Standards and regulations
OT cybersecurity standards: European Union
EU law now sets binding cybersecurity duties for operators of essential services and for makers of connected products, implemented through national legislation in each member state.
Key standards and regulations
| Standard | Who it applies to | What it covers | OTVista modules |
|---|---|---|---|
| NIS2Directive (EU) 2022/2555Directive | Essential and important entities, including energy, transport, water, manufacturing and chemicals | Risk-management measures, supply-chain security, management accountability and staged incident reporting (early warning within 24 hours). Applied through national laws such as Sweden's Cybersecurity Act. | Standards & ComplianceGovernance & PolicyThird-party & Remote AccessDashboards & Reporting |
| CRACyber Resilience Act, Regulation (EU) 2024/2847Regulation | Manufacturers, importers and distributors of products with digital elements | Security-by-design and vulnerability handling for connected products. Vulnerability and incident reporting applies from 11 September 2026; most other obligations from December 2027. | Vulnerability & Advisory ManagementAsset Visibility |
| NCCSNetwork Code on Cybersecurity, Regulation (EU) 2024/1366Regulation | Electricity sector entities affecting cross-border flows | Sector-specific rules for cybersecurity risk assessment and minimum and advanced controls for high- and critical-impact electricity entities. | OT Risk ManagementStandards & Compliance |
| CERCritical Entities Resilience Directive (EU) 2022/2557Directive | Critical entities designated by member states | All-hazards resilience of critical entities, complementing NIS2's cyber focus. | OT Risk ManagementGovernance & Policy |
| Machinery RegulationRegulation (EU) 2023/1230Regulation | Machinery manufacturers and integrators | Adds essential requirements on protection against corruption, including cyber, for machinery placed on the EU market. Applies from January 2027. | Change ManagementAsset Visibility |
| CLC/TS 50701Railway applications: cybersecurityTechnical specification | Railway operators and suppliers | Applies IEC 62443 concepts to railway systems and safety assurance processes. | Zones & ConduitsOT Risk Management |
Summaries are for orientation only and are not legal advice. Applicability depends on your sector, size and jurisdiction, and regulations change. Confirm obligations with the official texts and your legal or compliance advisers. OTVista does not certify compliance.
Other regions
International
ISA/IEC 62443, ISO/IEC 27001 & 27002, ISO/IEC 27019, IEC 62351, IEC 61511, ISO 31000
ViewUnited Kingdom
NIS Regulations 2018, Cyber Security and Resilience Bill, NCSC CAF, HSE OG86, Cyber Essentials
ViewUnited States
NIST CSF 2.0, NIST SP 800-82 Rev. 3, NERC CIP, TSA Security Directives, AWIA 2018, CISA CPGs, DOE C2M2, CMMC 2.0
ViewMiddle East
NCA ECC-2:2024, NCA OTCC-1:2022, NCA CSCC, SACS-002, UAE IA Regulation, Dubai ISR, Qatar NIA
View
From the blog
Insights on European Union requirements
-
Regulation7 min
NIS2 in 2026: what OT operators should have in place now
National NIS2 laws are now being enforced. Here is what energy, water, transport and manufacturing operators should be able to show for their OT environments.
Read the article -
Regulation6 min
The Cyber Resilience Act's reporting duties are live: what changes for OT
Manufacturers must now report actively exploited vulnerabilities and severe incidents. Asset owners should expect more advisories, and suppliers need a working process.
Read the article -
Technology6 min
AI in OT security: where it helps and where it needs guardrails
AI can take the paperwork out of OT security, but control decisions must stay with engineers. A grounded look at useful applications and necessary guardrails.
Read the article
Preparing for NIS2 or another requirement?
We combine the OTVista Platform with compliance readiness services to get you audit-ready.