React Less. Defend More.

NIS2 COMPLIANCE FOR OT

Practical NIS2 compliance for operators of energy, water, transport and manufacturing sites. We turn the Directive into OT controls your plant teams can run, without stopping production.

GET A FREE NIS2 READINESS CALL

What NIS2 Means for OT Operators

NIS2 (Directive (EU) 2022/2555) is the EU’s updated cyber security law for essential and important services. Member states had to turn it into national law by 17 October 2024, and 24 of 27 now have a law in force.

For industrial operators, NIS2 is not an IT policy exercise. Most sectors it names run on operational technology: energy, transport, water and waste water, chemicals, food production and manufacturing. Your control systems, remote access and suppliers are now in scope, and your management board is personally accountable.

What changes in practice:

  • Faster incident reporting: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
  • Ten minimum security measures (Article 21): risk analysis, incident handling, business continuity, supply chain security, vulnerability handling, access control, asset management, training, cryptography and multi-factor authentication.
  • Board accountability (Article 20): management must approve the measures, oversee them and complete cyber security training.
  • Higher fines: up to €10m or 2% of global turnover for essential entities, and €7m or 1.4% for important entities.

In the UK? The Cyber Security and Resilience Bill

NIS2 does not apply in the UK, but the UK is moving the same way. The Cyber Security and Resilience (Network and Information Systems) Bill is going through Parliament and will update the NIS Regulations 2018.

As drafted, it would require an initial incident report within 24 hours and a full report within 72 hours. Maximum fines would rise to £17m or 4% of worldwide turnover. It also brings managed service providers, data centres and critical suppliers into scope, so your OT vendors and integrators will face new obligations too.

If you operate in both the UK and the EU, we build one OT security programme that meets NIS2 and prepares you for the Bill, rather than two parallel projects.

Our NIS2 Compliance Services for OT

NIS2 scoping

Confirmation of whether you are an essential or important entity, which sites and systems are in scope, and your national authority.

OT gap assessment

Your current controls measured against the ten Article 21 measures, mapped to IEC 62443, with a prioritised remediation roadmap.

OT risk assessment

A documented, IEC 62443-aligned OT risk assessment that meets the Article 21 risk analysis requirement.

Asset inventory

A complete OT asset inventory, the baseline for asset management and vulnerability handling.

Incident reporting readiness

24-hour and 72-hour reporting playbooks built into your OT incident response plan, tested in an industrial tabletop exercise.

Supply chain and remote access

Supplier risk review and secure third-party remote access to your OT networks.

Board briefing and training

Training that meets the Article 20 management training obligation.

Ongoing compliance support

Policies, evidence packs and audit support, or an embedded OT security lead.

How We Get You Compliant

  1. Scope: confirm your entity status, in-scope sites and reporting obligations.
  2. Assess: run an OT gap assessment against Article 21 and IEC 62443, on site and without disrupting production.
  3. Prioritise: produce a risk-ranked roadmap with the quick wins first.
  4. Implement: close the gaps with segmentation, access control, monitoring and reporting playbooks.
  5. Prove: build the evidence pack your regulator or auditor will ask for, and brief your board.

Why OTIFYD

  • OT only. We work on industrial control systems, not office IT, so our controls fit how your plant actually runs.
  • Standards-based. Our assessments follow IEC 62443, ISO/IEC 27001 and NIST, which map directly to NIS2 Article 21.
  • UK, EU and Middle East. Offices in London, Munich and Dubai cover the UK Bill, German and EU NIS2 laws, and group-wide programmes.

NIS2 (Directive (EU) 2022/2555) is the EU’s cyber security law for organisations that provide essential and important services. It replaced the original 2016 NIS Directive, covers far more sectors and companies, and sets common rules for risk management, incident reporting and management accountability.

NIS2 compliance means meeting your country’s national NIS2 law: registering with the authority, putting the Article 21 security measures in place, reporting significant incidents on time, and having your board approve and oversee it all. Most organisations start with a scoping exercise and a gap assessment, then follow a prioritised remediation roadmap.

Article 21 sets ten minimum measures: risk analysis and security policies, incident handling, business continuity, supply chain security, secure acquisition and vulnerability handling, testing of effectiveness, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication. Article 23 adds incident reporting, and Article 20 makes management accountable.

NIS2 generally applies to medium and large organisations (50+ staff or over €10m turnover) in the sectors listed in its Annexes. These include energy, transport, water and waste water, health, digital infrastructure, chemicals, food and manufacturing. Some entities are in scope regardless of size, and your national law sets the final detail.

NIS2 entered into force in January 2023, and EU countries had to apply their national laws from 18 October 2024. By October 2026, 24 of the 27 member states had a national NIS2 law in force, including Germany. If your organisation is in scope in those countries, the obligations already apply.

Not directly, because the UK has left the EU. UK operators fall under the NIS Regulations 2018, which the proposed Cyber Security and Resilience Bill will update. A UK company that provides in-scope services inside the EU can still fall under NIS2 in those countries.

DORA is an EU regulation for the financial sector, such as banks, insurers and investment firms, and has applied since January 2025. NIS2 covers a broad range of critical sectors. Where a financial entity is covered by DORA, DORA’s ICT risk rules take precedence over NIS2’s.

A significant incident needs an early warning to your national CSIRT or authority within 24 hours, an incident notification within 72 hours and a final report within one month. For OT operators, that means detection and escalation must work around the clock, not just in office hours.

Essential entities face fines of up to €10m or 2% of worldwide annual turnover, and important entities up to €7m or 1.4%, whichever is higher. Management can also be held personally accountable, and authorities can temporarily ban executives of essential entities from management roles.

It is the UK’s proposed update to the NIS Regulations 2018, introduced to Parliament in November 2025 and not yet law. As drafted, it adds 24-hour initial incident reporting, fines of up to £17m or 4% of turnover, and brings managed service providers, data centres and critical suppliers into scope.