NIS2 Compliance Readiness
The NIS2 Directive sets cybersecurity obligations for essential and important entities across the EU, applied through each member state's national law. OTVista helps industrial operators understand what applies to them and turn the requirements into controls, procedures and evidence that also work in their plants.
NIS2, Directive (EU) 2022/2555, requires essential and important entities in sectors such as energy, transport, water, manufacturing and chemicals to take appropriate cybersecurity risk-management measures (Article 21), report significant incidents in stages starting with an early warning within 24 hours (Article 23), and ensure management bodies approve and oversee those measures and follow training (Article 20). Obligations apply through national laws, so details differ by country.
NIS2 widened the range of sectors and organizations covered, and many manufacturers, chemical producers and utilities face binding cybersecurity duties for the first time. Its risk-management measures apply to the network and information systems used to provide their services, which for industrial operators includes operational technology.
The directive states outcomes rather than detailed controls, national laws add their own detail, and management bodies can be held accountable. Teams need a clear view of whether they are in scope, which measures they already meet, how incidents would be reported within the deadlines and what evidence would satisfy a supervisory authority.
Readiness work is organized around the obligations that apply to your entity:
Sector, size and service analysis to indicate whether you are likely an essential or important entity, to be confirmed with your legal advisers.
Management body approval and oversight of risk measures, and training for its members (Article 20).
Policies on risk analysis and information system security covering both IT and OT (Article 21(2)(a)).
Detection, classification and a reporting workflow for the 24-hour early warning, 72-hour notification and one-month final report (Articles 21 and 23).
Backup management, disaster recovery and crisis management, including recovery of control systems.
Security requirements for suppliers, integrators and service providers, including remote access by vendors.
Security in procurement and maintenance of systems, including vulnerability handling and disclosure.
How you measure whether the measures work: audits, metrics and testing.
Basic practices and training for staff and contractors, including OT personnel.
Policies and practices for encryption, personnel security, access and asset inventories.
MFA or continuous authentication and secured voice, video, text and emergency communications where appropriate.
The ten Article 21(2) measures translate into a practical document set. We align it with frameworks you already use, such as ISO/IEC 27001 or IEC 62443, to avoid duplicating work.
Articles 20 and 21(2)(a), (f), (g)
Articles 21(2)(b), (c) and 23
Articles 21(2)(d), (e), (h), (i), (j)
Final deliverables depend on the agreed engagement.
Confirm entity type, member states, services, and the IT and OT systems that support them.
Review current measures against Article 21(2) and national requirements.
Rate gaps by risk and regulatory exposure and agree priorities with management.
Develop policies, procedures, the reporting playbook and supplier requirements.
Set up evidence collection, metrics and a review cycle for ongoing compliance.
Runs on the OTVista tool
This service is delivered in the OTVista tool, not in a pile of spreadsheets. Use the same modules yourself, or have a practitioner run them for you.
A dedicated OTVista workspace is created for your scope, sites and frameworks.
An independent OT security practitioner carries out the work in OTVista, with you, instead of in loose spreadsheets.
Assets, findings, evidence and the roadmap stay live and traceable, ready for the next review or audit.
The OTVista tool is in early access. Modules are released progressively, and demos show the current release. Ask us which capabilities are available for your environment today. Where a module is not yet released for your scope, the same structure is delivered as an exportable workbook.
Sensitive material is exchanged only after an engagement is agreed, using a method we agree with you — never through the website form.
NIS2 lists manufacturing of certain products, such as electrical equipment, machinery, motor vehicles, computers and electronics, and medical devices, as an 'other critical sector'. Medium and large entities in those categories are generally in scope as important entities, subject to the national law that applies.
For significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification. Intermediate reports can be requested by the authority.
NIS2 measures apply to the network and information systems an entity uses for its operations or services. For industrial operators, that normally includes the control systems that run the process.
Member states must allow fines of at least up to EUR 10 million or 2% of worldwide annual turnover for essential entities, and EUR 7 million or 1.4% for important entities, whichever is higher. National laws set the actual regime.
They help a great deal: an ISO/IEC 27001 ISMS supplies the management system, and IEC 62443 the OT technical controls. NIS2-specific items such as reporting deadlines, management training and supply-chain duties still need to be checked explicitly.
Share your objectives and constraints. We'll help you define a scope that fits your operations.