Treat energy controls as operational technology
A hospital BESS is a cyber-physical system. Software commands change charging power, inverter mode, generator starts, breaker permissions and load priorities. Incorrect data or unavailable control can therefore affect physical power delivery. The cybersecurity objective is not only confidentiality; availability, integrity, safety and recoverability are central.
NIST SP 800-82 defines operational technology as programmable systems that interact with the physical environment and emphasizes their performance, reliability and safety constraints. This is a useful engineering lens for BMS, PCS, EMS, microgrid controllers, protection relays, meters and building interfaces even though NIST guidance is not Philippine law.
Local operation is a resilience requirement, not a rejection of cloud services
Cloud analytics can improve fleet visibility, reporting and vendor support. The risk appears when basic safe operation depends on continuous internet access, an external identity provider, a remote license server or an opaque cloud optimization service. An outage, account lockout or vendor incident can then coincide with the electrical event the BESS is expected to manage.
A local-first architecture defines what the on-site system continues to do without the cloud. Protection remains autonomous. The PCS retains approved local controls. The BMS continues safety supervision. The EMS follows a conservative local schedule or reserve rule. Operators can see state, acknowledge alarms and apply authorized manual actions. When connectivity returns, buffered data can synchronize without forcing an unsafe state change.
This does not mean every function must be duplicated or air-gapped. It means the consequence of losing each dependency is known and acceptable. Optional optimization may stop; patient-supporting power behavior should degrade predictably.
Map trust boundaries and control authority
The first cyber deliverable is an asset and data-flow diagram. It should show batteries, BMS, PCS, EMS, relays, meters, generator controls, building management, operator stations, vendor gateways, hospital IT, remote users and cloud services. For every interface, record protocol, direction, credentials, write authority, encryption, logging, update path, owner and required availability.
The design should distinguish viewing data from issuing commands. A dashboard account that only reads state presents a different risk from a vendor account able to open a breaker or change protection-related settings. Remote write access should be justified, time-bound where practical, least-privileged, strongly authenticated and visible to the asset owner.
| Boundary | Failure or threat | Required local answer |
|---|---|---|
| Internet / cloud | Service unavailable or account blocked | Continue approved dispatch and reserve locally |
| EMS to PCS | Command or telemetry lost | Timeout to a documented safe power state |
| BMS to PCS | Limits unavailable or stale | Protect cells; alarm and restrict operation safely |
| Vendor remote access | Credential compromise or misuse | Disable path locally; preserve logs and control |
| Operator HMI | Screen or workstation fails | Independent protection and alternate status access |
Segmentation and remote access reduce the blast radius
Hospital business networks contain email, internet browsing, administrative systems and many user endpoints. Energy OT should not be placed on a flat network where compromise of an office account provides a direct path to control equipment. CISA’s 2025 OT mitigations emphasize segmentation between IT and OT, controlled remote access, least privilege and stronger authentication.
A project-specific design may use security zones, firewalls, a demilitarized zone for data exchange, allow-listed communications, jump hosts, phishing-resistant multifactor authentication and monitored vendor sessions. The exact measures depend on consequence and maintainability. A firewall rule set that nobody can support after handover is not resilient.
Updates, backups and time are part of the power design
Firmware and software updates can change operating behavior. The owner needs an inventory of model, serial number, firmware, configuration and dependencies; a process for assessing advisories; an approved maintenance window; a tested rollback path; and copies of configurations under owner control. Automatic updates should not silently change critical behavior during an emergency period.
Logs from BMS, PCS, EMS, generator controller and transfer systems need synchronized time. Otherwise a trip investigation becomes a collection of contradictory timestamps. Retention should cover operational investigation needs, while access and privacy are controlled. The Philippine Data Privacy Act becomes relevant if the monitoring environment processes personal information; it should not be invoked merely because ordinary electrical telemetry exists.
Procurement evidence should also identify software ownership, support lifetime, vulnerability-notification route, cryptographic update checks and the conditions under which the vendor can disable remote service. A security certificate for one component does not establish the posture of the integrated installation; the delivered firmware, gateways, accounts and network design remain part of the acceptance boundary.
Design graceful degradation as explicit states
“Fail safe” is too vague for a hospital microgrid. Opening every contact may be electrically safe but clinically unacceptable; continuing every command may be unsafe for batteries or workers. The team must define the least harmful state for each failure and confirm that local protection always retains priority.
Examples include freezing a non-critical economic setpoint while preserving emergency reserve, blocking a generator start when status is contradictory, shedding lower-priority loads when BMS limits fall, maintaining the island at reduced capacity after one PCS block fails, and requiring local authorization before reconnection. These decisions belong in the control narrative and hazard review.
- Internet disconnected and cloud unreachable.
- Remote credentials revoked or identity service unavailable.
- Meter frozen, out of range or time-unsynchronized.
- EMS-to-PCS and BMS-to-PCS communications interrupted.
- Controller reboot and configuration restore.
- One control component unavailable during utility loss.
Commission the failures before relying on the system
A cyber-secure design is not demonstrated by a penetration-test certificate alone. Commissioning should include functional failure tests: disconnect the internet, block a permitted communications path, stop the cloud session, present stale data, remove a controller, attempt unauthorized access and restore from an approved backup. The hospital should witness the electrical and alarm behavior, not only a network result.
S3’s review converts these dependencies into acceptance criteria alongside kW, kWh, transfer and protection tests. The result is a system that can use remote services without making patient-supporting power hostage to them. Certification claims, where offered, remain product- and scope-specific and must be verified for the delivered configuration.