NIS2 has moved from transposition to enforcement. The Directive (EU) 2022/2555 had to be transposed by October 2024. Member states moved at different speeds, but national laws, such as Sweden's Cybersecurity Act (Cybersäkerhetslagen), now apply, and supervisory authorities have started asking organizations for evidence.
For operators of industrial environments, the question is no longer whether NIS2 applies but whether you can demonstrate that your OT is managed with the same discipline as your IT.
Who is in scope
NIS2 covers "essential" and "important" entities in sectors that include energy, transport, water, wastewater, manufacturing of critical products, chemicals and food. Size thresholds and national designation decide the exact list. If your organization falls in scope, your OT systems are in scope too: the Directive covers network and information systems used to provide the service, not just office IT.
What supervisors expect to see
Article 21 lists risk-management measures. Translated into OT terms, a supervisor will typically look for:
- Governance: management bodies approving and overseeing cybersecurity measures, with training, as required by Article 20.
- Risk analysis: a documented OT risk assessment, not just an IT risk register.
- Asset and network knowledge: an OT asset inventory and up-to-date architecture.
- Access control and remote access: individual accounts, multi-factor authentication and controlled vendor access.
- Supply-chain security: requirements for integrators, OEMs and service providers.
- Vulnerability handling: a process for advisories, including compensating controls where patching waits for an outage.
- Business continuity: backups, restore tests and crisis procedures.
- Incident handling and reporting: an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month.
The OT-specific gaps we see most
- Risk assessments that stop at the firewall. Corporate risk registers rarely describe the consequence of losing a substation, a treatment process or a production line.
- No evidence trail. Controls exist, but nobody can show when access was last reviewed or a restore was last tested.
- Vendor access nobody fully owns. Remote access paths accumulate across projects. See our remote access use case.
- Incident procedures written for IT. Isolating an OT network is an operational decision that needs pre-agreed authority. See OT incident readiness.
A practical 90-day plan
| Weeks | Focus | Output |
|---|---|---|
| 1–3 | Confirm scope and applicable national law | Applicability statement per site |
| 3–6 | OT asset and remote access inventory | Inventory with owners |
| 6–9 | Control assessment against IEC 62443-2-1 themes mapped to NIS2 | Gap register with evidence |
| 9–13 | Prioritize and plan remediation; test incident reporting | Roadmap, tabletop results |
Using IEC 62443 as the technical reference is practical: it gives OT-appropriate controls that map well onto NIS2's outcome-based duties.
How OTVista helps
The Standards & Compliance module maps one assessment to NIS2 and the other frameworks you face, while Evidence & Audit Trail keeps proof current. Our compliance readiness service can run the first assessment with you.
This article is general information, not legal advice. Confirm your obligations under your national NIS2 law.
Topics: NIS2, NIS2 OT, NIS2 compliance checklist, essential entities, OT cybersecurity regulation, incident reporting 24 hours