## 1 Introduction  
It is uncommon to pair cybersecurity with sustainability in the same sentence. However, in order to achieve environmental sustainability, high-level cybersecurity features must be integrated into decision-making energy optimization tools and utilities [1]. Hosting the data collected from renewable-energy sources and energy optimization utility on the cloud has created some cybersecurity challenges. Thus, decision-makers and providers must plan and mitigate cybersecurity threats. In light of this, the renewable-energy sector's quick evolution has exposed some major cybersecurity challenges [2].  
The first challenge is related to employing Internet-of-Things (IoT) devices to collect data from renewable-energy sources. In addition, IoT is used in controlling energy loads, promoting industrial operational effectiveness, and offering a more flexible energy experience [3]. On the other hand, low-cost IoT devices have many security vulnerabilities. These may allow attacks on energy systems through backdoor gateways [4]. Due to their apparent passivity, seemingly unprotected devices such as a thermostat, printer, or industrial sensor can be used to climb the technology stack and gain access to more vital networks [5]. To the best of our knowledge, many energy operators lack the necessary visibility to effectively defend these sensitive networks.  
The second challenge represents the increased number of attacks on the renewable-energy sector due to the development of more connected industrial assets and large-scale operating technologies [6]. The third challenge is related to storing the collected renewable-energy data on the cloud, which is a decentralized environment for easy and remote access.  
This creates the need for efficient and secure identity verification and access management. This access-management scheme should work as an efficient protection layer between the user requesting access and the sensitive renewable-energy data hosted in the cloud [7].  
The first step in effective access control is authentication. While authorization is made possible via authentication, which confirms the user's identity, after the authentication process, a user is given the right to perform something, which is referred to as authorization [8]. For example, a user requesting access can create and use an identity to log into the energy optimization utility website, but the optimization utility policy must ensure that. After verifying the user's identity, they are authorized to monitor some fields from the hosted database, such as solar, wind, hydro, geothermal, and biomass energy. However, this authenticated user cannot specify constraints in the model to investigate the optimal renewable-energy combination. Thus, the optimization utility authorization policy can be used at more specific levels than for access alone.  
A crucial step in preventing unauthorized access to information and the exploitation of computer systems is the proper setting of access privileges [9]. Therefore, to protect sensitive renewable-energy data and the energy optimization utility, a secure, flexible, and privacy-preserving access control system must exist. Renewable-energy organizations can employ solutions which include encryption, two-factor authentication, and authorization built in as a security feature. This paper introduces the evidence for using token-revocation access control as a feasible solution for the renewable-energy sector's security against several high-risk cyber attacks, such as malware infection and data leakage. Successful experiments with different renewable-energy organizations demonstrated that the rigorous implementation of token-revocation access control can effectively mitigate a wide range of cyber threats without introducing a lot of additional complexity or cost. The token-revocation access-control scheme has the ability to revoke the user's access at various points based on a constantly shifting revocation threshold.