NIS 2 and UK NIS, plant-wide, with OT included

NIS 2 tells you what to achieve, but not how to achieve it in a control room. We make the whole site compliant, OT included, and map it to each country's NIS 2 transposition (such as CyFun® in Belgium) or to UK NIS and the NCSC CAF.

Art. 21Ten cybersecurity risk-management measures

24 h · 72 h · 1 monthEarly warning, notification, final report (Art. 23)

Art. 20Management bodies approve, oversee and are trained

Per countryNational transpositions, e.g. Belgium's NIS2 law and CyFun®

The OT gap

Why IT-led NIS 2 programmes stall at the plant fence

Most NIS 2 programmes start from an ISMS written for offices and data centres. In a plant, the same measures collide with safety cases, turnaround windows, vendor-owned systems and 20-year asset lifecycles. Patching, MFA or backup policies that are right for IT can be unsafe or impossible on a DCS or SIS.

We start from the OT side. Each NIS 2 measure is implemented through IEC 62443 controls that operators and maintenance teams can actually run, while one group baseline still satisfies every national regime you report to.

Multi-country operator? One group baseline mapped to each national transposition (for example Belgium and Poland) and to UK NIS, instead of one project per country.

What you get

From scoping to supervisor-ready evidence

Entity classification (essential or important) and scope per site and country
One group baseline mapped to every national regime, including CyFun® in Belgium and the NCSC CAF in the UK
OT controls specified with IEC 62443 and integrated with your ISO/IEC 27001 ISMS (A1 USMS)
Incident reporting procedures that fit your plant emergency response (D2)
Management-body training as required by Art. 20 (E2)
Supervisor-ready evidence and audit preparation

NIS 2 in the control room

Art. 21(2) measures, implemented through IEC 62443

How we typically anchor each NIS 2 measure in the IEC 62443-2-1:2024 security program elements (SPEs) and the companion parts of the series.

NIS 2 Art. 21(2)	Measure	IEC 62443 anchor
(a)	Risk analysis and information system security policies	`ORG` security program; IEC 62443-3-2 risk assessment
(b)	Incident handling	`EVENT`
(c)	Business continuity, backup management, disaster recovery, crisis management	`AVAIL`
(d)	Supply-chain security	`ORG`; IEC 62443-2-4 service providers; IEC 62443-4-1 / -4-2 for products
(e)	Security in acquisition, development and maintenance, incl. vulnerability handling	`CM` `COMP`; IEC 62443-3-3
(f)	Assessing the effectiveness of measures	`ORG`; SL verification and audits
(g)	Basic cyber hygiene and training	`ORG` `COMP`
(h)	Cryptography and encryption	`DATA`
(i)	Human resources security, access control, asset management	`USER` `CM`
(j)	Multi-factor authentication, secured communications	`USER` `NET`

Indicative mapping at SPE level. In an engagement, we map to individual requirements and to your national framework (for example CyFun® or the NCSC CAF).

Related services

How we help

NIS 2 and UK NIS / CSRB, plant-wide

Entity classification, group baseline, national mapping, supervisor-ready evidence.

Unified Security Management System

IEC 62443 integrated with ISO/IEC 27001: one management system for IT and OT.

Gap assessments

Your current state against NIS 2 or UK NIS, IEC 62443-2-1 and ISO/IEC 27001, with a roadmap around your turnarounds.

OT incident response

Playbooks aligned with your plant emergency response and your NIS 2 or UK NIS reporting duties.

Related training

Which of your sites are in scope, and under which regime?

Tell us where you operate. We will come back with a scoping proposal and a practical first step.

Talk to us

References: Directive (EU) 2022/2555 (NIS 2), Arts. 20, 21 and 23; Belgian NIS2 law of 26 April 2024, in force since 18 October 2024 (Centre for Cybersecurity Belgium). This page is general information, not legal advice.