In brief
- Regulation: NIS2.
- Energy producers, network operators and distributors, drinking water and wastewater operators above the relevant thresholds are classified as essential entities.
- Secure OT/SCADA.
- Applying the measures of Article 21.
- Notify incidents.
- Up to €10M or 2% of global turnover, with prior supervision and potential liability for executives.
Regulatory deadlines
The key dates of this regulation.
January 2023
Entry into force (EU directive)
In forceOctober 2024
Transposition deadline (EU)
In force2026
French transposition (Resilience Act)
In forceWhat does NIS2 cover?
NIS2 classifies energy (electricity, gas, oil, hydrogen, heat), drinking water and wastewater among the essential entities in Annex I. Waste management falls under important entities. The essential regime involves ex-ante supervision (inspections, audits).
Article 21 measures must cover IT and especially OT (SCADA), historically under-secured.
Is the "Energy & environment" sector concerned?
Energy producers, network managers, distributors, drinking water operators and sanitation operators above the thresholds are essential entities. Some critical operators may qualify as such regardless of their size.
Waste management falls under important entities, subject to a slightly less strict regime.
Detailed obligations
Secure OT/SCADA
Inventory and secure industrial control systems, often legacy and exposed once connected.
Apply the measures of Article 21
Security policy, incident management, encryption, access control, multi-factor authentication.
Notify incidents
Issue an early warning then reports according to deadlines.
Ensure continuity and crisis management
Having robust plans tailored to critical infrastructures.
Submitting to supervision.
Cooperate with the prior checks specific to essential entities.
Sanctions & risks
Up to €10M or 2% of global turnover, with prior supervision and potential liability for executives. The operational risk is societal: an attack on a critical network can deprive populations of energy or water.
Application timeline
- 1Directive. Adopted end of 2022.
- 2France. Transposition in progress; essential regime to anticipate.
Common mistakes in the sector
- 1Neglected SCADA. Securing IT without addressing industrial systems.
- 2Fragile continuity. Underestimating the societal impact of an outage.
- 3Unsecured chain. Leaving critical suppliers ungoverned.
- 4Absent leadership. Confining cybersecurity to the technical domain.
Practical case
A water operator detects an intrusion on its SCADA system via a remote management access point. As an essential entity, it must notify the relevant authority and demonstrate its measures. It segments IT/OT networks, governs remote access, strengthens industrial system monitoring, and stress-tests its continuity plan.
Compliance roadmap
- 1
Qualify. Confirm essential status.
- 2
Map OT assets. Inventorying SCADA systems and interconnections.
- 3
Secure. Deploying IT/OT measures and the incident plan.
- 4
Frame vendor relationships. Securing the supply chain.
- 5
Prepare for audits. Prepare for prior supervision.
Frequently asked questions
Energy and water: essential; waste: important.
Take action on NIS2
Free assessment or a chat with an expert dedicated to energy & environment.
They already trust us
See how organisations in the energy & environment sector secured their compliance with DCO.