Paragraph 3 Software
A relevant charge point must incorporate software which is able to be securely updated.
In sub-paragraph (1), securely updated means updated using adequate cryptographic measures to protect against a cyber-attack.
A relevant charge point must be configured so that—
it checks, when it is first set up by the owner, and periodically thereafter, whether there are security updates available for it;
it verifies the authenticity and integrity of each prospective software update by reference to both the data’s origin and its contents and only applies the update if the authenticity and integrity of the software have been validated;
by default, it provides notifications to the owner about prospective software updates;
the owner can implement software updates without undue difficulty.
A relevant charge point must be configured so that—
it verifies, via secure boot mechanisms, that its software has not been altered other than in accordance with a software update which has been validated in accordance with sub-paragraph (3)(b) above;
if an unauthorised change to the software is detected, it notifies the owner and does not connect to a communications network other than for the purposes of this notification.