Cloud and security · Industrial
NIS2 compliance engineering for energy and manufacturing
We provide NIS2 compliance engineering for energy and manufacturing companies: determining whether and how the directive applies, implementing the cybersecurity risk-management measures it lists, building incident detection and reporting workflows that meet its deadlines, securing the supply chain and producing the evidence that management and supervisors expect. Obligations become engineering work with owners and dates, and you own the controls and the code.
Checklist · Industrial security
OT security, NIS2 and Cyber Resilience Act checklist
A checklist for operators and manufacturers of industrial and connected products: asset visibility, zones and conduits, remote access, monitoring, patching, recovery, supplier security and the regulatory duties of NIS2 and the Cyber Resilience Act.- 01Eight areas based on IEC 62443 practice, with testable checks.
- 02Incident detection and reporting items for NIS2 and the Cyber Resilience Act.
- 03Supplier and secure development questions for product makers.
- 04Seven questions to put to any vendor or engineering partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
Applicability and scoping
Assessment of whether each legal entity is an essential or important entity under the sector lists and size rules, in each member state where it operates. - 02
Risk analysis and security policies
A documented risk analysis and information system security policy, owned by management and reviewed regularly. - 03
Incident handling and reporting
Detection, classification and workflows to submit an early warning, an incident notification and a final report to the national authority within the required times. - 04
Business continuity and crisis management
Backup management, disaster recovery and crisis procedures for the systems that support essential services, tested on a schedule. - 05
Supply chain security
Assessment and contractual security requirements for suppliers and service providers, with monitoring and a register of critical dependencies. - 06
Secure acquisition and development
Security requirements in procurement and development, vulnerability handling and coordinated disclosure processes. - 07
Access control, authentication and cryptography
Identity and access management, multi-factor authentication, privileged access control and the use of cryptography and secured communications. - 08
Effectiveness testing
Policies and procedures to assess the effectiveness of the measures, including vulnerability scanning, penetration testing and exercises. - 09
Management accountability and training
Management approval and oversight of measures, training for management and staff, and records that show both.
Reference architecture.
Standards and interfaces
What we design against.
- Directive (EU) 2022/2555 (NIS2)
- The EU directive on measures for a high common level of cybersecurity, applying to essential and important entities in energy, transport, manufacturing of certain products and other sectors, as transposed into national law.
- Implementing regulations and national laws
- Technical and methodological requirements for certain entities, and the national transposition that sets the details of scope, supervision and penalties.
- ISO/IEC 27001 and 27002
- Information security management system and control catalogue that map closely to the directive's measures.
- IEC 62443
- Industrial automation security standards for the operational technology that energy and manufacturing entities depend on.
- ENISA guidance
- Technical guidance on implementing the security measures and on supply chain security.
- Incident classification and reporting rules
- National templates and channels for reporting significant incidents, with the three-stage timeline.
Data model
The core entities.
- Entity and service
- Legal entity, sector, size, classification, member states and essential services.
- Risk and measure
- Risk, measure, owner, status, evidence and review date.
- Incident and report
- Detection time, classification, reports submitted and their times, and lessons.
- Supplier and dependency
- Supplier, service, criticality, security assessment, contract clauses and review date.
- Test and finding
- Type, scope, results, findings and remediation.
- Training and approval record
- Management and staff training, approvals of policies and measures.
- Continuity plan
- Service, procedure, test dates and results.
When custom development is the right call.
Controls designed in, not added later.
Management responsibility
Management approves measures and oversees implementation, and the system keeps evidence of both.Rapid detection and escalation
Incident detection and escalation paths designed so early warnings can be made within the first day.Supplier accountability
Contracts require security measures, incident notification and audit rights from critical suppliers.Evidence integrity
Control evidence, incident reports and test results are stored unaltered and retrievable for supervisors.Tested continuity
Backups and recovery are tested, with attention to ransomware and loss of OT systems.
From discovery to a system you run.
- 01
Applicability and gap analysis
We determine the position of each entity under national law and compare current practice with the measures, in IT and OT. - 02
Roadmap and ownership
Gaps are turned into a prioritised roadmap with owners, budgets and dates, approved by management. - 03
Implement priority measures
Identity, backups, monitoring, segmentation, supplier requirements and the incident workflow are implemented first. - 04
Test and evidence
Measures are tested, exercises run and evidence is collected in one place. - 05
Operate and report
The programme runs with regular management reporting and continuous improvement.
Relevant work
Where to see our work.
Common questions.
- Is our company in scope of NIS2?
- It depends on the sector, the size and the member state's law. Energy, including oil and gas, and several manufacturing sectors are covered, with different obligations for essential and important entities. We assess each legal entity.
- What are the reporting deadlines?
- Significant incidents require an early warning within a day of becoming aware, an incident notification shortly after, and a final report afterwards. The exact times and templates are set by the directive and national authorities, which we build into the workflow.
- Does NIS2 cover operational technology?
- It covers the network and information systems that support essential services, which in energy and manufacturing includes operational technology. Industrial standards such as IEC 62443 are a practical way to meet the measures for OT.
- Are managers personally liable?
- The directive makes management bodies responsible for approving and overseeing the measures and allows sanctions on them in some circumstances. That is why training and evidence for management are part of the work.
- Who owns the controls and the code?
- You do. The controls, the automation and the evidence stay yours.