Skip to content
SOC for OT

EU · NIS2

NIS2 and OT monitoring: what the directive means for your SOC

By 2 min read
Jurisdiction
EU
In force since
Legal status verified

Key takeaways

  • NIS2 applies to medium and large organisations in 18 sectors, including energy, water, transport, chemicals, food and manufacturing.
  • Article 21 lists minimum measures, including incident handling and business continuity.
  • Article 23 sets reporting deadlines of 24 hours, 72 hours and one month.
  • National laws implement NIS2 — check your country's version (e.g. the Dutch Cyberbeveiligingswet or the German NIS2UmsuCG).

What is NIS2?

NIS2 is the EU directive on measures for a high common level of cybersecurity across the Union. It entered into force on 16 January 2023 and member states had to transpose it into national law by 17 October 2024. It replaces the original NIS Directive and greatly expands the number of sectors and organisations in scope.

Which organisations does NIS2 cover?

NIS2 applies to medium-sized and large entities in sectors of high criticality (such as energy, transport, drinking water, waste water and health) and other critical sectors (such as manufacturing, chemicals, food, and waste management). Entities are classified as essential or important, which mainly affects supervision and fines. Some entities are in scope regardless of size.

What does NIS2 require that affects OT monitoring?

NIS2 obligations and the OT SOC capabilities that support them
NIS2 obligationWhat it means in OTOT SOC capability
Art. 21(2)(a) Risk analysis and security policiesKnow your OT assets, zones and the risks to themPassive asset inventory and communication mapping
Art. 21(2)(b) Incident handlingDetect, analyse and contain incidents in control networks24/7 monitoring, OT use cases, safety-aware playbooks
Art. 21(2)(c) Business continuityRecover control systems and production safelyVerified PLC/config backups, recovery runbooks, exercises
Art. 21(2)(d) Supply chain securityControl vendor and integrator accessMonitoring of remote-access sessions and engineering connections
Art. 21(2)(f) Effectiveness assessmentProve that controls workDetection coverage metrics, purple-team tests, KPIs
Art. 23 ReportingReport significant incidents on timeEarly detection, triage and evidence for 24h/72h/1-month reports

How fast must incidents be reported under NIS2?

24 hours

Deadline for the early warning to the CSIRT or competent authority after becoming aware of a significant incident (NIS2 Article 23), followed by a notification within 72 hours and a final report within one month.

— Directive (EU) 2022/2555, Art. 23, 2022

The clock starts when the entity becomes aware of a significant incident. Without monitoring in the OT network, an intrusion may go unnoticed for weeks — and the organisation has little evidence to assess whether the incident is significant.

How does NIS2 relate to IEC 62443?

NIS2 states what must be achieved; IEC 62443 describes how to secure industrial automation and control systems. IEC 62443-3-3 includes requirements for audit logs (SR 6.1) and continuous monitoring (SR 6.2), which map directly onto OT SOC capabilities. Using IEC 62443 as the technical baseline is a common way to demonstrate “state of the art” measures under NIS2.

What should you do now?

  1. Check your status under your national implementation (essential, important or out of scope) and register where required.
  2. Include OT in scope of your risk analysis, not just office IT.
  3. Close the visibility gap: deploy passive monitoring at critical OT conduits.
  4. Write and test a reporting runbook that gets from OT alert to 24-hour early warning.
  5. Contract carefully: if you outsource monitoring, make sure the provider covers OT and supports your reporting deadlines.

Frequently asked questions

Does NIS2 apply to OT?

Yes. NIS2 covers the network and information systems an entity uses for its operations or services. For manufacturers, utilities and other operators, that explicitly includes the operational technology that runs their processes.

Does NIS2 require a SOC?

NIS2 does not require a SOC by name. It requires appropriate and proportionate measures, including incident handling, and timely reporting of significant incidents. A SOC — in-house or managed — is the most common way to detect incidents early enough to meet the 24-hour early-warning deadline.

What are the NIS2 reporting deadlines?

An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month after the notification (Article 23).

Sources

  1. Directive (EU) 2022/2555 (NIS2) — EUR-Lex
  2. NIS2 Directive — policy page — European Commission
  3. ISA/IEC 62443 series of standards — International Society of Automation

Related reading