OT cyber security: what it is and how NIS2 changes it

What is OT cyber security?

NIST defines operational technology as programmable systems and devices that interact with the physical environment, or manage devices that do. Its guide to OT security, NIST SP 800-82 Rev. 3, covers:

• Industrial control systems (ICS), including supervisory control and data acquisition (SCADA) and distributed control systems (DCS)
• Programmable logic controllers (PLCs) and the sensors and actuators they drive
• Building automation and physical access control systems
• Transportation systems
• Systems that monitor and measure the physical environment
• The industrial internet of things (IIoT)

OT, ICS and industrial cyber security

OT cyber security, industrial cyber security and ICS security mean much the same thing in practice: keeping these systems safe, available and working as intended despite attacks, mistakes and failures. SCADA security is the part that covers systems spread over large areas, such as pipelines, grids and water networks.

How OT security differs from IT security

In IT, an incident usually means lost or stolen data. In OT, as NIST puts it, the logic running in the system has a direct effect on the physical world, so a failure can put lives at risk, damage the environment and cause severe financial losses. That changes the priorities:

• Safety comes first. NIST is blunt: any security measure that impairs safety is unacceptable.
• Availability comes next. Rebooting a system to fix a problem may not be acceptable while a process is running.
• Systems last longer. NIST puts the lifetime of OT at 10 to 15 years, against three to five for IT, so many sites still run operating systems that are no longer supported.
• Patching is slow. Both the vendor and the operator must test updates thoroughly, and outages have to be planned days or weeks in advance.
• IT tools can cause harm. NIST warns that applying IT security practices to OT indiscriminately can disrupt availability and timing.

What OT attacks look like

• Ukraine, December 2015: attackers remotely operated breakers at three regional electricity distribution companies, cutting power to about 225,000 customers. According to CISA, they also wiped systems with KillDisk malware and disabled serial-to-Ethernet devices at substations.
• TRITON, also known as TRISIS: malware built to attack Triconex safety controllers, the systems that shut a process down safely when something goes wrong. CISA says it was used against a foreign oil refinery, which shut down for several days.
• Colonial Pipeline, May 2021: ransomware hit the company's business systems, not its OT. The company still disconnected systems that monitor and control the physical pipeline so they would not be compromised. IT and OT security can't be planned separately.

Standards for OT security

• NIST SP 800-82 Rev. 3, the Guide to Operational Technology (OT) Security, published in September 2023: free guidance on OT risks, architecture and controls
• ISA/IEC 62443: a series of standards for securing industrial automation and control systems, developed by the International Society of Automation (ISA) and adopted by the IEC. It has parts for each role: security programmes for asset owners, requirements for service providers, risk assessment and security levels for systems, and secure development and technical requirements for components.
• Segmentation models such as the Purdue model, which NIST cites for organising OT networks in levels, with sensors and actuators at level 0

Core OT security controls

• Know what you have: an inventory of OT assets, firmware versions and connections
• Separate OT from IT and from the internet, and split OT into zones so an attack cannot spread freely. IEC 62443 calls these zones and conduits.
• Control remote access, especially for vendors and integrators, with multi-factor authentication and approval for each session
• Monitor OT networks for unusual traffic and for changes to controller logic
• Plan patches around the process: test first, patch in maintenance windows and add protections around what you can't patch
• Keep offline backups of controller logic and configurations, and practise restoring them
• Write incident response plans with operations and safety staff, including how to keep running manually

Does NIS2 cover OT?

Yes. NIS2 never uses the term, but Article 21 covers the network and information systems an entity uses for its operations, and its definition includes any device that processes digital data under a programme. PLCs, SCADA servers and engineering workstations all fit. NIS2 applies to medium and large organisations in the sectors listed in its two annexes, and many of them run OT:

• Energy: electricity, district heating and cooling, oil, gas and hydrogen
• Transport: air, rail, water and road
• Drinking water and waste water
• Waste management
• Manufacture, production and distribution of chemicals
• Production, processing and distribution of food
• Manufacturing of medical devices, computer, electronic and optical products, electrical equipment, machinery, motor vehicles and other transport equipment

What NIS2 changes for OT

The original NIS Directive of 2016 already covered electricity, oil, gas, transport and drinking water. NIS2 adds district heating and cooling, hydrogen, waste water, waste management, chemicals, food and manufacturing, so many plants now face EU cyber security law for the first time.

NIS2 also replaces national lists with a size rule. Under the first directive, each member state picked its operators of essential services. Under NIS2, every medium or large organisation in a listed sector is in scope.

Is your organisation in scope?

NIS2 applies to organisations in the listed sectors that count as medium-sized or larger under the EU's SME definition. In general, that means 50 or more staff, or annual turnover and balance sheet both above €10 million.

Large organisations in Annex I sectors, such as energy, transport and water, are essential entities. The rest are important entities unless the member state designates them as essential. Both have the same security and reporting duties, but essential entities face proactive supervision and higher maximum fines. Your national law has the final word, and it can bring in smaller organisations that are critical in your country.

What NIS2 asks of OT operators

Article 21 sets minimum measures. For an industrial operator, they reach the plant as well as the office:

• Risk analysis and security policies that cover OT, not only office IT
• Incident handling, business continuity, backups and crisis management for plant systems
• Supply chain security: you must consider the vulnerabilities of each direct supplier and service provider, and the quality of their products and security practices, including secure development. In OT that means automation vendors, integrators and maintenance contractors.
• Security in buying, developing and maintaining systems, including vulnerability handling and disclosure
• Access control, asset management and multi-factor authentication where appropriate
• Basic cyber hygiene and security training for staff

Reporting, accountability and fines

Significant incidents must be reported in stages: an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report within one month. Management bodies must approve and oversee the security measures, follow training themselves and can be held liable for failures.

Member states must be able to fine essential entities up to at least €10 million or 2% of total worldwide annual turnover, whichever is higher, and important entities up to at least €7 million or 1.4%.

OT is often left out

ENISA's NIS360 2026 report found that around two in five transport companies still exclude OT from their cybersecurity assessments, and that the gaps in the sector remain mainly because of legacy OT and IT systems. A NIS2 programme that stops at office IT leaves the systems with the most physical risk unchecked.

Other EU laws that reach OT

• The Cyber Resilience Act sets security requirements for hardware and software products with digital elements, which includes many products used in OT. Its reporting obligations apply from 11 September 2026 and its main obligations from 11 December 2027.
• The Machinery Regulation (EU) 2023/1230 applies from January 2027. Machinery must be protected against accidental or intentional corruption of its safety-critical software and data, and its control systems must withstand reasonably foreseeable malicious attempts by third parties that could create a hazard.

Where NIS2 stands in 2026

Most member states have written NIS2 into national law. In July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for not notifying full transposition.

The Commission's January 2026 proposal to amend NIS2 is still before the European Parliament. Until it is adopted, the current rules apply.

What good OT security help looks like

OT work needs people who understand both security and industrial operations. Typical needs are an OT asset inventory and risk assessment, a NIS2 gap assessment that includes plant systems, segmentation design, secure remote access for vendors, OT monitoring, incident response planning with operations staff, and IEC 62443 work for product makers and integrators.

Ask providers about their experience in your sector and with your control system vendors, whether they have worked on live plants, and how they avoid disrupting production during assessments and tests.

How CISO Talents helps

At launch you can post a NIS2 readiness request through a guided brief: how the rules apply to you, your deadline, the frameworks you already follow and whether you need a gap assessment first. Describe your plant and control systems in the summary. Verified vCISOs, consultants and firms that list NIS2 work see the request with the reason it matched them, and reply in the same format, so price, deliverables and timeline are easy to compare.