NIS2, without
halting production.
The EU's NIS2 directive is in force. If you run essential or important infrastructure in the Netherlands, you're in scope — and your OT environment is now part of the audit.
10,000+
Dutch entities in scope
24h
Window for incident notification
€10M+
Maximum administrative fines
Personal
Liability for board members
Two categories. Both come with teeth.
NIS2 splits in-scope organizations into essential and important entities. Both face mandatory measures, supervision and fines — the difference is intensity, not optionality.
Critical to society. Subject to active oversight and inspection by the regulator.
- Energy
- Transport
- Banking
- Financial markets
- Health
- Drinking water
- Wastewater
- Digital infrastructure
- Public administration
- Space
In scope, but supervised after-the-fact (typically following an incident or report).
- Postal services
- Waste management
- Manufacturing of chemicals & food
- Manufacturing of medical devices
- Digital providers
- Research
Six minimum measures. All have OT implications.
NIS2 lists ten minimum cybersecurity measures. Six of them collide directly with the realities of OT — and that's where most organizations get stuck.
01
Risk management
Documented risk analysis and policies covering your OT and IT estate.
02
Incident reporting
Significant incidents reported within 24 hours, follow-up within 72 hours.
03
Supply chain security
Direct supplier and service-provider risks must be assessed and managed.
04
Business continuity
Backup management, disaster recovery and crisis management — tested.
05
Cyber hygiene & training
Basic security practices and awareness training across the organization.
06
Cryptography & access control
Policies on encryption, multi-factor authentication and identity management.
A path to compliance that doesn't require an audit panic.
We've walked NIS2 paths with airports, ports and energy operators. The work is tractable when phased correctly.
Scope & gap analysis
We map your entities against NIS2 scope criteria, then run a gap analysis against the obligations — including your OT-specific risks.
Output
Scoping report + prioritized gap list
Roadmap & quick wins
We produce a 12-24 month roadmap, separating quick wins (segmentation, MFA, IR plan) from structural programs (continuous monitoring, supply-chain).
Output
Roadmap signed off with your CFO and CISO
Implementation
Our engineers and consultants execute alongside your team — from AX-BOX deployments to policy authoring and tabletop exercises. No production halts.
Output
Hardened environment, ready for audit
Ongoing assurance
24/7 monitoring through our SOC, annual reassessment, and continuous evidence collection so the next audit isn't a fire drill.
Output
Continuous compliance, not a once-a-year scramble
Stop guessing whether you're NIS2-ready.
Book a 30-minute readiness call. We'll walk through your scope, your OT estate, and the realistic path to compliance.
Book a readiness call