power system brings greater attention to this issue. The directive extends scrutiny beyond physical equipment to associated software, firmware, digital services, maintenance services, and remote access capabilities.

For utilities and other energy infrastructure operators, the broader takeaway is important. Software supply chains are an integral part of infrastructure security.

EV charging software is becoming critical energy infrastructure

This issue is particularly relevant as utilities expand their investments in EV charging infrastructure and transportation electrification.

EV chargers are physical assets, but much of the intelligence controlling them resides in software. A Charge Station Management System, or CSMS, communicates with chargers, sends commands, collects operational data, manages charging sessions, connects with other platforms, and increasingly supports smart charging and energy management.

This creates an important distinction between owning EV charging infrastructure and controlling it.

A utility may own hundreds or thousands of chargers while remaining dependent on a proprietary third party EV charging software platform to operate them.

As EV charging becomes more closely connected to utility operations and the electric grid, those software dependencies deserve greater scrutiny.

Utilities should understand who controls the software operating their chargers, where the platform is hosted, where operational data resides, and who has remote access to their charging infrastructure.

They should also know whether the underlying technology can be independently evaluated, how dependent they are on a single software provider, and how difficult it would be to migrate to another platform.

Perhaps most importantly, utilities should understand what happens if their EV charging software provider is acquired, becomes restricted, change sits commercial model, stops supporting required functionality, or leaves the market entirely.

These are no longer simply technology procurement questions. They are questions of operational resilience.

EV charging vendor lock-in can become an infrastructure risk

Vendor lock-in has traditionally been discussed in terms of cost, competition, and flexibility.

For utilities and operators of critical infrastructure, it can also create operational risk.

If an operator cannot readily separate its charging hardware from the software platform controlling it, replacing that software provider can become expensive, disruptive, and slow.

Open standards such as the Open Charge Point Protocol, or OCPP, help reduce this dependency by establishing a standardized method of communication between EV chargers and charging management systems.

Open source EV charging software can provide another layer of flexibility by making the underlying software platform itself transparent and portable.

The goal is not simply to adopt open source technology. The goal is to give infrastructure operators greater control.

An open, standards based EV charging architecture can give utilities more flexibility to determine where their software runs, how it is secured, who maintains it, which charging hardware connects to it, and how the platform evolves over time.

Utility EV charging will become more connected to the grid

The importance of the EV charging software layer will continue to grow as charging infrastructure becomes more integrated with utility and grid operations.

Smart charging, demand response, distributed energy resources, fleet electrification, energy management, and bidirectional charging are transforming EV charging from an isolated technology system into an increasingly controllable energy asset.

This means the role of the EV charging management system is also changing.

Utilities should look beyond the traditional SaaS procurement question of which charging platform to purchase. They should also consider how much control they want to retain over the technology operating their EV charging infrastructure.

For some organizations, a fully managed EV charging platform will continue to make sense. Others may choose to deploy their charging management software within their own cloud environment or infrastructure.

Large utilities may want direct control of certain components while relying on specialized EV charging software partners to develop, integrate, maintain, and support the platform.

There does not need to be one deployment model. What matters is maintaining the ability to choose.

Open source EV charging software can give utilities more options

At S44 Energy, this philosophy has shaped how we approach EV charging software.

Our team helped create CitrineOS, a Linux Foundation Energy project and an open source Charge StationManagement System built around OCPP, and continues to contribute to its development. We subsequently built TopazEV on that open source foundation to provide operators with a commercially supported path for deploying and managingEV charging infrastructure.

This architecture gives operators options.

They can use a managed environment, deploy within their own infrastructure, integrate with existing utility systems, support charging hardware from multiple vendors, and maintain greater control over the technology underlying their charging network.

Our experience building and supporting software for EV charging networks has reinforced a simple principle: critical energy infrastructure should not depend on a software platform that an operator cannot control or replace.

That does not mean every utility should build and operate its own EV charging software.

It does mean utilities should understand their architecture, software dependencies, data flows, remote access, interoperability, and migration options before those decisions become difficult or expensive to unwind.

Utilities should evaluate the software behind their EV charging infrastructure

As federal policymakers increase their focus on the technology and software supply chains supporting U.S. energy infrastructure, utilities have an opportunity to examine their EV charging strategies through the same lens.

That assessment should extend beyond the charger manufacturer.

Utilities should understand the charging management system controlling those assets, the vendors with access to the network, the protocols connecting their systems, where critical data resides, and whether they have a practical path to change technology providers when necessary.

The next phase of transportation electrification will require more than reliable chargers. It will require secure, interoperable, flexible software infrastructure that utilities can integrate with the broader energy ecosystem.

Knowing where your charging equipment comes from is important.

Knowing who controls the software behind it may prove just as important.

‍