Equipment area
Field Devices- Batteries / BMS
- PCS / Table
- Sensors / support equipment
Ownership: client site
CYBERSECURITY & ACCESS CONTROL
For every connection, operation, and change,
All through the trusted boundary.
An in-depth protection system from asset, network, identity, control to cloud connection for energy storage sites based on a credible identity, minimal authority and auditable access. Any remote access and critical operations must be sourced, authorized, disciplined and result-oriented.
Identified
Min permissions
Ongoing monitoring
Auditable
Recoverable
External visits
Cloud / DMZ
Station-level transport sector
Control network area
Protected / Safe Zone
Equipment area
AST
Assets counted
3,248
Device / System / Service
ID
Privileges
86
Real name controlled.
TERM
Remote access terminal
12
Controlled Terminal
MFA
Documented compliance rate
98.6%
Rotation / MFA / Certificate
LOG
Security Event Log
28,731
Past 24h
DR
Recovery target
RTO 2h
RPO 15 min
01 Assets and regional models Trust zones and ownership
Protected / Safe Zone
Safety & Protection- Protect relays
- Safety interlock
- FIRE FIGHTING SYSTEM
Ownership: client site
Control network area
Control Network- PLC / RTU
- BMS / PCS controller
- Industrial exchanges
Ownership: client site
Station-level transport sector
Site Operations- SCADA / EMS
- Engineer station
- Local dimensions tool
Ownership: client site
Edge / DMZ
Edge Services / DMZ- Edge Gateway
- Jumper!
- Interface Agent
Ownership: Client / Sky
Cloud management area
Cloud Management- Cloud Platform
- Alarm service
- Update Management
Ownership: the sky
External area visits
External Users- Client
- Partner
- Temporary visits
Ownership: external organization
Credible Data Path
Controlled Accessed Path
Block Path
Equipment area:
Physical equipment such as on-site cores, BMS, PCS, sensors, etc. are located in the lowest level of equipment area and only controlled communications from clearly controlled and collected links are allowed.
02 Identity and Minimum Permissions
| Identity type | Identity | Source Role / Service | Site Range | Asset scope | Permissions | MFA | Status |
|---|---|---|---|---|---|---|---|
| Personnel status | zhang.min | Remote Engineer | Site-A | BESS-PCS-07 | Read / Controlled Operations | Yes. | Entry into force |
| Personnel status | li.yan | Security Analyst | All stations | Security incidents | Read-Only | Yes. | Entry into force |
| Service status | edge-gw-01 | Edge Gateway | Site-A | Data collection | Reading / writing restricted | Certificate | Entry into force |
| Device Identity | ctrl-plc-02 | PLC controller | Site-A | Control network | The protocol is restricted. | Certificate | Entry into force |
Remote Engineer:
Access to designated sites and PCS is only allowed in the approval window, and the entire site cannot be controlled by successful login.
• Credible access paths Single entry · across a trusted boundary
All remote access must be verified layer by layer on controlled paths; external users cannot jump directly into the device zone.
External area visits
Edge / DMZ
Station-level transport sector
Control network area
Protected / Safe Zone
Equipment area
04 Safety access cases Authorized
05 Block the attempt Intercepted
×
External requests
Unusual source
×
Identification
Failed
×
MFA verification
No valid evidence
×
Asset authorization
Reject
×
Strategy block
DMZ terminated.
×
Generate Event
High risk
×
Into the control zone.
0 times
!
Alarm level: high
!
Source: Unknown external domain
!
Disposal: Edge / DMZ pre-cut
!
Record: Full security incidents
Blocked
×
No equipment change
06 Certificate / Certificate / Key Life Cycle
Signature:
Certificates and certificates must be issued by a controlled CA, PKI or identity system, and the creation of long-term shared accounts is not permitted.
07 Controlled software/ configuration update chain
• Security monitoring and incident response process
Detection is not the end—assessment, impact containment, recovery, and evidence closure must follow.
09 Audit and retention of evidence
10 Backup and Restore
11 Standards & Compliance Example reference · Project-specific
IEC 62443
- Industrial automation and Control Systems Safety Framework
- Regional and corridor thinking
- Identification and access control
- System integrity
- Restricted data flows
- Security incident response
CLIENT TO CONFIRM / PROJECT-SPECIFIC
ISO / IEC 27001
- Information security management system
- Identity and access management
- Asset management
- Change and supply chain governance
- Logs and audits
- Continual Improvement
CLIENT TO CONFIRM / PROJECT-SPECIFIC
Client/industry safety requirements
- Client IAM Policy
- Remote access approval
- MFA / VPN / Jumper
- Password and Certificate Policy
- Log retention requirements
- Incident response and recovery requirements
CLIENT TO CONFIRM / PROJECT-SPECIFIC
12 Border relations and interface management
Cloud–Edge Run-time boundary
Define who runs between clouds, edges, field controls, data caches, offline autonomy, renewal and recovery.- Security controls remain on the scene.
- On the edge, take on DMZ and interview agents
- Cloud cover cross-site analysis and management
↔
API/ Interface Compact System Interactive Boundaries
Define what data is allowed to be exchanged between systems, who can call, how to authenticate, how to fail and how to audit.- Interface Schema and version controlled
- Writing requires explicit authorization
- The order must be retroactive.
Ultimate Principle:
Platform connections must be met simultaneously
Controllable, auditable, abnormally responsive, system recoverableI don't know. The goal of the security system is not to block all connections, but to keep all permitted connections within clear, controlled and verifiable boundaries.