A Review on Cyber Security in Virtual Power Plants and Commercial and Industrial Solar

Electricity demand in the United States is rapidly rising, driven by electrification, clean energy goals, and AI data centers’ power demands. In parallel, the electric grid is undergoing a structural transformation as privately owned distributed energy resources (DERs) proliferate. Among DER technologies, solar photovoltaics (PV) plays a leading role in adoption trends, with adoption expanding beyond residential rooftops into larger commercial and industrial (C&I) installations. Virtual Power Plants (VPPs) offer a mechanism to aggregate and coordinate these C&I PV systems, alongside other DERs, into a dispatchable, grid-interactive resource. This paper identifies cybersecurity challenges and objectives that must be implemented for VPPs to successfully realize their goals. It proposes a set of security objectives for C&I systems participating in VPP operations. These objectives emphasize protecting data and operational integrity, ensuring only authorized entities can issue control actions, safeguarding data confidentiality, and maintaining service availability under adverse conditions. To achieve this, the paper proposes a Zero Trust Architecture (ZTA) tailored to the operational constraints and scalability requirements of VPP environments that coordinate large fleets of DERs.