Since the hydrogen sector – including hydrogen refueling stations (HRS) – is classified as critical infrastructure, it is subject to regulatory requirements under the European NIS2 Directive, the European CER Directive, and their national implementation in Germany via the BSI-KritisV (Ordinance on the Determination of Critical Infrastructures). These regulations mandate the development of risk and crisis management plans, require the reporting of incidents, and call for regular reviews of risk assessments.

Cybersecurity is also a growing priority for stakeholders across the hydrogen value chain. Most companies operate both IT and OT infrastructures, which must be adequately protected. This can be achieved, for instance, in accordance with DIN EN ISO/IEC 27000 for IT systems and DIN EN IEC 62443 for OT systems.

There is still a need for further standardization regarding system independence. Currently, no standards require hydrogen systems to operate independently of central organizations—such as being able to function without an internet connection. In this context, “independence” would mean that facilities can continue performing their core functions autonomously.

Additionally, there are no existing requirements for avoiding unnecessary complexity in hardware, software, or operational concepts. It would also be beneficial to develop cybersecurity guidelines specifically for non-industrial hydrogen systems. To date, no standard is known that defines device-level safety responses in the event of a critical incident.