NIS2 tells you what to achieve. IEC 62443 tells you how.

Article 21 of NIS2 lists the measures an essential or important entity must take: risk analysis, incident handling, business continuity, supply chain security, secure maintenance and vulnerability handling, a way to assess whether all of it works, access control, multi-factor authentication. Read it twice and you will not find one line telling an automation engineer where to put a firewall.

IEC 62443 does tell you. It is the standard family written for industrial automation and control systems, and it addresses the asset owner, the integrator and the product supplier separately. That is the three-party reality of any plant, where the site owns the risk, the integrator builds the system and the supplier ships the controllers.

The mapping that does the work

In practice, most of the Article 21(2) measures land on a handful of 62443 parts:

• Risk analysis → the zone and conduit risk assessment of 62443‑3‑2
• Technical measures, access control and multi-factor authentication → the system requirements and security levels of 62443‑3‑3
• Supply chain and secure maintenance → the service provider requirements of 62443‑2‑4 and the product development requirements of 62443‑4‑1, which include vulnerability handling
• Incident handling and continuity → the asset owner’s security programme of 62443‑2‑1, revised in August 2024

The mapping will not write your NIS2 file for you. It does tell each team which document it already knows how to read.

The part people skip

The zone and conduit assessment is where every serious OT security programme starts, and the step most often replaced by a network diagram someone once drew in Visio. A VLAN is a network construct. A zone is a group of assets that share a target security level because they share a consequence: the same batch lost, the same safety function defeated, the same line stopped.

Defining zones that way forces a conversation between automation, quality, production and IT. In our experience it is the first time some of those people have discussed the same piece of equipment in the same room, and no diagram can stand in for it.

If nobody from production was in the room when the zones were drawn, they describe your network rather than your risk.

Start there. The technical measures follow from it, and so does most of the evidence your NIS2 documentation will need.

References

• Directive (EU) 2022/2555 (NIS2), Article 21: eur-lex.europa.eu
• ISA, ISA/IEC 62443 Series of Standards: isa.org
• IEC 62443-2-1:2024, Security program requirements for IACS asset owners: webstore.iec.ch