NIS2 for Industry: Specific Requirements, Penalties, and OT Action Plan

April 28, 2025 · 12 min read

12 min read

IoT Infrastructure

The NIS2 Directive has been in effect in France since October 2024. It affects thousands of industrial companies that weren’t expecting it—and penalties can reach 10 million euros or 2% of global revenue. Even more challenging: NIS2 specifically targets OT (Operational Technology) networks—those industrial systems for which cybersecurity has, until now, been a secondary concern.

This guide demystifies NIS2 for manufacturers: who is affected, what concrete measures to implement on your automation networks, and how to develop a realistic action plan.

NIS2: The Big Picture in 3 Minutes

The Network and Information Security 2 (NIS2) Directive is an update to the 2016 NIS1 Directive. It was adopted by the European Union in December 2022 and was to be transposed into the national law of each member state by October 2024.

Why this update? NIS1 covered approximately 500 entities in France (Essential Service Operators). NIS2 significantly expands this scope: it is estimated that 15,000 to 20,000 French entities are now affected, compared to 500 previously.

What’s fundamentally changing for the industry: NIS2 explicitly includes OT systems within its scope. Automation networks, SCADA systems, PLCs, and monitoring systems—all of these are now subject to specific security requirements.

French transposition in progress

The French law transposing NIS2 was in the process of being adopted in early 2025. Specific deadlines and procedures may change depending on the final text adopted by the National Assembly. Follow ANSSI’s announcements for updates.

Does NIS2 apply to you?

NIS2 distinguishes between two categories of entities based on the criticality of their operations and their size:

Essential Entities (EE) — Enhanced Oversight

Sectors covered:

Energy: electricity (generation, transmission, distribution), natural gas, oil, hydrogen
Transportation: air, rail, maritime, road
Healthcare: hospitals, manufacturers of critical medical devices
Drinking water and sanitation
Digital infrastructure: DNS, IXP, data centers, cloud, communication networks
Central and regional government
Space

Size criterion: medium or large company (> 50 employees or > 10 M€ in annual revenue) in one of these sectors.

Significant Entities (SE) — Reporting Compliance

Sectors covered:

Manufacturing: chemicals, food and beverage, non-critical medical devices, electrical equipment, industrial machinery, automotive
Postal and delivery services
Waste management
Manufacturing, production, and distribution of chemicals
Digital service providers

Size criterion: large company (> 250 employees or > 50 M€ in revenue) in these sectors.

How do you know if this applies to you?

Your Business	Size	Probable Category
Energy producer or distributor	Any size (if ESE)	EE
Drinking water or wastewater treatment operator	> 50 employees or > 10 M€	EE
Food manufacturing plant	> 250 employees or > 50 M€	EI
Industrial machinery manufacturer	> 250 employees or > 50 M€	EI
Subcontractor in a critical sector	Depends on the contract	Potentially EI
Automation integrator	> 250 employees or > 50 M€	EI
Industrial SME < 50 employees	< thresholds	Not directly affected

SMEs are not directly affected... but

Industrial SMEs (< 50 employees) are not directly subject to NIS2. However, if they are subcontractors to an EE or EI (e.g., maintenance provider, integrator, control system supplier), their clients will impose similar security requirements on them contractually. Being proactive is good business practice.

The 10 Specific NIS2 Requirements for Your OT Network

Article 21 of the NIS2 Directive defines the mandatory security measures. Here is how they translate into practice for an OT industrial environment.

1. Risk Analysis and Security Policy

Requirement: Establish and maintain a cyber risk management policy that includes OT systems.

In practice:

Map all OT assets (PLCs, SCADA systems, RTUs, networked sensors, gateways)
Identify threats and vulnerabilities for each asset
Classify assets based on their criticality (production, safety, environmental)
Draft an OT security policy signed by management

OT Considerations: The inventory must include equipment that is not managed by your IT department (controllers under manufacturer maintenance contracts, SCADA systems from third-party providers, modems embedded in third-party machines).

2. Security Incident Management

Requirement: Procedures for incident detection, response, and notification.

In practice:

Define what constitutes a “security incident” in your OT context (unauthorized access, abnormal PLC behavior, network anomaly)
Draft the response procedure: who alerts whom, in what format, and within what timeframe
Mandatory notification to ANSSI within 24 hours for significant incidents (EE) or 72 hours (EI)
Final report to ANSSI within 1 month

3. Business Continuity

Requirement: Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) covering OT systems.

In practice:

Identify critical OT systems whose downtime would impact production or safety
Define the RTO (Recovery Time Objective) and RPO (Recovery Point Objective) for each system
Test the disaster recovery plan at least once a year
Document manual recovery procedures in case an automated system is compromised

4. Supply Chain Security

Requirement: Assess and manage cyber risks associated with suppliers and service providers.

In practice:

Include security clauses in contracts with OT maintenance providers
Require security audits or certification from critical subcontractors
Monitor service providers’ remote access (no permanent, unsupervised access)
Verify the cybersecurity policies of suppliers of embedded components (firmware, PLC operating systems)

5. Security in System Development and Maintenance

Requirement: Incorporate cybersecurity into the system lifecycle.

In practice:

Require security testing when integrating new OT equipment
Document PLC security configurations (passwords, access, active services)
Apply security patches from manufacturers (Siemens ProductCERT, Schneider Electric CyberSecurity, etc.)
Disable unnecessary services on PLCs (FTP, Telnet, unencrypted HTTP)

6. Asset and Vulnerability Management

Requirement: Vulnerability assessment and management process.

In practice:

Maintain an up-to-date inventory of all OT equipment (model, firmware, version)
Monitor CVE alert feeds for your equipment (Siemens, Schneider, Rockwell, etc.)
Address critical CVEs (CVSS ≥ 9) within 72 hours (isolate the device if a patch is not available)
Address high-severity CVEs (CVSS 7–8.9) within 30 days

7. Strong Authentication and Access Control

Requirement: MFA for all remote access; the principle of least privilege.

In practice:

Deploy MFA (Multi-Factor Authentication) for all VPN access and administration portals
Eliminate shared generic accounts (admin/admin, user/user)
Create individual accounts for each user with strictly defined permissions
Implement the principle of least privilege: a technician should only have access to the equipment necessary for their specific task
Manage session durations: automatic logout after inactivity

8. Encryption of Communications

Requirement: Encryption of data in transit on all OT networks exposed to risks.

In practice:

Encrypted VPN (OpenVPN AES-256-GCM, WireGuard ChaCha20, IPSec) for all remote access
HTTPS with TLS 1.3 for all web interfaces (cloud SCADA, dashboards)
Block directly exposed unencrypted protocols (HTTP, Telnet, FTP, SNMP v1/v2)
Unencrypted industrial protocols (Modbus, DNP3) must be routed through an encrypted tunnel

9. Logging and Traceability

Requirement: Logs of all logins and actions on critical systems; minimum retention period of 12 months.

In practice:

Log all VPN connections (identity, time, source IP, duration, volume)
Log all configuration changes on PLCs and SCADA systems
Tamper-proof logs (cannot be modified by the user who generates them)
Centralize logs in an SIEM (Splunk, Elastic, QRadar) for correlation and alerts
Retention: minimum of 12 months for EI, 36 months recommended for EE

10. Training and Awareness

Requirement: Train teams in OT cybersecurity.

In practice:

Annual awareness training for all staff with access to OT systems
Specific training for maintenance technicians on best practices for remote access
Training for contractors before their very first remote access to your systems

Schedule and Penalties

Applicable Time Limits (France)

Step	Timeframe after ANSSI notification
Registration with ANSSI	3 months
Compliance with priority technical measures	12 months
Full compliance	18–24 months
First compliance audit	24 months

ANSSI is gradually notifying organizations. If you haven't been notified yet in 2025, you probably will be soon. Don't wait for the notification to get started.

Penalties for Noncompliance

Entity Category	Maximum Fine	Minimum Fine (Significant)
Essential Entities	€10 million or 2% of global revenue	€100,000
Significant Entities	€7 million or 1.4% of global revenue	€70,000
Executives (personal liability)	Temporary ban on holding office	—

Penalties may also include:

Public disclosure of the incident (public “name and shame”)
Suspension of authorization to practice regulated activities
Orders to comply immediately, subject to a daily penalty

Control System

For Essential Entities, oversight is a priori: ANSSI can conduct audits even if no incident has occurred. For Important Entities, oversight is a posteriori: it generally takes place after an incident or a complaint.

NIS2 Compliance Checklist for OT Remote Access

Assess your current situation step by step:

AUTHENTICATION AND ACCESS
☐ MFA enabled on all VPN access points and portals (TOTP, FIDO2)
☐ Individual accounts created for each user (no more shared accounts)
☐ Service Provider Access: Temporary, Limited to the Relevant Facilities
☐ Access Revocation Can Be Completed in Less Than 1 Hour
☐ Documented Quarterly Review of Access Rights

ENCRYPTION AND NETWORKING
☐ Encrypted VPN (AES-256 or ChaCha20) for all remote access connections
☐ No OT ports exposed directly to the Internet
☐ TLS 1.2 minimum (TLS 1.3 recommended) on all web interfaces
☐ IT/OT segmentation with a firewall between the two zones
☐ Unencrypted protocols (HTTP, Telnet, FTP) disabled on OT devices

JOURNALISATION
☐ Centralized VPN connection logs (user, time, IP, duration)
☐ Logs of Configuration Changes to PLCs and SCADA Systems
☐ Log retention period of at least 12 months (at least 36 months for EE)
☐ Tamper-proof logs (write-once architecture or SIEM)
☐ Automatic alerts for unusual connections

ASSET AND VULNERABILITY MANAGEMENT
☐ Up-to-date inventory of all OT equipment (model, firmware, version)
☐ Subscription to CVE alerts from manufacturers (Siemens, Schneider, Rockwell, etc.)
☐ A documented and tested patch management process
☐ Safety Tests During the Integration of New Equipment

CONTINUITY AND INCIDENTS
☐ A documented incident response procedure that is known to the teams
☐ ANSSI contact identified and number recorded
☐ PCA/PRA testé (< 12 mois)
☐ Exercice de simulation de crise cyber (< 12 mois)

ORGANISATION
☐ OT Security Policy Signed by Management
☐ Mapping of OT Assets and Their Network Flows
☐ Security Clauses in Service Provider Contracts
☐ Annual training for teams and service providers who access OT systems

Where to Start: 90-Day Action Plan

If your company hasn't yet begun the compliance process, here is a realistic action plan for the first 3 months:

Month 1 — Inventory and Risk Analysis

Map all connected OT equipment (PLCs, SCADA systems, gateways, sensors)
Identify existing remote access points (VPN, RDP, modems, vendor access)
Assess the risk level of each access point (encrypted? authenticated? logged?)
Appoint an internal NIS2 officer (CISO or OT cybersecurity delegate)

Month 2 — Securing Remote Access (Priority #1)

That's where the highest risk and the quickest returns lie:

Disable all direct, unencrypted access (open RDP, HTTP port forwarding)
Deploy an encrypted VPN for all remote access (internal and third-party providers)
Enable MFA for all VPN access and administration portals
Create individual user accounts and remove shared accounts
Implement connection logging

Month 3 — Establishing Governance Structures

Draft the OT security policy
Update service provider contracts to include security clauses
Train internal teams and subcontractors on remote access
Schedule the first internal audit
Set up CVE alerts for your critical equipment

Frequently Asked Questions

Does NIS2 apply to "air-gapped" OT systems (disconnected from the network)? Technically, completely isolated systems (no network connection, no remote access, no USB connectivity) pose a reduced risk. But in practice, it is rare for an OT system to be completely isolated: technicians bring USB drives, manufacturers have maintenance access, and SCADA systems often send data back to IT. NIS2 applies as soon as the OT system can be reached by an external threat.

Can NIS2 compliance be outsourced to a service provider? Yes, for the technical implementation. However, legal responsibility remains with the entity (and its management). You can entrust the installation of security solutions, audits, and monitoring to specialized service providers—but security policy and governance decisions remain your responsibility.

Does NIS2 require ISO 27001 certification? No—NIS2 does not require ISO 27001. However, ISO 27001 is a recognized standard that covers a large portion of the NIS2 requirements and can help demonstrate compliance during ANSSI audits.

What happens if you are a subcontractor to an EE but do not meet the NIS2 thresholds? The EE or EI is required to ensure the security of its supply chain. In practice, it will contractually impose equivalent security requirements on its subcontractors—otherwise, it risks being held liable for an incident caused by a subcontractor with insufficient security measures. It is in the best interest of subcontracting SMEs to anticipate these requirements.

What is the difference between NIS2 and the CER (Critical Entities Resilience) Directive? NIS2 covers cyber resilience (IT security). CER (Critical Entities Resilience Directive) covers physical resilience (protection of infrastructure against natural disasters, terrorist acts, etc.). Both directives apply in parallel to operators of critical infrastructure.

Does Eziwan provide an NIS2 compliance report? Yes. The Eziwan platform generates an exportable compliance report (PDF) that includes: an inventory of remote accesses, connection logs for the selected time period, active security settings (MFA, encryption, logs), and valid VPN certificates. This report can be used directly for ANSSI audits or internal compliance reviews.

Additional Resources

NIS2 Industry — Overview of Requirements for Critical and Important Entities
Industrial Cybersecurity — Overview of Threats and OT Protection Solutions
OT Remote Access Cybersecurity — Securing remote access to PLCs
Industrial VPN — NIS2-compliant solutions for OT remote access

NIS2 for Industry: Specific Requirements, Penalties, and OT Action Plan

NIS2: The Big Picture in 3 Minutes

Does NIS2 apply to you?

Essential Entities (EE) — Enhanced Oversight