NIS2 and OT cybersecurity in industry
· by Equipo Nexum
OT cybersecurity for industry has stopped being an IT matter and become a legal obligation. With the NIS2 directive, thousands of plants across the EU must protect their control networks —PLCs, SCADA, production lines— as rigorously as their data. This guide explains, without the hype, who is in scope, what it requires and where to start.
1 What NIS2 is and why it hits industry
The NIS2 directive (EU Directive 2022/2555, Network and Information Security 2) is the European law that raises the minimum cybersecurity level across the sectors deemed critical. It replaces and widens the old 2016 NIS: it multiplies the covered sectors, tightens the obligations and, above all, pulls manufacturing and industry firmly inside the regulated perimeter.
The shift for a plant is that protecting office computers is no longer enough. NIS2 also requires you to assess and protect the networks and information systems that run the production process: the SCADA that supervises the plant, the PLCs that move the line, the HMIs, the drives and the industrial network that connects them. In other words, the OT world (Operational Technology).
2 Who it applies to: essential and important entities
NIS2 sorts the obligated organisations into two categories, with different supervision and penalty regimes:
As a rule of thumb, NIS2 applies if your organisation operates in one of the covered sectors and has 50 or more employees or more than EUR 10 million in turnover per year. Many factories and process plants fall in as an important entity, even if they don't see themselves as "critical infrastructure".
3 State of transposition across the EU
The European deadline to transpose NIS2 into national law expired on 17 October 2024. Many Member States missed it —the Commission issued reasoned opinions to most of them in 2025— and are bringing it in through national laws on staggered timelines:
- Spain is transposing in stages (Royal Decree-Law 7/2025 plus a pending Cybersecurity Coordination and Governance Act), with full enforcement expected in 2026.
- France missed the deadline and is enacting its national law, with enforcement phased over 2025-2026.
- Bulgaria adopted its NIS2 law (amendment to the Cybersecurity Act, State Gazette No. 17), in force from 13 February 2026.
The practical message is clear: the national law still being finalised is no excuse to wait. The core obligations (risk management and reporting) are already set in the directive, and a plant's technical adaptation takes months. Whoever starts now arrives on time. For official guidance, refer to your national CSIRT and to the EU agency ENISA.
4 Key obligations you must meet
NIS2 is not a checklist of products but a set of management obligations. These are the ones that hit an industrial plant hardest:
| Obligation | What it means for your plant |
|---|---|
| Risk management | Assess and treat cyber risk across IT and OT networks: inventory, segmentation, access control, backups, encryption. |
| Incident reporting | Early warning within 24 h, notification within 72 h and a final report within 1 month. |
| Management accountability | The management body approves and oversees the measures, and is personally liable for compliance. |
| Training | Regular awareness for staff, including management. |
| Continuity and response | Business-continuity plans, crisis management and tested backups. |
| Supply chain | Assess the security of suppliers and integrators. |
Non-compliance is costly: up to EUR 10 million or 2% of global turnover for essential entities, and up to EUR 7 million or 1.4% for important ones. More importantly, accountability sits with management, not just the systems department.
5 IT vs OT: why industrial security is different
The most expensive mistake is applying office-IT recipes to the plant. IT and OT have opposite priorities, and that changes everything:
| Criterion | IT | OT (industrial) |
|---|---|---|
| Priority | Data confidentiality | Availability and physical safety of the process |
| Life cycle | 3-5 years | 15-25 years (PLC, SCADA) |
| Patching | Frequent, near-automatic | Planned windows; often can't be stopped |
| Protocols | Designed with security | Legacy industrial, often without encryption or auth |
| Impact of a failure | Data leak or loss | Production halt, physical damage, risk to people |
That is why you can't "copy and paste" the IT model onto the factory. A heavy antivirus can take down an HMI; rebooting a device to update it can stop a whole line. OT security needs its own approach that understands the production process —the same knowledge used to design a SCADA system or to compare SCADA versus HMI.
6 OT security best practices (and where IEC 62443 fits)
Meeting NIS2 on the plant floor translates into concrete technical measures. The reference standard is IEC 62443, the international cybersecurity standard for industrial automation and control systems (IACS): while NIS2 sets the what (legal obligations), IEC 62443 provides the how with its zones and conduits model. These are the highest-impact practices:
The Purdue model organises the network into levels —from the field (sensors and actuators) to management (ERP)— and helps decide what talks to what. IEC 62443 refines it with zones (groups of assets at the same security level) and conduits (the controlled communications between them). Combining both is today the basis of any defensible OT architecture, and dovetails naturally with practices such as predictive maintenance, which also lives on that industrial network.
Frequently asked questions
What is the NIS2 directive and which industrial companies does it apply to?
NIS2 (EU Directive 2022/2555) is the European law that raises the minimum cybersecurity level in critical sectors. It applies to essential and important entities with 50 or more employees or more than EUR 10 million turnover operating in covered sectors, including energy, water, food, manufacturing of critical products, chemicals or transport. Many industrial plants fall in as an important entity.
When does NIS2 come into force?
The EU transposition deadline was 17 October 2024. Several Member States, including Spain and France, missed it and are transposing it in stages through national laws, with full enforcement and inspections expected during 2025-2026. Check your country's specific law, as competent authorities and exact dates vary.
What are the key NIS2 obligations for a plant?
Cybersecurity risk management across IT and OT networks, incident reporting (early warning within 24 h, notification within 72 h and a final report within one month), direct management accountability for the measures, training, business continuity and supply-chain security. Non-compliance can lead to fines of up to EUR 10 million or 2% of global turnover.
How does OT security differ from IT security?
In IT the priority is data confidentiality; in OT the priority is availability and the physical safety of the process. OT systems (PLC, SCADA, HMI) have very long life cycles, cannot be stopped for patching on demand and many industrial protocols were born without security. That is why OT needs its own approach rather than blindly copying IT practices.
What is the IEC 62443 standard and how does it relate to NIS2?
IEC 62443 is the international cybersecurity standard for industrial automation and control systems (IACS). It defines the zones and conduits model, security levels and requirements for vendors, integrators and operators. NIS2 sets the what (risk management and legal obligations); IEC 62443 provides the technical how to meet it in the OT environment.
Which OT security best practices should I apply first?
Start by inventorying all OT assets, segmenting the network to separate IT from OT following the Purdue model and IEC 62443 zones, controlling and logging remote access, managing SCADA and PLC patching with planned windows, and defining an incident response plan with tested backups. These are the measures with the highest impact and lowest relative cost.
The bottom line
NIS2 turns OT cybersecurity into a named obligation: risk management across the industrial network, incident reporting on tight deadlines and management accountability. It is not an IT project but a plant-continuity one —and the technical adaptation takes months, so it pays to start now.
The good news is that the first measures (inventory, segmentation, access) are the highest-impact ones and rest on process knowledge, not on buying boxes. See how we approach it in our secure SCADA systems.
Is your plant ready for NIS2?
We help you inventory, segment and secure your OT network —from PLC to SCADA— aligned with NIS2 and IEC 62443, without stopping production. Tell us about your case.
Talk to an OT security expertNexum Blog
Related articles
25 Jun 2026
Industrial robot price: 2026 buyer's guide
How much does an industrial robot cost in 2026: arm price by type, brand, payload and reach, integration costs and ROI. A clear guide to budgeting.
10 Apr 2026
Industrial Automation in Madrid: The Complete Guide 2026
Comprehensive Guide to Industrial Automation in Madrid: SCADA, Robotics, Electrical Panels, BMS, and Production Lines. Criteria for Choosing an Integrator.
26 Jun 2026
BMS for industrial buildings: cost & grants
How much a BMS costs in an industrial building (€15,000–120,000) and which IDAE grants, Next Generation funds and CAE certificates can finance it.