NIS2 for an industrial site: scope, evidence, and a clock that starts at awareness

Directive (EU) 2022/2555 replaced the 2016 NIS Directive. It covers far more organisations, asks more of them, and turns cyber resilience from good practice into a legal obligation.

The real shift is not the list of measures. NIS1 looked at services; NIS2 looks at entities. The perimeter is wider, supervision is stronger, and capability has to be demonstrable. There is no uniform technical checklist. What the Directive wants is risk management you can prove, steered by the board.

This piece is written for an industrial site, because that is where the abstract obligations get awkward.

Am I in scope?

Work through it in this order: size, then sector, then status.

Size. NIS2 uses the EU definition of enterprise size. You are at least medium-sized with 50 or more employees, or with both annual turnover and balance sheet above €10 million. You are large with 250 or more employees, or with turnover above €50 million and a balance sheet above €43 million. The bar is low, much lower than most industrial companies assume the first time they hear about NIS2.

Sector. Annex I lists the sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space. Annex II lists other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (which covers medical devices, machinery and several other product groups), digital providers, research.

Pharmaceutical manufacturing sits in Annex I, under health. Chemicals, food, medical devices and machinery are Annex II.

Status. Annex I and large: essential entity. Annex I and medium: important. Annex II, medium or large: important.

Four practical points settle most real cases:

• What you actually do counts, more than the registered activity code or the company name.
• Being above the threshold does not make you essential. Status comes from the combination, not from size alone.
• Some entities are in scope whatever their size, and a national authority can designate an entity that would otherwise fall outside.
• Groups are assessed entity by entity, but shared IT and real dependencies widen the perimeter in practice. A subsidiary that is out of scope on paper and runs on the group’s shared infrastructure is not out of scope operationally.

Whatever you conclude, write it down. “We assessed ourselves as out of scope” holds up if there is a dated analysis behind it. Without one, it does not.

What Article 21 actually asks for

Ten minimum measures, deliberately written as outcomes rather than prescriptions:

1. Risk analysis and information system security policies
2. Incident handling
3. Business continuity: backups, disaster recovery, crisis management
4. Supply chain security
5. Security in acquisition, development and maintenance, including vulnerability handling
6. Assessment of the effectiveness of the measures
7. Cyber hygiene and training
8. Cryptography and encryption
9. Human resources security, access control and asset management
10. Multi-factor or continuous authentication, secured communications

The Directive rests on proportionality: measures must match the risk, the size, the sector and the impact of the entity. That protects you, but it is not a loophole. A small entity is not held to a bank’s standard, and in return you must be able to explain why what you did is proportionate.

Where this gets specific in OT

Read that list again with a plant in mind and three items change character.

• Item 3, backups and recovery, means controller programs, HMI projects, drive parameters and recipes, not only servers. And it means a restore that has actually been performed and timed, not a backup job that reports success.
• Item 5, vulnerability handling, runs straight into a fleet that is rarely patched because patching needs a shutdown and, on a GMP site, revalidation. NIS2 does not expect “we patch everything”. It expects a documented, risk-based decision, with compensating controls where patching is not possible. That holds up. “We never patch OT” does not.
• Item 4, supply chain, covers your integrators and their remote access to your line. This is the clause that turns a vendor VPN nobody owns into a regulatory exposure.

Governance: what changes for management

Article 20 is the provision that changes behaviour. It moves cybersecurity from a technical subject to a matter of decisions, trade-offs and accountability.

Management bodies must approve the risk-management measures and oversee their implementation, and they can be held liable for infringements. In practice that means deciding priorities and budgets, accepting or refusing risks explicitly, and keeping a record of that steering that someone else can read and use.

Article 20(2) adds that members of management bodies must follow training, so that they can identify and assess cyber risk themselves rather than delegate the judgement entirely.

What you should be able to show when asked:

• an approved information security policy;
• defined roles and responsibilities;
• management reviews that actually took place, with minutes;
• risk decisions, including the risks knowingly accepted, and by whom;
• a cyber dashboard that somebody reads;
• evidence that the management training happened.

The clock, and why it is the hardest part

Article 23 sets three deadlines, one after the other:

• 24 hours: early warning. Say that something is happening, whether you suspect unlawful or malicious action, and whether it could have a cross-border impact. Speed over completeness. Nobody expects you to know what happened yet.
• 72 hours: incident notification. Update the warning with an initial assessment: severity, impact, and indicators of compromise where you have them. This one needs substance, which means evidence had to be kept from hour one.
• One month: final report. Severity and impact, the likely root cause, the mitigation applied. If the incident is still running, a progress report instead. This report is read closely, and it becomes evidence.

The authority can also ask for intermediate reports. And where appropriate, you must tell the recipients of your services, without undue delay, about a significant incident likely to affect them.

The clock does not start at the attack. It starts when you become aware of a significant incident. An incident is significant if it has caused, or could cause, severe operational disruption or financial loss for the entity, or considerable damage to other people or organisations.

Three operational consequences follow, and they explain why this is the most underestimated part of every NIS2 programme.

First, someone must be able to qualify an incident as significant, quickly, at any hour. The clock runs at night, at weekends and during shutdowns. If qualification depends on one person and that person is on holiday, the deadline is already at risk.

Second, the decision to notify needs a named owner and an agreed path. In most industrial groups that is a central security function together with legal, not the local site; the site’s job is to escalate fast and keep the evidence. Working this out during the incident costs hours you do not have.

Third, evidence collection starts before you know it matters. Logs, disk images, a timeline. The 72-hour notification is built from what was captured in the first hour, and you cannot go back for it.

The legal text is the easy part. Qualifying quickly, escalating, deciding and producing the right evidence inside the deadlines is the hard part, and it is solved by rehearsal, not by documentation.

Supervision and penalties

Fines are for failing the obligations. You do not have to be breached to be fined.

• Essential entities: up to €10 million or 2% of total worldwide annual turnover, whichever is higher, and proactive supervision, including inspections that do not wait for an incident.
• Important entities: up to €7 million or 1.4%, with supervision that is mostly ex post, once something comes to light.

Beyond fines, authorities can order security audits at your expense, issue binding instructions and require you to inform the users of your services. For essential entities, they can go as far as temporarily suspending a certification or authorisation, or barring a manager from exercising managerial functions.

Compliance is judged less by the number of controls than by how coherent the whole arrangement is and how good the evidence is.

Where transposition stands, with a caveat

Member States had until 17 October 2024 to put NIS2 into national law. Most missed the date. The Commission sent letters of formal notice to 23 of them in November 2024, then reasoned opinions to 19 in May 2025 for failing to notify full transposition.

Counts of how many have transposed since then vary with the method: primary legislation only, or full transposition including the implementing texts. Treat any single headline figure with care.

France shows the nuance well. Its transposition bill, which covers NIS2, the critical entities directive and the DORA directive together, was adopted by the Senate in March 2025 and examined by a special committee of the National Assembly in September 2025. At the time of writing it has still not been finally adopted. Even once it is, most technical requirements will come through decrees and ANSSI texts, and obligations will phase in.

So the honest statement is not “the grace period is over everywhere”. It is this: the direction is certain and the obligation is coming everywhere; the enforcement calendar varies by country, and the preparation time is shorter than that calendar suggests. The hard parts, the 24-hour capability, the supplier clauses, the evidence pack, take longer to build than decrees take to publish.

The blind spots that sink NIS2 programmes

It is rarely the tools that are missing. It is the coherence.

• Critical suppliers. Map the real dependencies, not only the ones under contract. The supplier who can reach your line is critical whether or not purchasing classified them that way.
• Cloud, MSP and MSSP. Some digital providers carry more detailed EU requirements of their own. Know which of yours do.
• Privileged access. Reduce it, review it, trace it, put multi-factor in front of it. In practice it is the most audited item of all.
• Vulnerabilities. Prioritise by exposure and business criticality, not by CVSS score alone. In OT the score often misleads.
• Backups. Test the restore, not the backup.
• Leavers and role changes. The account of someone who left eight months ago is a finding that writes itself.

Frameworks: useful, and not a substitute

NIS2 sets the what. Frameworks help organise the how. ISO/IEC 27001 structures governance, risk and continual improvement. EBIOS RM, ANSSI’s risk method, helps build the critical scenarios. For the plant itself, IEC 62443 brings zones, conduits and security levels.

None of them exempts you from the notification deadlines, management accountability, supply chain obligations or sector rules. A certificate is evidence of a management system, not a discharge of the Directive.

A defensible trajectory

1. Qualify whether the entity is in scope, and document the conclusion, whichever way it goes.
2. Identify critical services, key assets and major dependencies.
3. Compare what exists against the ten measures of Article 21, and record the gaps.
4. Set up governance: roles, reporting, risk decisions, management reviews.
5. Make incidents, continuity and suppliers reliable. Rehearse the 24-hour path at least once.
6. Build the evidence pack and a twelve-month improvement plan.

A credible piece of evidence is not just produced. It is dated, linked to a risk, understood by the teams, and usable again in an incident or an inspection.

NIS2 is a governance, resilience and evidence programme, not a documentation project. And the part that takes longest to build is the part that has to work at three in the morning.

References

• Directive (EU) 2022/2555: Articles 20, 21, 23, 32–34 and Annexes I–II.
• European Commission, Commission calls on 19 Member States to fully transpose the NIS2 Directive, 7 May 2025: digital-strategy.ec.europa.eu.
• Sénat, Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité, legislative file: senat.fr.
• Structure of this summary informed by the NIS2 synthesis published by William Wougang.