Today, the DOT’s Federal Highway Administration (FHWA) published a final rule in the Federal Register (88 FR 12724-12757) for the “National Electric Vehicle Infrastructure Standards and Requirements”. The rule “establishes regulations setting minimum standards and requirements for projects funded under the National Electric Vehicle Infrastructure (NEVI) Formula Program”. This rule establishes physical security and cybersecurity standards for NEVI funded projects as one of the six major areas of the new regulations.
Cybersecurity Overview
The executive summary of today’s rule notes that:
“This final rule outlines network connectivity requirements for charger-to-charger network communication, charging network-to-charging network communication, and charging network-to-grid communication. These requirements address standards meant to allow for secure remote monitoring, diagnostics, control, and updates. These requirements will help address cybersecurity concerns while mitigating against stranded assets (whereby any provider abandons operations at any particular charging station).”
It further notes that:
“This final rule establishes a requirement that States are required to implement appropriate physical strategies for the location of the charging station and cybersecurity strategies that protect consumer data and protect against the risk of harm to, or disruption of, charging infrastructure and the grid.”
Security Revisions
In §680.104, Definitions, the final rule adds a definitions for ‘cryptographic agility’ and ‘charging network’,
The final rule includes the following changes to the security requirements of the rule:
The FHWA agrees that physical security of charging station sites can be improved from consideration of additional strategies to include visibility from passersby, monitoring using security cameras, and the provision of emergency call boxes. The FHWA has modified language in this final rule to include consideration of these additional physical security strategies. See §680.106(h)(1)
The FHWA did update cybersecurity strategies of consideration to more holistically reflect the scope of standards recommended in comments. §680.106(h)(2)
The FHWA agrees with the recommendation that States consider strategies regarding both third-party cybersecurity testing and certification and the support of emerging PKIs and has modified the language in this final rule to include consideration of these strategies. §680.106(h)(2)
The FHWA also agrees to add language in this final rule to explain that the selection of “appropriate encryption systems” to “cryptographic agility,” meaning the capacity to rapidly update or switch between data encryption systems, algorithms and processes without the need to redesign the protocol, software, system, or standard. §680.106(h)(2)
The FHWA also changed the phrase “secure operation during communication outages” to “continuity of operation when communication between the charger and charging network is disrupted” for clarity. §680.106(h)(2)
Effective Date
March 30th, 2023 is the effective date for this regulation.