Industry reacts to cybersecurity rules for rooftop solar monitoring systems

As India scales its rooftop solar capacity under the PM Surya Ghar: Muft Bijli Yojana, the Ministry of New and Renewable Energy (MNRE) has released draft guidelines mandating that all original equipment manufacturers (OEMs) supplying inverters under this scheme must connect their inverters directly to the national servers and software managed by the MNRE or a designated agency.

The move seeks to address grid stability and cybersecurity risks posed by the planned integration of 10 million rooftop solar systems, with a cumulative capacity of 30 GW, under the PM Surya Ghar: Muft Bijli Yojana.

MNRE draft guidelines mandate:

Direct communication of all solar inverters installed in India with MNRE-designated national servers
Use of machine-to-machine (M2M) SIMs for secure, real-time data transmission
Vendor-neutral, open protocol-based architecture

The final version of the guidelines will be notified later this year after stakeholder consultations.

While the solar industry broadly supports the move, it has voiced concerns over implementation hurdles, costs, and technical feasibility.

“The MNRE’s guidelines lay a strong foundation for long-term grid stability and data-driven solar deployment, but several short-term implementation hurdles must be addressed for successful execution,” said Saurabh Marda, co-founder, Freyr Energy.

“Clarity on cost allocation is critical, particularly regarding who bears the additional INR 18,000 per system cost for M2M SIM-based data transmission over 10 years. Without a clear definition of the full compliance scope, financial planning becomes uncertain for both developers and consumers.”

Marda also highlighted the need for aligning central policies with state-level DISCOM implementation, and ensuring reliable data connectivity across regions with limited cellular or WiFi infrastructure. “Technical disparities and supply chain dependencies—especially given that most inverter manufacturing is overseas—require both global coordination and lead time. Smaller installers and price-sensitive segments risk being disproportionately impacted by cost escalations and added complexity,” he added.

Marda emphasized the need for a phased implementation approach, beginning with larger systems or select geographies, to iron out challenges before a nationwide rollout; stakeholder consultation with industry, DISCOMs, and technology providers to ensure the guidelines are both practical and inclusive; and transparent cost-benefit analysis and support for connectivity infrastructure—particularly in rural or underserved areas.

Arvind Kumar, founder, Exolar Energy, welcomes the security guidelines but flags practical constraints for local manufacturers. “Most Indian manufacturers are still dependent on imported components–especially the inverter control cards. So, there needs to be a phased and cooperative implementation of these guidelines. We need to set up a framework that will give inverter companies from India, an opportunity to adjust at their own pace. In doing so, a boost to local R&D, as well as offering technical assistance, would certainly contribute to creating a secure, self-reliant solar ecosystem in India,” he said.

Piyush Goyal, Co-Founder & CEO, Volks Energie, said the initiative is much-needed for India, adding that “currently, most rooftop solar inverters are manufactured in our neighbouring countries, and many third-party servers are also based in these countries. This poses a cybersecurity threat to our country, as the data can be exploited in ways we can’t imagine.”

Goyal highlighted that “there will be some challenges in implementation, as many remote monitoring systems use the home WiFi for data transmission. Also, the M2M SIMs are issued only to the EPC companies, and they will disconnect once the warranty period is over.”

“If this is to be effectively implemented, M2M SIMs need to be issued to consumers directly, who can ensure that the SIMs are operational over the life of the solar plant. However, that’s an operational hurdle that can and must be bypassed because if implemented successfully, it will give a lot of visibility to the discoms and the government agencies to understand the energy generation and usage pattern of solar in the country,” he opined.

Charusmita, director at Statcon Energiaa, emphasises that for national security, especially under PM Surya Ghar, all inverter servers, remote monitoring, and firmware must remain India-based to address cybersecurity concerns. She urges the government to also mandate that existing installations comply retrospectively to ensure a secure and self-reliant energy infrastructure. “Additionally, the MNRE’s draft guidelines to enforce BIS certification under Scheme-I for solar inverters will mark a major policy shift, if approved, ensuring local manufacturing verification and minimum 50% Indian content. This is expected to curb the import of finished inverters, pushing traders and foreign OEMs into CKD/SKD-based tie-ups within India, including Chinese players,” she added.

This content is protected by copyright and may not be reused. If you want to cooperate with us and would like to reuse some of our content, please contact: editors@pv-magazine.com.