NIS2 for energy, water and utilities
Electricity, district heating and cooling, gas, hydrogen and oil, together with drinking water and waste water, are sectors of high criticality under NIS2. Operators run large OT estates, many sites and long supplier chains, and an outage is felt immediately.
In short: Energy, drinking water and waste water are Annex I sectors under NIS2: large operators are usually essential, medium-sized ones important, and entities designated as critical under the CER Directive are covered whatever their size. Secrato keeps sites, OT systems, risks and suppliers on one record and maps NIS2, CyFun®, IEC 62443 and ISO/IEC 27001 to the same controls.
Energy and water are highly critical sectors
The energy sector covers electricity (including producers, network operators, suppliers and operators of recharging points), district heating and cooling, oil, gas and hydrogen. Suppliers and distributors of drinking water and operators of waste water treatment are also highly critical, and waste management is an “other critical” sector. Check your scope →
Secure the assets the grid and the network depend on
Every site, substation and system on record
Record plants, substations, pumping stations and control systems as assets, link them to owners, risks and controls, and keep evidence per site, so audits and supervisors see the same picture as your operations team.
NIS2 and the CER Directive together
Member States identify critical entities under the CER Directive. These entities are also covered by NIS2 regardless of size, and treated as essential. Keep resilience and cybersecurity measures side by side instead of in separate programmes.
IEC 62443 and ISO/IEC 27001 mapped to NIS2
Map IEC 62443 for operational technology and ISO/IEC 27001 for information security to the NIS2 measures, so one piece of evidence counts across frameworks and teams.
BUILT FROM BELGIUM
What applies to utilities in Belgium and the Netherlands
Belgian energy and water operators register with the CCB and can use CyFun® or ISO/IEC 27001 to show the NIS2 measures; essential entities need a regular conformity assessment. Dutch operators register with the NCSC under the Cyberbeveiligingswet, and critical providers also fall under the Wwke. Electricity operators involved in cross-border flows follow the network code on cybersecurity as well.
Secrato is built in Belgium and hosted in a Tier IV data centre in Antwerp. Read the NIS2 Belgium step-by-step guide or the Cbw guide.
Common questions
Are energy companies essential entities under NIS2?
Energy is an Annex I sector. Large energy companies are generally essential entities; medium-sized ones are generally important unless the authority designates them as essential. Entities identified as critical under the CER Directive are essential regardless of size.
Are water utilities in scope of NIS2?
Yes. Suppliers and distributors of water intended for human consumption and operators of urban, domestic or industrial waste water treatment are sectors of high criticality, when they are at least medium-sized or designated by the authority.
Does Secrato support IEC 62443?
Yes. IEC 62443 is available as a framework and can be mapped to NIS2, CyFun® and ISO/IEC 27001, so OT security measures count towards your NIS2 obligations.
How do we handle many sites and subsidiaries?
Use workspaces and sub-workspaces per company, region or site, with governance set once at the top and dashboards that roll up. See multi-tenant workspace management.
See how Secrato supports your utility's NIS2 programme
Show us your sites and systems, and we will map them to NIS2, CyFun® and IEC 62443 in Secrato.
