NIS2 for Industrial Operators: What the Directive Means for OT

The NIS2 Directive, Directive (EU) 2022/2555, is the European Union’s updated cybersecurity law for critical and important sectors. Member states had to bring it into national law by 17 October 2024. For many industrial companies it was the first time cybersecurity became a legal obligation rather than good practice, and it covers the control systems that run production as well as the office network.

Who is in scope

NIS2 sorts organizations into two groups.

Essential entities operate in sectors of high criticality, including energy (electricity, oil, gas, hydrogen, district heating), transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure and public administration.

Important entities operate in other critical sectors, including manufacturing (of medical devices, computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment), chemicals, food, waste management, postal services and digital providers.

As a general rule, medium-sized and large organizations in these sectors are in scope, though some are covered regardless of size. Essential entities face proactive supervision; important entities are supervised mainly after the fact.

What NIS2 asks for

Risk-management measures

Entities must take appropriate and proportionate technical, operational and organizational measures to manage cybersecurity risk. The directive lists what they must cover at a minimum, including:

• risk analysis and information system security policies;
• incident handling;
• business continuity, backup management, disaster recovery and crisis management;
• supply chain security, including relationships with suppliers and service providers;
• security in acquisition, development and maintenance, including vulnerability handling and disclosure;
• ways to assess whether the measures are effective;
• basic cyber hygiene and cybersecurity training;
• cryptography and encryption where appropriate;
• human resources security, access control and asset management;
• multi-factor authentication and secured communications where appropriate.

Management accountability

Management bodies must approve the measures, oversee their implementation and follow cybersecurity training. They can be held liable for failures. Cybersecurity is a board-level responsibility under NIS2.

Incident reporting

Significant incidents must be reported to the national authority or computer security incident response team (CSIRT) in stages: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month.

Penalties

Fines can reach at least 10 million euros or 2% of worldwide annual turnover, whichever is higher, for essential entities, and at least 7 million euros or 1.4% for important entities.

What NIS2 means for OT teams

Most NIS2 measures map directly onto OT security practice:

• Asset management starts with an accurate OT asset inventory.
• Vulnerability handling means knowing which vulnerabilities affect your control systems and prioritizing them by real risk, with a sound patch process behind it.
• Access control and MFA reach the control network through secure remote access, especially for vendors and integrators.
• Business continuity needs tested backups of controller logic and configurations, and plans to run safely in a degraded state.
• Incident handling must be fast enough to meet a 24-hour early warning, which is only possible if OT events are visible and someone is responsible for them.
• Supply chain security covers the suppliers who build and maintain your control systems, and the products they deliver.
• Assessing effectiveness calls for regular assessments against a recognized framework. IEC 62443 is the natural reference for OT.

Turning NIS2 into a plan

1. Confirm your status. Check whether you are an essential or important entity under your country’s transposition, and register if required.
2. Assess the gap. Compare current OT and IT practice against the measures, and against IEC 62443 or another framework for detail.
3. Prioritize. Start where risk is highest and evidence is weakest: usually inventory, remote access, vulnerability handling and incident response.
4. Assign ownership. Make sure management is briefed and trained, and that each measure has an owner, in OT as well as IT.
5. Prepare to report. Agree who decides an incident is significant, who notifies and how, and rehearse it.
6. Keep evidence. Maintain documented policies, procedures and records that show the measures are in place and reviewed.

How Novaigu helps

Mission Guard gives each site the asset management, configuration hardening, vulnerability handling and documented policies NIS2 calls for, with reports that show compliance levels against industry standards. Mission Control aggregates the picture across sites for management and auditors. Our assessments and audits service measures your gap to NIS2 and IEC 62443 and delivers a prioritized roadmap, as it did for the multi-site operator in our case studies.