Cybersecurity has entered utility procurement in emerging markets, with clauses covering secure development, access control, patching, monitoring and incident response now attached to tenders for control systems, smart meters and any grid equipment with communications.

The push comes from regulators, lenders and utilities’ own experience as digitalisation programmes connect assets that were once isolated. International operational-technology standards are the usual reference.

What suppliers face

Questionnaires and certifications at prequalification; secure-by-design requirements in specifications; obligations for vulnerability disclosure and long-term patch support; and, for some critical systems, local hosting or sovereignty rules. Read our reporting on distribution sensing and our grid section.

Background: digital grids, wider attack surface

Every smart meter, feeder sensor, remote terminal unit and cloud-hosted analytics platform that utilities add — see our coverage of distribution sensing — is also a potential entry point. Attacks on utilities in Ukraine, the United States and elsewhere, and ransomware incidents at utilities and suppliers on every continent, have moved cybersecurity from IT departments to procurement documents. Emerging-market utilities, often financed by development banks that now require cyber risk assessments, are writing security requirements into tenders for control systems, meters, communications and even primary equipment with digital components. Reference frameworks include the IEC 62443 series for industrial control systems, the NIST Cybersecurity Framework, NERC CIP in North America and guidance from the World Bank and IEA.

What suppliers face, in more detail

• Product security requirements: secure-by-design development, vulnerability disclosure, patch management and secure remote access.
• Certification and testing: IEC 62443 component and system certification, penetration testing and factory acceptance tests that include security.
• Supply-chain transparency: software bills of materials, country-of-origin questions and restrictions on certain vendors in some markets.
• Operational obligations: long-term security support, incident response commitments and data-residency rules for cloud services.
• Standards alignment: consistency with new grid codes and communication standards such as IEC 61850 and DLMS.

What it means for suppliers to utilities and OEMs

Cybersecurity is now a scored, sometimes pass/fail, criterion in utility tenders — and a competitive advantage for suppliers who can document it. That applies not only to control-system vendors but to inverter, battery, meter and protection suppliers, whose devices sit on utility networks. Suppliers should expect questionnaires, evidence requests and contractual security clauses as part of vendor qualification, and should track requirements as they spread through our grid reliability page.

Quick answers

Which cybersecurity standards do utilities reference in tenders?

IEC 62443 for industrial control systems is the most common internationally, alongside the NIST Cybersecurity Framework, ISO 27001 and, in some markets, NERC CIP-style requirements.

Do cybersecurity requirements apply to hardware suppliers?

Increasingly yes — inverters, meters, relays and battery systems all contain software and network connections and are covered by tender security clauses.

Sources and further reading

• IEC — Cyber security (IEC 62443) — industrial control system security standards
• NIST Cybersecurity Framework — risk-management framework
• IEA — Electricity security — cyber resilience analysis
• World Bank — Energy — utility digitalisation and cyber programmes

This article was researched and written by the EnergiTech Media editorial team and last reviewed in August 2026. We update country and sector guides as tenders, plans and regulations change. Spotted something out of date? Email support@energitechmedia.com.