Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

NIST IR 8498 (Initial Public Draft)

Cybersecurity for Smart Inverters: Guidelines for Residential and Light Commercial Solar Energy Systems

Date Published: May 10, 2024
Comments Due: June 10, 2024
Email Comments to:


James McCarthy (NIST), Jeffrey Marron (NIST), Don Faatz (MITRE), Daniel Rebori-Carretero (MITRE), Johnathan Wiltberger (MITRE), Nikolas Urlaub (MITRE)


The use of small-scale solar energy systems to generate electricity continues to increase. Smart inverters provide two critical functions to a small-scale solar energy system: they convert the direct current (DC) produced by solar panels to the alternating current (AC) used in homes and businesses, and they manage the flow of excess energy to the local electric grid.

This report provides practical cybersecurity guidelines for small-scale solar inverter implementations typically used in homes and small businesses. The report also presents recommendations to smart inverter manufacturers to improve the cybersecurity capabilities in their products.

These recommendations build on the IoT cybersecurity capability baselines defined in NIST IR 8259A and NIST IR 8259B by providing smart-inverter specific information for all baseline cybersecurity capabilities.

NOTE: A call for patent claims is included on page ii of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.



IoT cybersecurity capabilities; light commercial inverter; residential inverter; small-scale solar energy system; smart inverter cybersecurity
Control Families

None selected


Download URL

Supplemental Material:
Project homepage

Document History:
05/10/24: IR 8498 (Draft)


Security and Privacy

general security & privacy, risk management


Internet of Things


smart grid