Skip to main content
Request for proposal

      In Lithuania, solar power plants, electricity generation facilities and energy storage systems with an installed capacity exceeding 100 kW are subject to mandatory cybersecurity requirements. Pursuant to Article 73³ of the Law on Electricity and the implementing regulatory requirements, the operators of these facilities are required to conduct an independent cybersecurity audit and submit a security compliance declaration.

      KPMG provides independent cybersecurity audit services for solar power plants, electricity generation facilities and energy storage systems. During the audit, we assess technological, organisational and process-based security measures, identify non-compliances and provide recommendations to help ensure compliance with legal requirements and strengthen the resilience of infrastructure against cyber threats.

      Ramūnas Tiškus

      Manager, Technology Advisory

      KPMG in Lithuania

      Audit process

      • Scope definition

        We define the audit scope and assess the architecture of the power plant or storage system, the technologies used, suppliers and responsible parties.

      • Document review and remote analysis

        We analyse technical documentation, network diagrams, configurations, access management processes and related documents.

      • On-site assessment

        We perform a technical assessment of the infrastructure, analyse networks and control systems, review physical security measures and conduct interviews with responsible persons.

      • Report and discussion of results

        We present conclusions, identified non-compliances and recommendations, and discuss the action plan with the organisation’s representatives.

      • Follow-up review

        Where required, we assess the implemented measures and help prepare for the annual audit obligation.

      What do you receive after the audit?

      • An independent auditor’s report suitable for submission together with the security compliance declaration;
      • A register of non-compliances with risk assessment and recommended actions;
      • A prioritised action plan with responsibilities clearly assigned to the contractor and the owner;
      • Recommendations for further compliance assurance and repeat audits.

      Why choose KPMG?

      • Independent and objective assessment

        KPMG does not install, configure or manage power plant control systems. This helps ensure an independent, objective assessment unaffected by conflicts of interest.

      • Experience in the energy sector

        We work with energy infrastructure operators, project developers and power plant owners, assessing cybersecurity and regulatory compliance matters.

      • International expertise

        KPMG’s global network provides access to cybersecurity best practices in the energy sector and international experience.

      Want to request a service?

      Submit RFP and get an offer that is tailored to meet your business needs.

      Submit RFP
      Woman in an office talking on the phone