OT inside NIS2: the definitions that reach the control room

In this lesson

• Apply the three limbs of the article 6(1) definition of a network and information system to controllers, operator stations, field devices and control logic.
• Identify where that definition stops, so that the perimeter of your OT security work rests on the text and not on a slogan.
• Explain why article 21(1) brings the systems an entity uses for its operations under every article 21(2) measure, and why that does not create OT-specific obligations.
• Locate the few places where EU law does name industrial control systems, and say whom each of them binds.

A directive without the word OT

Directive (EU) 2022/2555

Directive (EU) 2022/2555 never uses the terms operational technology, industrial control system, SCADA or programmable logic controller. Yet its annexes list electricity, district heating, gas, hydrogen, rail, ports, drinking water, waste water, chemicals and food production: sectors whose services come out of physical processes that are measured and steered by control systems.

The absence is not a gap. NIS2 attaches its obligations to network and information systems, defined by what devices do rather than by what they are called. Article 25(1) even asks Member States to encourage standards “without imposing or discriminating in favour of the use of a particular type of technology”. The consequence for an OT practitioner is that the argument has to be built from the definitions, and that two shortcuts are wrong:

• OT is outside NIS2 because it is not IT. Article 6(1) contains no such distinction, and article 21(1) covers the systems an entity uses for its operations.
• NIS2 has OT requirements. It has none of its own: no required architecture, product or standard for control systems. What the measures look like in a plant is decided by the proportionality test of article 21(1) (lesson m1l2).

Article 6(1): three limbs

Art. 6(1)

A network and information system is any of three things: an electronic communications network as defined in Directive (EU) 2018/1972, the European Electronic Communications Code (point (a)); a device or group of devices that processes digital data under a programme (point (b)); or the digital data those elements handle (point (c)). Point (b) does most of the work in a plant. Whether a given fieldbus or plant radio network also meets point (a) need not be settled: the devices it connects form a group under point (b), and the data it carries is covered by point (c).

Point (b): what the devices do

The text reads: “any device or group of interconnected or related devices, one or more of which, pursuant to a programme, carry out automatic processing of digital data”. Four conditions follow from it: a device, or a group of devices that are interconnected or related; at least one of them working pursuant to a programme; processing that is automatic; and data that is digital.

A programmable logic controller meets all four: it executes a stored program in a continuous cycle, reads its inputs as digital values and writes its outputs without human intervention. So does a remote terminal unit at a pumping station, a distributed control system controller, a programmable safety logic solver, a microprocessor-based protection relay, an operator station, a SCADA server, a historian and the engineering workstation used to change all of them.

The words “one or more of which” matter: a group qualifies if a single member runs a programme. A purely analogue transmitter runs no programme, but it is related to the controller that processes its signal. Read literally, the measurement chain, the controller and the actuators it drives form one group of related devices, and tampering with a field signal is an attack on a network and information system.

Where point (b) stops

A hardwired relay interlock or a mechanical overspeed trip contains no programme and processes no digital data. On its own, it is not a network and information system. It is not irrelevant either: it may be the barrier that limits what an attacker who controls the programmable layer can achieve, which matters in the risk analysis (lesson m1l2) and when compensating for vulnerabilities you cannot fix (lesson m3l1). Record which barriers are non-programmable and why you rely on them.

Point (c): logic and data count too

Point (c) adds “digital data stored, processed, retrieved or transmitted by elements covered under points (a) and (b) for the purposes of their operation, use, protection and maintenance”. In a plant, that covers control logic and project files, setpoints and recipes, alarm thresholds, drive and switch configurations, firmware images, historian records, backup copies and the credentials used to reach all of them. A setpoint changed without authority is a compromise of the integrity of a network and information system, even if no computer has crashed.

Incidents in a physical process

Art. 6(6)

An incident is “an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems”. Each property has a plant reading:

• Availability: operators lose their view of the process, or lose the ability to send commands to it.
• Integrity: a setpoint, a recipe or a block of control logic is altered.
• Authenticity: a controller accepts a command from a source that is not the one it appears to be.
• Confidentiality: project files that reveal how the process and its protections work leave the entity.

No attacker is required. Recital 79 lists “theft, fire, flood, telecommunication or power failures” among the events the all-hazards approach covers; a firmware update that stops a controller is an incident. Whether it must be reported is a separate test, under article 23(3) (lesson m4l1).

Article 21(1): the systems you run the plant with

Art. 21(1), 21(2)

Article 21(1) requires essential and important entities to take “appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services”. Control systems are used for operations: that sentence is the bridge between the plant and the directive.

Article 21(2) then lists ten measures, (a) to (j), that the measures “shall include at least”, on the basis of an all-hazards approach protecting “network and information systems and the physical environment of those systems”. Article 21 has no carve-out for control systems: from risk analysis to multi-factor authentication, each measure applies to the plant as to the office.

Recital 83 closes an escape route: the measures and reporting obligations should apply “regardless of whether those entities maintain their network and information systems internally or outsource the maintenance thereof”. A control system maintained by its vendor under a service contract remains the entity's system.

What article 21 does not do

It does not say segment OT, use one-way gateways or apply a given standard. Recital 89 names network segmentation among the cyber hygiene practices entities should adopt, but a recital explains; it does not add an obligation. Article 21(5) required implementing acts for a list of digital entity types, and Implementing Regulation (EU) 2024/2690 binds only the entity types in its article 1. For an operator of a physical process, its annex is a reference, never an obligation.

Being in scope is a separate question

Art. 2, 3

That OT is a network and information system does not bring an entity into the directive; its type and size do. Article 2(1) covers entities of a type listed in Annex I or II that are at least medium-sized. Article 2(3) adds, regardless of size, entities identified as critical entities under Directive (EU) 2022/2557, and article 3(1)(f) makes them essential entities. The class decides the supervisory regime (articles 32 and 33), not the measures: article 21 applies to essential and important entities alike. National transpositions add their own designations and supervisors for each sector; check them on the transposition tracker rather than in this course.

Where EU law does name control systems

A few texts around NIS2 mention control systems explicitly, and the annex to Implementing Regulation (EU) 2024/2690 mentions safety. None adds an OT obligation to an NIS2 entity as such; each binds its own addressees.

What a supervisor will ask

• Which network and information systems do you use to produce and deliver your service? A scope statement that lists the control systems and shows the reasoning from article 6(1).
• What did you leave out, and why? A recorded rationale for each exclusion, such as non-programmable safety barriers.
• Are systems maintained by suppliers in scope? Inventory entries naming the supplier and how maintenance is performed (recital 83).

Key points

• NIS2 never names OT or industrial control systems. It reaches them through the functional definition of article 6(1)(b) and (c).
• A group of related devices qualifies if one of them runs a programme; control logic, setpoints and configurations are covered as data.
• Non-programmable barriers such as hardwired interlocks are not network and information systems on their own, but they belong in the risk analysis.
• Article 21(1) covers the systems an entity uses for its operations, so all ten article 21(2) measures apply to OT, including where maintenance is outsourced.
• The directive prescribes no OT-specific control. Implementing Regulation (EU) 2024/2690 binds only its article 1 entities.