When the damage is measured in stopped production
Manufacturing, energy, water, transport, logistics, waste and the suppliers who serve them. NIS2 pulled far more of these organisations into scope than the old directive did, and many of them are still finding out.
Are you in scope?
NIS2 covers a defined list of sectors and generally applies from medium size upward, with member states adding their own cases. We are not a law firm and will not pretend otherwise, but if the description below sounds like you, it is worth finding out properly.
Energy & utilities
Electricity, heating, oil, gas, hydrogen, water and waste water, including operators well below the size people assume.
Manufacturing
Medical devices, electronics, machinery, motor vehicles, chemicals and food production among others.
Transport & logistics
Road, rail, air and water transport, ports and terminals, and the postal and courier operations around them.
Their suppliers
Even out of scope yourself, your customers are now obliged to assess you, which arrives as a questionnaire with contractual weight behind it.
The problem is rarely the office network
In an industrial setting the valuable, fragile part is the production side: controllers, panels, sensors, historians and the machines that talk to them. It usually runs software that cannot be patched on a normal cycle, sometimes cannot be patched at all, and was designed on the assumption that anything on the same network was friendly.
The realistic answer is not to secure each of those devices individually. It is to control what can reach them. Zones and controlled paths mean a compromised office laptop cannot see a controller; traffic between zones is inspected and recorded; the maintenance engineer's laptop gets a time-limited path rather than a permanent one; and the supplier who needs remote access gets a recorded session instead of an open port.
Alongside that, you finally get an inventory. Most sites cannot say with confidence what is connected to the production network, and discovery is usually the first uncomfortable conversation: the count is almost always higher than expected.
What we do not claim: we are not an OT protocol-analysis product and we do not install anything on a controller. What we do is control, observe and record the network around your operational technology, and give you the evidence that you did. Where a specialist OT platform is genuinely needed, we will tell you.
What tends to matter most
Separation
Production, office and guest networks kept genuinely apart, with the crossings inspected and logged.
Supplier access
Recorded, time-bound sessions for maintenance contractors, replacing the standing accounts nobody remembers creating.
Removable media
The USB stick is still how things get onto an isolated network. Policy that is enforced on the machine, and recorded every time.
Recovery you have tested
The question is not whether you have backups. It is how long a line stays stopped, which you only know if you have restored one.
Multiple sites, one view
Plants, depots and remote installations report into one console, with configuration pushed out rather than typed in twice. A change you approve once reaches every site, and a site that has drifted from the approved configuration is flagged rather than discovered later.
Start with one site
Tell us what a typical site looks like: the production network, the office side, who comes in to maintain what. We will scope one site properly and show you what repeating it costs.