NIS2 for operators of industrial control systems
NIS2 is written in the language of information security. For a plant, the systems that most need protecting under it are the control systems.
Many plant managers read NIS2 as an IT matter, something for the CISO and the legal department. For an operator of power, water, gas, chemical or manufacturing plants that reading is a mistake. The systems whose failure would hurt most are the control systems, and NIS2 covers them.
What NIS2 is
NIS2 is Directive (EU) 2022/2555, on measures for a high common level of cybersecurity across the Union. It replaced the first NIS directive and widened its scope considerably. It covers essential and important entities in sectors of high criticality, such as energy, transport, drinking water, waste water, health and digital infrastructure, and in other critical sectors, such as chemicals, food, waste management and manufacturing. In general it applies to medium-sized and large organisations in those sectors, with some entities covered regardless of size.
A directive works through national law. Member states had to transpose NIS2 by 17 October 2024; several were late, and some were still working on their laws in 2026. The obligations below come from the directive itself; the exact wording, deadlines and authorities depend on the country.
What it asks for
Three articles matter most to an operator. Article 21 lists the risk-management measures, Article 23 the reporting duties, and Article 20 the responsibility of management.
- Policies on risk analysis and the security of information systems
- Incident handling, business continuity, backup management and crisis management
- Supply-chain security, including the relationship with suppliers and service providers
- Security in acquiring, developing and maintaining systems, including vulnerability handling
- Ways to assess whether the measures actually work
- Basic cyber hygiene and training, and cryptography where appropriate
- Personnel security, access control, asset management, and multi-factor authentication where appropriate
- Significant incidents reported in stages: an early warning within 24 hours, a notification within 72 hours and a final report within a month
- Management bodies that approve the measures, oversee their implementation and take part in training, and that can be held liable
The directive sets maximum fines of at least 10 million euros or 2 percent of worldwide annual turnover for essential entities, and 7 million euros or 1.4 percent for important ones. National law fills in the rest.
What changes for OT
NIS2 has no chapter on operational technology. It covers network and information systems, and a control network is one. In practice, five things change for a plant.
The control system is in scope
A risk analysis that stops at the office network does not meet the directive. The HMI servers, engineering workstations, controllers and the links between them are part of the systems the operator must protect.
Asset management reaches the controller
You cannot protect what you have not listed. A complete, current inventory of the control network, built from the devices themselves rather than from old drawings, is the foundation for everything else.
Suppliers become part of your risk
Integrators, machine builders and maintenance contractors connect to the plant, often remotely. Supply-chain security means knowing who connects, how, and under what contract, and holding suppliers to security requirements in writing.
Incidents in the plant must be reported
A 24-hour early warning needs two things that many plants lack: a way to notice an incident in the control network at all, which means monitoring, and someone with the authority to decide quickly that it is significant.
Management owns it
Plant managers and boards must approve the measures and understand them well enough to oversee them. That makes OT security a management topic, with a budget and priorities, not only an engineering one.
How NIS2 relates to IEC 62443
NIS2 says what must be achieved and leaves the how to the operator, within the state of the art. For control systems, the ISA/IEC 62443 series is the most direct way to show what that means. As an engineering guide, not a legal opinion:
- Risk analysis and security policies: IEC 62443-2-1, the security programme for asset owners, and IEC 62443-3-2, risk assessment and zones and conduits
- Security of the systems themselves: IEC 62443-3-3, system requirements and security levels
- Supply chain: IEC 62443-2-4 for integrators and service providers, IEC 62443-4-1 and 4-2 for product suppliers
- Incident handling and continuity: the security programme, plus an incident plan that has actually been rehearsed
National regulators may name their own standards or guidance alongside it, so check what yours expects.
The first steps
- Establish whether you are an essential or important entity, and register with the national authority if your country's law requires it.
- Build an inventory of the control network, using tools that query the devices rather than old drawings.
- Draw zones and conduits, and list every remote-access path and every supplier who uses one.
- Assess the gap against Article 21, using IEC 62443 as the yardstick, and rank it by consequence.
- Extend the incident plan into the plant: who decides in the first 24 hours, who calls the authority, and how the process is kept safe meanwhile. Then rehearse it.
- Brief management, and arrange the training the law expects of them.
- Review supplier contracts for security requirements and remote-access terms.
The bodies to know in Germany and Israel
In Germany, NIS2 was transposed by the NIS2UmsuCG, in force since 6 December 2025, which rewrote the BSI Act. The Federal Office for Information Security (BSI) handles registration, incident reports and supervision. The KRITIS-Dachgesetz, in force since March 2026, adds physical-resilience duties for critical facilities, with the Federal Office of Civil Protection and Disaster Assistance (BBK) as the authority. Energy network operators also work to the Federal Network Agency's IT security catalogue. My page on OT-Sicherheit für KRITIS-Betreiber covers this in German.
Israel is not in the EU, and NIS2 does not apply there directly. It still matters to Israeli companies in two ways. Israeli integrators, equipment makers and service providers that support plants in Europe fall under their customers' supply-chain requirements. And Israel's own National Cyber Defense Bill, which passed its first reading in the Knesset in June 2026, follows a similar logic: essential organisations, a mandatory protection baseline, reporting of significant attacks, and supervision by sector units in the ministries under the professional guidance of the Israel National Cyber Directorate. The bill may still change before it becomes law.
US operators work under different rules; see OT security for US critical infrastructure.
Where I can help
Much of what NIS2 asks of a plant has been part of my work for years: the inventory and risk assessment, as at ICL's power stations, where the report went to the regulator; the defense architecture; and training for the people who will run the plan.