ICS & OT Security

NIS2 and IEC 62443: A practical implementation guide for OT environments

Reading time 7 min Sebastian Bach

Key takeaways

  • NIS2 Article 21 demands organisational measures — in OT, the translation into zones, conduits and operable controls is often missing; IEC 62443 provides a workable implementation framework.
  • Effective gap assessment starts with the System under Consideration (SuC), a realistic Security Level (often SL2) and prioritised Foundation Requirements FR1, FR2 and FR6.
  • 62443-2-1 (programme), 62443-3-3 (system) and 62443-4-x (components) address different layers — without clear ownership, duplicate effort and audit gaps follow.
  • CRA product obligations and NIS2 operator duties converge in OT supply chains; a shared architecture board prevents conflicting priorities.
  • Delivery-ready OT security roles determine whether measure catalogues work on the plant floor — not only on slides.

Subscribe to our newsletter

Receive regular insights, strategies and best practices on IT recruitment and cybersecurity (many articles in German).

NIS2 and IEC 62443 are the two reference points many industrial and critical-infrastructure operators use in 2026 to judge OT implementation maturity. NIS2 Article 21 sets concrete risk-management and security measures — without OT-specific detail. IEC 62443 supplies that depth: zones, conduits, Security Levels and Foundation Requirements for industrial automation and control systems.

The practical lever is alignment: NIS2 defines what organisational accountability means; IEC 62443 describes how that becomes operational in plants, facilities and supply chains. Separate programmes produce parallel spreadsheets. Integrated programmes yield auditable evidence and operationally credible priorities.

NIS2 Article 21: the OT translation gap

Article 21 lists ten measure areas — from risk analysis to incident handling and supply-chain security. For OT operators the challenge is not reading the list but translating it:

  • Risk analysis must cover PLCs, HMIs, safety systems and remote maintenance — not office IT alone.
  • Business continuity collides with maintenance windows and process-safety approvals.
  • Supply-chain security includes OEM components, integrators and update paths — a CRA intersection.

Many enterprises launched NIS2 on corporate IT first. OT remains a “later workstream” — even though physical impact originates there. Our NIS2 FAQ article covers applicability; this guide focuses the OT bridge.

Article 21 → OT — typical translation gaps

  • Risk analysis: asset inventory without OT protocol and safety context.
  • Hardening: IT patch cycles applied to PLCs without change control.
  • Incident handling: SOC playbooks without OT escalation to operations.
  • Supply chain: CRA product duties and NIS2 operator duties managed separately.

IEC 62443 as a bridge — not a substitute

IEC 62443 does not replace NIS2 and vice versa. The series structures industrial cybersecurity across:

  • 62443-2-1 — security management system for IACS operators and integrators,
  • 62443-3-3 — system security requirements and Security Levels,
  • 62443-4-x — component requirements (4-1 development, 4-2 integration).

In practice, NIS2 Article 21 measures map to 62443 controls — risk analysis to FR1 (identification), protective measures to FR2 (protection), incident response to FR6 (response). That creates shared vocabulary for audit, operations and engineering.

System under Consideration and Security Level

Before prioritising controls, define the System under Consideration (SuC): which plant, site or production line is in scope? Over-broad SuC definitions create unrealistic SL demands; too narrow scopes miss conduit dependencies.

For many manufacturing and utility environments, SL2 is a pragmatic starting point: protection against intentional or casual violation with moderate resources — without SL3/SL4 complexity that overwhelms integration projects. SL targets must be documented per zone and justified against operational criticality.

Gap assessment along FR1, FR2, FR6

A credible gap assessment prioritises three Foundation Requirements:

  1. FR1 — identification and authentication: who may access which OT asset — engineering station, HMI, remote maintenance?
  2. FR2 — system integrity: how are unauthorised changes to logic, parameters and configuration detected?
  3. FR6 — availability and response: how does the team respond under disruption — without compromising safety?

Typical gaps: shared engineering accounts (FR1), missing integrity monitoring on PLCs (FR2), and incident playbooks without OT owners (FR6). Results should become measures with owner, deadline and evidence type — not generic “comply” checkboxes.

62443-2-1 / 3-3 / 4-x — who owns what?

2-1: programme ownership, policies, training, supplier control — often corporate OT security or site CISO.

3-3: zone architecture, conduit rules, SL evidence per SuC — OT architect plus integrator.

4-x: component hardening, secure development — manufacturers and product security; operators verify supply-chain conformance.

CRA linkage: product and operations

The Cyber Resilience Act shifts responsibility for products with digital elements — from machine controllers to remote-maintenance modules. NIS2 addresses the operator. In OT both collide:

  • A compromised update module is a CRA product incident and an NIS2 reporting duty.
  • SBOM gaps on OEM components weaken FR2 evidence in the SuC.
  • End-of-support dates for field devices affect CRA conformance and OT availability alike.

A shared readiness model — as in our industrial CRA/NIS2 readiness article — prevents conflicting priorities between plant and corporate IT.

Implementation in four phases

Phase 1 — scope and SuC

Clarify NIS2 applicability, draw SuC boundaries, identify critical zones. In parallel: inventory digital products in the facility — gateways, edge, engineering tools.

Phase 2 — gap assessment

Mirror current state against FR1/2/6 and target SL2. Sort results by operational impact — not audit chapter number.

Phase 3 — measures and roles

Establish 62443-2-1 programme structure, document 3-3 architecture decisions, write 4-x requirements to suppliers. Staff roles with decision authority — see IEC 62443 in recruiting.

Phase 4 — evidence and maturity

Test control effectiveness, run tabletops with OT participation, sample supplier audits. Maintain NIS2 evidence and 62443 artefacts in one data foundation.

Suggested next steps

People as the bottleneck

Programmes rarely fail for lack of standard knowledge but for missing hybrid profiles: who translates FR gaps into maintenance windows, who holds integrators to SL2, who connects CRA reporting with OT incident chains. That talent pool is tight — early hiring measurably improves execution speed.

Common mistakes in practice

Three patterns repeat in mandates we support:

Mistake 1: standard stacking without SuC

Teams buy NIS2, CRA and 62443 consulting in parallel — without a shared system boundary. Result: conflicting SL targets and duplicate inventory work. Countermeasure: one architecture board with SuC as the binding anchor.

Mistake 2: SL3/SL4 as default

Integrators sell maximum Security Levels; operations cannot sustain them in maintenance windows. Countermeasure: justify SL2 and tie SL increases to concrete threat and evidence.

Mistake 3: evidence without operational follow-through

Policies exist but engineering accounts stay shared and remote maintenance unchecked. Auditors spot this faster than internal teams. Countermeasure: link gap-assessment results to owners and quarterly KPIs — e.g. share of closed FR1 measures in critical zones.

KPI set for steering

Leadership teams need only a few metrics:

  • share of SuC zones with documented SL and conduit rules,
  • open FR1/2/6 high-risk gaps with deadline and owner,
  • integrator contracts with 62443-4-x and CRA clauses,
  • time-to-productive for new OT security roles on site.

These KPIs separate compliance theatre from credible implementation.

Conclusion

NIS2 and IEC 62443 together provide a credible OT implementation model: Article 21 as organisational duty, 62443 as the technical-operational bridge with SuC, SL2 and FR1/2/6 gap assessment. Integrating CRA product duties into the same steering model avoids duplicate work and builds auditable resilience in plants and critical infrastructure.

Further reading: IEC 62443 recruiting, NIS2 implementation. Hiring: Cybersecurity recruitment.

Source

FlowFuse — NIS2 and IEC 62443 for manufacturers

FAQ

How does Perfomynd support NIS2 and IEC 62443 implementation in OT?
We first identify risk-critical roles along SuC boundaries and gap-assessment outcomes, define outcome-based profiles for programme, system and component layers, and qualify candidates against real OT scenarios — not standard terminology alone.
Which profiles are typically missing when aligning NIS2 and IEC 62443?
OT security programme owners with 62443-2-1 experience, system architects for 3-3 target designs, product security roles for 4-x components, and interface managers between operations, engineering and corporate compliance.
How does Perfomynd reduce mis-hires in OT compliance mandates?
We separate governance, architecture and delivery accountability early, assess candidates with practical cases on patch windows, segmentation and evidence management, and calibrate expectations to SL targets and SuC scope.