The Open Charge Alliance (OCA) published Version 2.0 of its Security Operations Guide on Tuesday, Sept. 22, 2026, launching it at OCPP Plugfest & Conference Europe in Dublin. The whitepaper is written for the companies that build and run charging networks: charging station manufacturers, providers of charging station management systems (CSMS), charge point operators (CPOs) and other parties. It sits alongside the Open Charge Point Protocol (OCPP), the communication protocol the alliance maintains, and turns the security requirements in the OCPP specifications into practical implementation advice.
OCA published the first version at the beginning of 2026. Version 2.0 is a whitepaper of practical guidance that complements the security requirements and recommendations already in the OCPP specification and its certification programs.
What changed in Version 2
OCA lists six changes from the first edition:
| Area | Version 2.0 change |
|---|---|
| Document structure | CSMS and CPO requirements now have separate sections |
| Operations and deployment | Extended guidance for CSMS providers and CPOs on secure deployment and operations |
| Cryptography | A new Post-Quantum Security Policy to help organizations prepare for the transition to post-quantum cryptography |
| Certification | References to the JC-STAR Level 1 cybersecurity certification scheme |
| Architecture | A new defense-in-depth section describing extra controls that can complement OCPP security |
| Local Controllers | A new section on security considerations for Local Controllers |
The role split means CSMS providers and CPOs each get their own set of requirements rather than one combined list. The extended requirements in those sections cover how each should deploy and operate systems securely.
Post-quantum cryptography covers algorithms designed to resist attacks from future quantum computers. OCA describes the new policy as a way to help organizations prepare for that transition. The defense-in-depth section describes additional controls that can be layered on top of the security built into OCPP itself, and the Local Controllers section addresses the security considerations that come with using Local Controllers in an OCPP deployment.
What the guide covers
The guide's whitepaper page describes Version 2.0 as a complementary guide for implementers of OCPP Charging Stations and CSMSs. It has two main parts. The first gives a structured overview of key security-related regulations and the measures each regulatory framework applies. The second sets out operational best practices drawn from OCPP requirements and recommendations, and explains how to use OCPP features securely.
The page treats charging infrastructure as critical infrastructure and warns that security issues there can have "far-reaching consequences" for the electricity grid and society. The full document is available as a free PDF from the same page.
Launched at the Dublin plugfest
OCPP Plugfest & Conference Europe was held Sept. 22–23, 2026 at ESB's head office in Dublin. According to OCA's event recap, published Sept. 28, attendees came from 25 nationalities. OCA Director Lonneke Driessen presented the second version of the Security Operations Guide at the event and outlined future scenarios.
Partner teams ran round-robin interoperability testing of OCPP 2.0.1 and OCPP 2.1 implementations. Security was also tested hands-on: an ElaadNL expert ran cybersecurity penetration tests on several onsite charging stations. OCA technical editor Milan Jansen gave an OCTT demonstration that closed the testing days. The conference program also featured a joint Ireland-Netherlands position advocating broader adoption of open standards, along with talks on cyber resilience, grid flexibility and vehicle-to-grid (V2G).
Aja Teehan of Zero Emission Vehicles Ireland (ZEVI), a dedicated office of Ireland's Department of Transport, said in OCA's announcement: "ZEVI welcomes the development by OCA of their security operations guide." Teehan and ZEVI colleague John Byrne also spoke at the conference on Ireland's EV infrastructure and digital policy.
Context
The Security Operations Guide is one of the whitepapers OCA publishes to support OCPP implementers, alongside the protocol specifications and certification programs it complements. The alliance's plugfests bring charger and back-end vendors together to test their implementations against each other, and the next one, OCA Plugfest & Conference Australia, is scheduled for Oct. 21–23, 2026.
What It Means for Drivers
The guide does not change connectors, payment, charging speeds or which vehicles can use a station. Its measures are aimed at the back-end systems and operating practices of charging station manufacturers, CSMS providers and CPOs, so any effect on drivers comes through how securely their network's chargers and management software are run.
Drivers who want to know whether their network follows OCA's security guidance can look at the operator's published security or privacy information, or ask the network directly whether it applies the Security Operations Guide v2.
