Product Overview

Summary: This SOP sets out clear, practical cybersecurity measures for electric vehicles (EVs) and their supporting infrastructure to protect workers, passengers, and critical business assets. It translates complex cyber and data security risks into step-by-step controls tailored to Australian EV fleets, charging stations, and workshop operations, supporting both WHS and regulatory compliance.

As electric vehicles become more connected, the line between physical safety and digital security is rapidly disappearing. Compromised EV control systems, charging infrastructure or telematics platforms can create real-world safety risks for drivers, technicians, and the public—ranging from vehicle malfunction and charging faults through to unauthorised remote access and data breaches. This Safe Operating Procedure provides a structured, WHS-aligned approach to managing cybersecurity risks specific to EVs in Australian workplaces, including fleets, depots, workshops, and public or private charging facilities.

The procedure converts technical cybersecurity concepts into operational controls that frontline staff, supervisors, and managers can actually implement. It covers secure configuration of EV systems, safe use of diagnostic tools, access control for charging stations, management of over-the-air updates, and incident response when a cyber event has potential safety implications. By adopting this SOP, organisations establish defensible, repeatable practices that support their WHS duties, safeguard critical transport assets, protect sensitive data (including driver and location information), and reduce the likelihood that a cyber incident escalates into a safety, operational, or reputational crisis.

Key Benefits

• Reduce the risk that cyber incidents impact the safe operation of electric vehicles, charging systems, and workshops.
• Ensure EV-related cyber controls align with Australian WHS obligations and information security expectations.
• Standardise how technicians, drivers, and managers configure, access, and update connected EV systems.
• Strengthen protection of sensitive operational and location data associated with EV fleets and charging infrastructure.
• Improve preparedness and response capability for cyber events that may affect vehicle safety or business continuity.

Who is this for?

• Fleet Managers
• EV Operations Managers
• Workshop Managers
• IT and Cybersecurity Managers
• WHS Managers
• Electrical Engineers
• EV Technicians and Auto Electricians
• Charging Infrastructure Coordinators
• Facilities Managers
• Transport and Logistics Managers
• Public Transport Operations Managers
• Local Government Fleet Coordinators

Hazards Addressed

• Unauthorised remote access to vehicle control or safety systems
• Malicious interference with EV charging equipment and power management systems
• Compromised telematics or GPS data leading to unsafe routing or misuse of vehicles
• Installation of unverified software or firmware on EVs and diagnostic tools
• Data breaches involving personal information of drivers, customers, or staff
• Operational disruption of EV fleets due to ransomware or other cyber incidents
• Unsafe work practices when connecting EVs to networks, diagnostic ports, or third-party devices

Included Sections

• 1.0 Purpose and Scope
• 2.0 Definitions and Key Concepts (EV and Cybersecurity)
• 3.0 Roles and Responsibilities (WHS, Fleet, IT, Technicians)
• 4.0 Applicable Legislation, Standards and Manufacturer Requirements
• 5.0 Cyber Risk Assessment for EVs and Charging Infrastructure
• 6.0 Access Control and User Management for EV Systems
• 7.0 Secure Configuration of EVs, Telematics and Onboard Systems
• 8.0 Secure Use of Diagnostic Tools, Laptops and Mobile Devices
• 9.0 Over-the-Air Updates, Firmware and Software Management
• 10.0 Data Protection and Privacy for Driver and Vehicle Information
• 11.0 Network Security for Charging Stations and Depot Infrastructure
• 12.0 Physical Security Measures Supporting Cyber Controls
• 13.0 Safe Work Practices for Connecting and Disconnecting EVs to ICT Systems
• 14.0 Cyber Incident Detection, Reporting and Escalation
• 15.0 Response to Cyber Events with Potential Safety Impacts
• 16.0 Training, Competency and Awareness Requirements
• 17.0 Documentation, Recordkeeping and Audit Trail
• 18.0 Monitoring, Review and Continuous Improvement of Cybersecurity Measures
• 19.0 References and Supporting Documents
• 20.0 Revision History and Document Control

Legislation & References

• Work Health and Safety Act 2011 (Cth) and equivalent state and territory WHS Acts
• Work Health and Safety Regulations 2011 and equivalent state and territory WHS Regulations
• Safe Work Australia – Managing electrical risks in the workplace Code of Practice
• AS ISO/IEC 27001:2023 Information security, cybersecurity and privacy protection – Information security management systems
• AS ISO/IEC 27002:2023 Information security, cybersecurity and privacy protection – Information security controls
• AS ISO 31000:2018 Risk management – Guidelines
• AUSkey successor frameworks and Australian Government Information Security Manual (as guidance for best practice)
• Manufacturer technical and safety bulletins for specific EV models and charging systems