NIS2 can reach plant operators through their size and sector, and its risk-management and reporting duties extend to the OT systems that run production.
Directive (EU) 2022/2555, known as NIS2, sets cybersecurity risk-management and incident-reporting duties for essential and important entities in the sectors listed in its annexes. Many of those sectors run industrial plants, including energy, drinking water, waste water, and several manufacturing branches. Article 21 covers the network and information systems an entity uses for its operations, which for a plant includes the controllers, HMIs, and engineering tools that run production. OT owners therefore cannot leave that duty entirely to the IT team.
This is engineering guidance, not legal advice. National laws transpose the Directive, sector regulators add their own rules, and the text that applies in your country must be checked with counsel and the competent authority. The article maps the Directive's requirements to OT practice and lists the evidence an engineering team can produce. The statements are checked against the Directive text on EUR-Lex. The Commission's NIS2 page also reports a January 2026 proposal for targeted amendments, so confirm the current wording before relying on any detail.
Who is in scope and in which category
Article 2 applies to entities of the types listed in Annex I or Annex II that are medium-sized or larger, with some exceptions that apply regardless of size. Annex I covers high-criticality sectors such as energy (electricity, district heating and cooling, oil, gas, and hydrogen), drinking water, and waste water. Annex II covers other critical sectors, including manufacturing divisions for medical devices, computer and electronic products, electrical equipment, machinery, motor vehicles, and other transport equipment, together with chemicals, food production, and waste management.
Article 3 separates the two categories. Annex I entities that exceed the medium-sized ceilings are essential entities. Other entities in Annex I or Annex II are important entities, unless a Member State identifies them as essential under the rules in Article 2. A manufacturer is therefore usually in the important category, but the classification is a national decision to confirm.
Typical starting categories, to be confirmed locally, are listed below.
- Electricity producer or distribution operator: Annex I, energy. Essential if above the medium-sized ceilings.
- Oil refining or storage operator: Annex I, energy (oil). Essential if above the medium-sized ceilings.
- Drinking water supplier: Annex I, drinking water. Essential if above the medium-sized ceilings.
- Industrial waste water treatment undertaking: Annex I, waste water. Essential if above the medium-sized ceilings.
- Machinery or electrical equipment manufacturer: Annex II, manufacturing. Important if medium-sized or larger.
- Food producer with industrial processing: Annex II, food. Important if medium-sized or larger.
- Chemical manufacturer: Annex II, chemicals. Important if medium-sized or larger.
Governance and management accountability
Article 20 places the responsibility at management level. Member States must ensure that the management bodies of essential and important entities approve the risk-management measures, oversee their implementation, and can be held liable for infringements of Article 21. Members of those bodies must follow training, and entities should offer similar training to employees on a regular basis.
- Approval record. Keep a dated decision in which plant management or the board approves the OT measures and the residual risks it accepts.
- Regular OT reporting. Give management a short report on OT risk, open gaps, and incident readiness, not only IT security metrics.
- Training evidence. Record training for managers who sign off OT risk decisions, alongside operator and engineer training.
Mapping the Article 21 measures to OT practice
Article 21(2) lists at least ten areas. The measures must be appropriate and proportionate, must take account of the state of the art and, where applicable, relevant European and international standards, and must consider the cost of implementation (Article 21(1)). The table maps each area to evidence an OT team can produce.
| Article 21(2) area | Plain meaning | OT evidence to keep |
|---|---|---|
| (a) Risk analysis and security policies | Documented risk analysis and approved policy | Zone-based risk assessment; approved OT security policy |
| (b) Incident handling | Detect, respond to, and learn from incidents | OT incident playbook; drill records |
| (c) Business continuity, backup, disaster recovery, crisis management | Keep production running, restore systems, coordinate | Backup register; restore test results; crisis roles |
| (d) Supply chain security | Security with direct suppliers and service providers | Vendor security requirements; integrator access terms |
| (e) Acquisition, development, maintenance, vulnerability handling | Secure change, patching, and vulnerability process | Vulnerability register; patch and change records |
| (f) Assessing effectiveness | Testing that the measures work | Audit and test reports reviewed by management |
| (g) Basic cyber hygiene and training | Routine practice and skills | Training records for operators and engineers |
| (h) Cryptography and encryption | Policies for the use of cryptography | Protocol and remote-access encryption standard |
| (i) HR security, access control, asset management | People, permissions, and inventory | Joiner-mover-leaver log; access reviews; asset inventory |
| (j) Multi-factor or continuous authentication, secured communications | Strong authentication and secured channels | MFA on remote and privileged paths; secured emergency channel |
Supplier and vendor access
Article 21(3) asks entities to consider the vulnerabilities specific to each direct supplier and service provider, the overall quality of their products and cybersecurity practices, including secure development procedures, and the results of coordinated supply-chain risk assessments. For a plant, the practical equivalent is a written set of security terms for integrators and vendors, and a controlled remote-access process. The OT vendor remote access workflow shows one way to run that process.
Incident reporting timeline
Article 23 sets the notification stages for a significant incident. An incident is significant if it has caused or can cause severe operational disruption or financial loss, or if it has affected or can affect other persons with considerable material or non-material damage (Article 23(3)). The stages below run from the moment the entity becomes aware of the significant incident.
- Decide significance in advance. Agree with operations what severe disruption means for each plant, in terms that can be judged in the first hours.
- Keep the templates and contacts ready. Name the people who sign off each notification and keep the national reporting route documented.
- Timestamp the decisions. Record detection, containment, and escalation times, because the 24 and 72 hour clocks start from awareness.
- Preserve OT evidence. Keep historian data, controller logs, and engineering-workstation records in storage that the same incident cannot erase.
- Early warning within 24 hours. Say whether the incident is suspected of being caused by unlawful or malicious acts, and whether it could have a cross-border impact (Article 23(4)(a)).
- Incident notification within 72 hours. Update the early warning, give an initial assessment of severity and impact, and include indicators of compromise where available (Article 23(4)(b)).
- Intermediate report. Provide one when the CSIRT or competent authority asks for it (Article 23(4)(c)).
- Final report within one month of the incident notification, covering a detailed description, the likely threat type or root cause, applied mitigation, and any cross-border impact (Article 23(4)(d)).
Use standards as the structure, not as the legal test
NIS2 does not name an OT standard. Article 21(1) refers to relevant European and international standards where applicable. The ISA/IEC 62443 series is widely used for OT security programs and asset owner requirements, which makes it a practical structure for the Article 21 evidence. For the detailed design, see the IEC 62443 standards overview and the ICS security governance article. ICS risk assessment provides the method behind the Article 21(2)(a) evidence.
Apply this to your project
- Annex category, size status, and national classification confirmed with counsel or the competent authority, with the basis recorded.
- Every OT zone mapped to the Article 21(2) areas, with an owner and the evidence for each area.
- Restoration of controller programs and HMI configuration from backup tested, and the results kept.
- OT asset inventory current, including vendor-owned devices and devices reachable remotely.
- Vendor and integrator access approved, time-limited, logged, and covered by written security terms.
- Reporting steps for the 24-hour, 72-hour, and one-month stages rehearsed with the people who would sign them.
Follow an ASP project guide to connect the fundamentals with implementation and acceptance.
Frequently asked questions
Is a manufacturing plant covered by NIS2?
It can be. The manufacturing entry in Annex II covers specific NACE divisions, including machinery, electrical equipment, computer and electronic products, motor vehicles, other transport equipment, and medical devices. The entity must also be medium-sized or larger, unless an exception applies. Coverage depends on the legal entity and its activities, so confirm it with the national authority.
What is the difference between an essential and an important entity?
Essential entities are mainly the larger entities in Annex I sectors, plus others that a Member State identifies. Important entities are the remaining entities in Annex I or Annex II. The Directive differentiates the supervisory and enforcement regimes for the two categories, and national law sets the details. Record the classification and the reasons for it.
Does NIS2 require a specific OT standard such as IEC 62443?
The Directive does not name one. Article 21(1) asks for measures that take account of relevant standards where applicable. IEC 62443 is a common structure for OT security programs, so it gives a defensible basis for the evidence, but the choice of approach and the proof of compliance remain the entity's responsibility.
How quickly must an OT incident be reported?
For a significant incident, the Directive requires an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification. Intermediate reports are made on request. Whether an incident is significant depends on Article 23(3) and national guidance, so decision rules should be agreed before an incident occurs.
Is this article legal advice?
No. It is engineering guidance based on the Directive text and the Commission's published summary. National laws, sector rules, and any amendments can change the obligations. Confirm which duties apply to your entity with qualified legal counsel and the competent national authority.
Continue the engineering work
- IEC 62443 Industrial Cybersecurity Standards
- ICS Security Governance: Policies, Procedures and IEC 62443-2-1
- ICS Security Risk Assessment Methodology (IEC 62443-3-2)
- Supply Chain Security for Industrial Automation (IEC 62443-2-4)
- ICS Incident Response and Recovery
Browse the related technical library or follow an ASP project guide to plan the implementation sequence.
Primary references and further reading
Use the original specifications and product documentation for implementation details. Examples in this guide are illustrative engineering scenarios, not published project results.