NIS2 and the CRA Both Reach Your Plant Floor. Here Is What to Do.

For years, OT security sat in a gap. IT security teams did not own the plant floor, and engineering teams did not see cybersecurity as their job. The PLCs, HMIs and industrial switches kept running, and that was what counted.

That gap is closing from two sides. NIS2 makes operators accountable for the security of their systems, OT included. The Cyber Resilience Act (CRA) makes the vendors of those systems accountable for what they ship. This article explains what each law asks, where they meet, and what to do in the next 90 days.

Why OT is the weak spot

Industrial networks were built to be isolated. They are not anymore. Production data flows to the ERP, maintenance teams connect remotely, and vendors need access to update their equipment. Each connection is a path from IT to OT.

At the same time, OT assets stay in service for decades. Many run operating systems their vendor stopped supporting long ago. Patching means stopping production, so it rarely happens.

Belgian industry knows the problem. In September 2026, an analysis reported by Business AM found that operational technology is the most vulnerable part of Belgian tech companies, while classic IT is generally better protected. Agoria called for a comprehensive approach to industrial cybersecurity.

NIS2 covers your OT too

NIS2 does not distinguish between IT and OT. It applies to the "network and information systems" an entity relies on to deliver its services. For an energy operator, a water utility or a manufacturer, that includes the control systems.

The sectors in scope make this clear: energy, transport, drinking water and waste water, and parts of manufacturing such as machinery, electrical equipment, chemicals and food. In Belgium, the NIS2 law has applied since October 2024.

Three obligations hit OT teams directly:

• Risk management measures (Article 21). Access control, incident handling, business continuity, vulnerability handling and supply chain security. On the plant floor, these are rarely in place.
• Incident reporting. An early warning within 24 hours, a notification within 72 hours and a final report within one month. An OT incident nobody detects cannot be reported.
• Management accountability. The board approves the measures and answers for them. We covered this in NIS2 Is Not a Compliance Exercise.

The Belgian timeline is concrete. By 18 April 2026, essential entities had to show the Centre for Cybersecurity Belgium (CCB) their path: a CyberFundamentals verification, ISO/IEC 27001 (with full certification due by April 2027) or a direct inspection. Auditors will ask how the OT perimeter is covered.

The CRA changes what your vendors ship

The CRA regulates products with digital elements sold in the EU. That includes most industrial components: PLCs, HMIs, industrial switches, gateways and OT firewalls. Network firewalls and intrusion detection systems are classed as important products, with a stricter conformity assessment.

Two dates matter:

• 11 September 2026. Manufacturers must report actively exploited vulnerabilities and severe incidents within 24 hours. This applies to products already on the market, not only new ones.
• 11 December 2027. All other requirements apply: security by design, vulnerability handling, security updates over a defined support period of at least five years in most cases, and CE marking.

For an operator, this is good news. Your vendors now have legal obligations you can rely on and write into contracts. Our view on how the CRA reshapes product design is in The Cyber Resilience Act: An Architectural Correction.

IEC 62443: the common language

NIS2 and the CRA say what to achieve. IEC 62443 says how, and it already splits the work between the two sides:

• Asset owners (operators) use parts 2-1 and 3-2: a security program, a risk assessment, and a network split into zones and conduits.
• Suppliers use parts 4-1 and 4-2: a secure development lifecycle and security requirements for each component.

The European standards being written for the CRA in OT, the EN 50770 series, build on IEC 62443. As of mid-2026, no CRA harmonised standard had yet been cited in the Official Journal. If you need a reference today, IEC 62443 is it.

The lifecycle gap

Here is the problem neither law solves. Your plant runs equipment installed ten or twenty years ago. The CRA does not make that installed base secure. A five-year support period is short next to the life of a substation or a production line.

So the risk stays with you, the operator. The answer is compensating controls:

• Segmentation. Group assets into zones by criticality, and control every conduit between them. A flat network turns one infected laptop into a plant-wide incident.
• Controlled remote access. Vendor access is one of the most common entry points into OT. Route every session through a PAM platform such as WALLIX or CyberArk: no shared passwords, access approved per session, sessions recorded. As we argued in PAM Is a Waste of Money (If You Don't Fix IAM First), define who needs access before you buy the tool.
• Monitoring. Passive OT monitoring sees traffic without touching the controllers. Feed it into your SOC, so OT alerts follow the same process as IT alerts.

A 90-day plan

• Weeks 1 to 4: know what you run. Build an OT asset inventory: what, where, which firmware, which vendor, which support status. Flag every asset without security updates.
• Weeks 3 to 6: map zones and conduits. Draw the real network, not the intended one. List every connection between IT and OT, and every remote access path.
• Weeks 5 to 8: close vendor access. Move all third-party remote access behind PAM. Remove permanent VPN accounts and shared credentials.
• Weeks 6 to 10: update procurement. For every new OT purchase, require IEC 62443-4-2 alignment, a stated support period, a software bill of materials (SBOM) on request, a vulnerability contact and a commitment to notify you of exploited vulnerabilities.
• Weeks 8 to 12: test reporting. Run an OT incident exercise. Check that you can detect, decide and send an early warning to the CCB within 24 hours.

Next step

NIS2 has made OT security a board topic. The CRA will make vendors better partners, but only for what they ship from now on. The installed base, the network and the access paths remain your job.

Want to know where your OT perimeter stands against NIS2? Talk to our cybersecurity team, or see how we approach governance, identity and security operations.