What is a Battery Energy Storage System (BESS)?
A Battery Energy Storage System (BESS) is an installation that stores electrical energy in rechargeable battery cells and, at a chosen moment, returns it through power electronics to a building, a business or the electricity grid. A BESS is far more than a stack of batteries: a battery management system supervises the cells, an inverter converts direct current into alternating current and an energy management system decides when to charge and discharge. That makes a battery system a piece of OT steering physical energy flows of tens of megawatts, often remotely and often through the manufacturer’s cloud.
🧠 How does a battery energy storage system work?
A BESS charges when electricity is plentiful or cheap, for example on a sunny afternoon, and discharges when demand is high or the grid is constrained. Control is organised in layers:
- Cell level — the battery management system (also called a BMS in the storage world, not to be confused with a building management system) measures the voltage, current and temperature of every cell and intervenes when something deviates
- Power level — the Power Conversion System (PCS), the inverter, controls within milliseconds how much power flows to or from the grid
- System level — the energy management system chooses the strategy: peak shaving, trading or balancing services
- Grid level — a SCADA link to the grid operator or an aggregator dispatches the installation based on grid signals
Two figures characterise any system: power in megawatts (how fast) and energy capacity in megawatt-hours (how long). Grid-scale batteries in the Netherlands typically have a duration of one to four hours, and the round-trip efficiency of a full charge-discharge cycle is usually around 85 to 90 per cent.
🔧 What are the components of a BESS?
| Component | Function | OT relevance |
|---|---|---|
| Cells, modules and racks | Store energy; cells are bundled into modules and racks | Physical source of the fire risk |
| Battery management system | Supervises cells, balances charge, trips on danger | Last line of protection; tampering can lift safety limits |
| PCS / inverter | Converts DC to AC and back, follows the grid code | Directly determines the power exchanged with the grid |
| EMS | Charge and discharge strategy, link to market and grid operator | Often cloud-based, an entry point for mass dispatch |
| SCADA / RTU | Remote monitoring and control | Interface with the grid operator and control room |
| HVAC and fire suppression | Cooling, ventilation, gas detection, extinguishing | Failure raises the chance of overheating |
Stationary storage is dominated by lithium iron phosphate (LFP) chemistry. LFP is cheaper, lasts thousands of cycles and has a higher thermal runaway threshold than nickel manganese cobalt (NMC), which packs more energy per kilogram and is mainly used in electric vehicles.
🏭 What is battery storage used for?
| Application | What the battery does | Typical user |
|---|---|---|
| Peak shaving | Covers short consumption peaks so the contracted capacity can be lowered | Factories, distribution centres |
| Grid congestion relief | Charges during surplus and discharges during shortage | Solar parks, business parks |
| FCR | Automatic frequency containment; full power within 30 seconds | Grid batteries via TenneT |
| aFRR | Automatic frequency restoration; full power within 5 minutes | Grid batteries, aggregators |
| Arbitrage | Buying at low and selling at high electricity prices | Traders, developers |
| Backup power | Bridges outages as a large-scale UPS | Data centres, hospitals |
| Solar self-consumption | Stores daytime solar output for later use | Businesses and households |
For grid congestion in particular, battery storage is one of the fastest remedies: a battery next to a solar park or factory makes better use of an existing grid connection without waiting years for grid reinforcement. Similar questions arise for EV charging infrastructure.
📈 How is the Dutch market developing?
According to the market monitor of the trade association Energy Storage NL, the Netherlands had 84 large batteries (1 megawatt-hour and above) at the end of 2024, with a combined 350 megawatts of power and 620 megawatt-hours of storage — more than twice as many systems as a year earlier. Capacity was expected to double again in 2025, with large projects coming online in Flevoland.
In 2023 the transmission system operator TenneT cited a need for 9 gigawatts of battery power by 2030; at the end of 2025 it estimated that 5 to 7 gigawatts would be economically viable by then. For years the so-called double transport tariff held the market back: a battery paid grid charges both when charging and when discharging. On 16 July 2024 the Dutch regulator ACM adopted a code decision on the time-duration-bound transport right (TDTR, formerly ATR85), which has applied since 1 April 2025: the battery may use the grid in at least 85 per cent of the hours in a year, TenneT may curtail it in the remaining 15 per cent, and in return the transport tariff is cut substantially. The tariff problem has been eased, not eliminated.
🔥 What are the safety risks of a battery system?
The greatest physical hazard is thermal runaway: a faulty or overcharged cell heats itself up, releases flammable and toxic gases and can drag neighbouring cells along. Such a fire is hard to extinguish and can smoulder for days.
In the Netherlands, PGS 37-1 is the guideline for energy storage systems using lithium batteries, while PGS 37-2 covers the storage of lithium-containing energy carriers. Both were adopted in December 2023. The guideline is not yet legally anchored in the Dutch Environmental Activities Decree (Bal); an amendment is expected around 2028. Until then, municipalities and safety regions use PGS 37-1 as the reference for permits and the general duty of care. It calls for, among other things, separation distances between containers, detection, explosion venting and arrangements with the fire service.
This is where safety and security meet: the BMS and the cooling system are protection layers. Anyone who disables them remotely or alters limit values can create a physical hazard.
🔌 Which protocols does a BESS use?
- Modbus TCP — a widely used protocol between BMS, PCS and EMS, with no authentication or encryption; inside the battery cabinets, modules and racks often talk over CAN bus
- SunSpec Modbus — standardised Modbus register models for inverters and storage, so an EMS can control equipment from different brands
- IEC 61850 — used in substations and larger installations; part 7-420 defines the information model for distributed energy resources, including storage
- DNP3 and IEC 60870-5-104 — links to the SCADA systems of grid operators or trading platforms
- Cloud and vendor connections — MQTT or HTTPS connections to the manufacturer’s portal for monitoring, warranty and firmware updates
🔐 Why is battery storage a cybersecurity risk?
A BESS combines large power ratings with software that can be reached remotely. The main risks are:
- Remote vendor access — manufacturers and service companies often demand permanent remote access for warranty and monitoring, sometimes out of the owner’s sight
- Origin of BMS and PCS — a large share of batteries and inverters is made in China. In May 2025 Reuters reported that US investigators had found undocumented communication devices, including cellular radios, in inverters and in batteries from several Chinese suppliers. Lithuania had already passed a law in November 2024 banning remote access from countries regarded as a national security threat to solar, wind and storage installations above 100 kilowatts. See also solar inverter cybersecurity.
- Manipulation with grid impact — whoever controls many batteries at once can make power swing abruptly and disturb the grid frequency
- Manipulation with fire risk — changing BMS limits or switching off cooling can trigger thermal runaway
- Weak basic hygiene — default passwords and internet-facing VPNs played a central role in the attack on the Polish energy system at the end of 2025
📜 Which standards and regulations apply to a BESS?
| Framework | Subject |
|---|---|
| IEC 62933 series | Electrical energy storage systems; part 5-2 covers the safety of electrochemical systems |
| UL 9540 / UL 9540A | Safety of energy storage systems and test method for fire propagation during thermal runaway |
| PGS 37-1 | Dutch guideline for fire-safe energy storage systems |
| IEC 62443 | Cybersecurity of control systems; 3-3 for system requirements, 4-2 for components |
| NIS2 / Cybersecurity Act | Duty of care, incident reporting and registration in the energy sector; the Dutch Cbw has applied since 15 August 2026 |
| Network Code on Cybersecurity (NCCS) | Delegated Regulation (EU) 2024/1366, in force since 13 June 2024 for entities with high impact on cross-border electricity flows |
| Cyber Resilience Act | Security requirements for products with digital elements, such as EMS software and inverters |
🧭 Step by step: procuring and commissioning a BESS securely
- Assess the risks — determine what damage manipulation could cause (fire, grid impact, financial) and whether your organisation falls under the Cbw or NIS2.
- Set requirements in the tender — ask for IEC 62443-4-2 certified components, a software bill of materials, a vulnerability handling policy and full documentation of every communication module.
- Limit supply chain risk — stipulate from which countries and by whom the installation may be reached, and that cloud access can be disabled without voiding the warranty.
- Segment the network — place BMS, PCS and EMS in their own zone using network segmentation and allow only named connections.
- Centralise remote access — route it through a jump server with MFA, session logging and on-demand rather than permanent access.
- Verify at handover — inventory every device, look for unknown radios or SIM cards, change default passwords and check firmware versions.
- Keep physical protection independent of the network — make sure fire and temperature protection keeps working locally and in hardware, even if the EMS is compromised.
- Monitor and rehearse — watch network traffic, set alarms on abnormal setpoints and run an incident exercise together with the vendor and the fire service.
❓ Frequently asked questions
What is the difference between a home battery and a BESS?
A home battery is a small battery storage unit of a few kilowatt-hours used to consume your own solar power. A BESS is usually a large-scale system of one or more containers with megawatts of power, also used for balancing services, trading or grid support. The technology is similar, but the safety and security requirements for a BESS are much stricter.
How long does a BESS last?
A BESS with LFP cells typically lasts ten to fifteen years, depending on the number of cycles, temperature and depth of discharge. Capacity declines gradually, and many manufacturers guarantee around 70 per cent after ten years. Power electronics and software often have a shorter life than the cells.
Does battery storage fall under NIS2?
Large battery storage can fall under NIS2 and the Dutch Cybersecurity Act, because it provides services to the electricity grid and therefore belongs to the energy sector. Whether an individual operator is covered depends on the size of the organisation and its role in the energy system. Even operators outside the scope often receive the same requirements through contracts with grid operators or aggregators.
Is battery storage dangerous?
Battery storage with lithium-ion cells carries a real fire risk from thermal runaway, but that risk can be managed well. In the Netherlands, PGS 37-1 sets out the measures, such as separation distances, detection, ventilation and arrangements with the fire service. A well-protected BMS and reliable cooling are essential to that.
Can a hacker make a battery catch fire?
A hacker who gains access to the BMS or cooling of a battery energy storage system could in theory alter safety limits and so raise the chance of thermal runaway. That is why critical protections in a BESS should work locally and in hardware, independent of the network. No publicly confirmed incident of this kind is known so far.
Which protocols does a BESS use?
Inside a BESS, the BMS, inverter and EMS often communicate over Modbus TCP, often following the SunSpec models. Externally, IEC 61850, DNP3 or IEC 60870-5-104 are used, supplemented by cloud connections to the vendor. Many of these protocols have no authentication by default, which makes network segmentation essential.
📌 In summary
A battery energy storage system (BESS) is a fast-growing link in the energy system: it relieves grid congestion, supplies balancing power and absorbs peaks, but it is also a remotely controllable installation with fire and grid risks. Anyone procuring a BESS should therefore combine PGS 37-1 fire safety with IEC 62443, NIS2 obligations and strict rules for vendor access.