Security Audit of a Grid-Connected Wind Farm
A 22-turbine wind farm connected to the public grid, manufacturer's SCADA hosted off-site, multiple remote access points. Six weeks of NIS2 gap analysis and zone and conduit segmentation, with no interruption to production.
[ Context ]
The wind farm studied comprises 22 turbines connected to the public distribution grid through a single delivery substation. It is owned and operated by a renewable energy production company that manages several assets of this type across France. Day-to-day control relies on a SCADA system supplied by the turbine manufacturer and hosted off-site, at the manufacturer's premises. The operator accesses it through a web portal, the manufacturer and the maintenance provider each have their own remote access for remote maintenance, and a dedicated link transmits production data to an aggregator. A remote control interface finally lets the grid operator act on the power injected.
The operator falls within NIS2 scope as an electricity producer. Its technical team is small: two people oversee all the wind farms, and first and second-level maintenance is contracted out. The question raised was twofold: understand what, within this system, is actually the operator's responsibility rather than the manufacturer's, and obtain a usable assessment to start its compliance program. The farm had to remain in production throughout the assignment, with no interruption to production.
The Challenge
The wind farm was built and connected before the operator had formalized any cybersecurity requirement in its contracts. Control, supervision, and maintenance of the turbines therefore depended on the manufacturer, with a technical architecture it designed and documented only partially. The operator had no up-to-date flow diagram, no inventory of the remote access opened on its installation, and no visibility into what passed between the farm, the hosted SCADA, and the aggregator. The arrival of NIS2 made this situation untenable: the obligations fall on the operator, including for equipment it doesn't directly control.
The operator needed to be able to answer a simple question: in the event of an incident on the farm's control system, who acts, on which equipment, and with what permissions.
Manufacturer's SCADA exposed to the Internet through a shared portal
Flat internal wind farm network, with no filtering between zones
Two active remote access points missing from the documentation
Our Approach
The difficulty with this wind farm wasn't technical but contractual: most of the equipment and access was held by third parties, with the boundary of responsibility written down nowhere. The intervention therefore consisted of first establishing what actually existed, under real operating conditions, before comparing it against NIS2 obligations and translating it into zones and conduits enforceable against both the manufacturer and the maintenance provider.
Two days on site with the operations manager and the maintenance technician. Review of the SCADA maintenance and hosting contracts, the connection diagram, the agreement with the grid operator, and the aggregation contract. This scoping was used to set the system's ownership boundaries before any technical survey. The operations teams were involved at every step.
OT asset inventory: PLCs, HMIs, supervision stations, network equipment, remote access. Survey conducted in four nacelles representative of the two turbine generations present on the farm, at the delivery substation, and in the metering room. Passive observation of network traffic, no injection into the production network. Captures were made under real operating conditions, with the turbines running, over a ten-day window covering a curtailment episode requested by the grid operator.
Reconstruction of the communication paths actually used between the turbines, the delivery substation, the hosted SCADA system, the aggregator, and the remote control interface. Identification of active remote access, its holders, its authentication methods, and its traceability. Each flow was compared against what the contracts described, which revealed the gaps between the documented architecture and the architecture in service.
Gap analysis against the NIS2 obligations applicable to an electricity producer: governance, risk management, access control, logging, incident management, supply chain security, continuity. Each requirement was compared against what existed, what existed partially, and what was missing. For each point: criticality, remediation effort, action owner.
Zone and conduit segmentation under IEC 62443, applied to the entire farm, with a target security level per zone. Construction of a responsibility matrix assigning each zone and each conduit to the operator, the manufacturer, the maintenance provider, or the aggregator. Remediation plan prioritized across three horizons: immediate, 6 months, 18 months. Two presentations: one technical, with operations, the other for management.
[ Results ]
214 pieces of equipment recorded across 22 turbines and the delivery substation, including seven remote access points, two of them unknown.
5 zones and 9 IEC 62443 conduits defined, with flow diagrams the operator can edit itself.
34 NIS2 gaps identified, 9 of them urgent, risk-rated and integrated into the compliance file.
Written responsibility matrix between the parties, added as an annex to the maintenance contract; undeclared access cut off.
We knew our weak point was the split in responsibility with the manufacturer, without being able to put it into words. The zone and conduit segmentation made the conversation possible: every remote access now has an identified owner and a written rule. Production was never interrupted during the surveys, and we were able to take over the flow diagrams in-house to prepare our NIS2 declaration.
Discover other industrial cybersecurity missions carried out by Leviotec, in France and internationally
.svg)
.svg)