What is UL 2941 and why does it matter?
UL 2941, the Standard for Cybersecurity of Distributed Energy and Inverter-Based Resources, is the first cybersecurity Standard for distributed energy resources (DERs) and inverter-based resources (IBRs). This standard defines minimum requirements to help safeguard devices impacting grid stability, emphasizing security from the beginning of product development.
Cybersecurity enhancements for power systems
The Standard was developed in cooperation with the National Renewable Energy Laboratory (NREL), part of the U.S. Department of Energy (DOE), and establishes testable requirements for energy storage and generation technologies on the distribution grid. UL 2941 covers requirements for photovoltaic inverters, electric vehicle chargers, wind turbines, fuel cells and similar devices and equipment that support grid operations.
The Standard’s requirements target cybersecurity enhancements for power systems involving high-penetration inverter-based resources, including those that interface with bulk power systems for periods of high wind, solar and hybrid/storage power generation.
UL 2941 may also help promote awareness of the need to include cybersecurity considerations in the development of new IBR and DER systems.
Basic vs. advanced certification to UL 2941
Basic certification
Covers essential cybersecurity features required for certification. These are mandatory and foundational.
Advanced certification
Covers additional features that improve cybersecurity and interoperability. These are optional but recommended. These advanced requirements often match those from the Institute of Electrical and Electronics Engineers (IEEE) and the International Electrotechnical Commission (IEC) and may be required in future editions.
Applicable devices and technologies
UL 2941 applies to a wide range of technologies, including:
Photovoltaic inverters
Electric vehicle chargers
Wind turbines
Fuel cells
DERs and transmission-connected IBRs
Network-connected, software-operated endpoint devices used in critical infrastructure are also covered.
Cybersecurity testing coverage
Cybersecurity testing and requirements under UL 2941 cover multiple areas to support a comprehensive approach.
Access control and authentication
Tests verify proper user access management, including:
- Read/write permissions
- Role-based access control
- Default credential handling
- Remote and local interface authentication
Cryptography and data protection
- Strong, peer-reviewed cryptographic mechanisms
- Key management
- Digital certificate implementation
- Avoidance of deprecated encryption methods
Security management and risk mitigation
- Secure coding practices
- Protocol validation (e.g., TLS, DNP3)
- Use of X.509 and OCSP certificates
- Risk documentation and mitigation procedures
Logging, monitoring and documentation
- Logging – Captures security events, including login attempts and configuration changes
- Monitoring – Detects suspicious activity and supports incident response
- Documentation – Requires secure design records, provisioning/deprovisioning procedures and user manuals
Product management and updates
- Secure firmware updates
- Verification of update authenticity and integrity
- Penetration testing and vulnerability scanning
- Support for remote and local updates
Physical and anti-tamper protection
- Tamper-evident seals
- Secure enclosures
- Access control for physical interfaces (e.g., HMI, Ethernet ports)
How UL 2941 relates to other standards
Integration with UL 1741
UL 2941 can help provide an added security layer and covers cybersecurity requirements that complement the focus on inverters in UL 1741, the Standard for Inverters, Converters, Controllers and Interconnection System Equipment for Use With Distributed Energy Resources.
Alignment with IEEE and IEC requirements
Advanced certification requirements incorporate IEEE and IEC standards, supporting interoperability and cybersecurity best practices.
Grid code compatibility
UL 2941 helps companies demonstrate compliance to evolving grid code requirements by supporting cybersecurity features in DER and IBR technologies.
X
Get connected with our team
To learn more or to work with UL Solutions for DER and IBR cybersecurity, contact us today.
Please wait…
Characters remaining