Cybersecurity for energy and utilities — NIS2 highly critical sector, IT/OT boundary with IEC 62443 judgement

Energy is classified as a HIGHLY critical sector in Annex I of NIS2: electricity, district heating and cooling, oil, gas and hydrogen. The specific qualification as essential or important entity depends on size and role; large operators are essential entities with maximum obligations. The Spanish transposition through Law 11/2022 and Royal Decree 43/2021 specifies competent authorities and the sanctions regime. We validate it in the initial diagnosis.

They coexist. The Spanish CNPIC's PIC designation is a prior, specific regime that designates the operator and its critical infrastructure, requires an Operator Security Plan (PSO) and Specific Protection Plans (PPE) per facility, and appoints a Security and Liaison Officer. NIS2 is a broader European cybersecurity framework. An operator may fall under both. The right approach is to design a single technical and governance picture that answers both regimes with reusable evidence.

Hard2bit brings judgement to the IT layer and to the IT/OT boundary with IEC 62443 in mind: zones and conduits, segmentation, governance of vendor and maintainer accesses, monitoring at the boundary. For pure OT depth (ICS forensics, industrial-protocol retrofits, IEC 62443 component-level certification) we work with specialist partners without over-claiming experience we don't have. Transparency about where we deliver demonstrable value and where we lean on a specialist partner is the basis of the conversation with the client.

IEC 62443. The 62443-2-1 (policies), 62443-3-3 (system requirements), 62443-4-1 (vendor development process) and 62443-4-2 (component requirements) family defines zones and conduits, security levels and vendor obligations. For electrical substations and operations communications, IEC 61850 defines the language (GOOSE, MMS, Sampled Values) on which the protection and control systems coexist — the systems that need to be segmented and protected.

With a centralised broker, not separate VPNs and loose credentials. The recommended practice is to consolidate all remote accesses by vendors and external maintainers through a broker that records every session, requires MFA, restricts to specific destinations within an agreed window and leaves audit-grade traceability. On top of that, contractual governance: security clauses in tenders, supplier incident-notification obligation and IEC 62443 requirements where they apply to the product.

NIS2 sets initial notification to the national CSIRT within a short window from detection (typically 24 hours for the early warning), incident notification with details within 72 hours, and a final report with root cause and measures within a later deadline. Exact deadlines are set by the national transposition. The 24/7 DFIR retainer covers those deadlines from minute one thanks to prior onboarding and CSIRT coordination.

Yes for the part of the system or service contracted with the corresponding municipality, joint authority or river basin authority. ENS applies to the public sector and to its IT suppliers with in-scope systems. It coexists with NIS2 and, where designated, with PIC. A good implementation reuses evidence across the three frameworks. We explain it in the framework comparison.

Renewables have led to operators with thousands of PV inverters or wind turbines across distributed plants, telemanagement consolidated on modern platforms and a much larger attack surface. The strategy combines hardening of the telemanagement platform, identity governance for operations staff and vendors, SOC monitoring over platform logs and posture across the cloud when there is infrastructure on Azure/AWS/GCP.

Yes. The 24/7 SOC/MDR includes prioritised use cases for the sector: ransomware precursors on the corporate network, abuse of maintenance VPN credentials, anomalous behaviour at the IT/OT boundary, pivot attempts to telemanagement platforms and exfiltration of large-scale consumption data. Pure OT logs are integrated when the operator requires it and, in projects with ICS-forensic depth, with specialist partners.

With security clauses in tenders (referencing IEC 62443-4-1 and 62443-4-2 where they apply to the product), contractual incident-notification obligation from the supplier, evaluation of default configurations on RTUs, PLCs and inverters before commissioning, governance of firmware updates and SOC monitoring over anomalous behaviour from products of the same vendor. The long-lifecycle rule of OT assets (15–25 years) requires auditing the legacy, not just the new roadmap.

Yes. A large retailer has portfolio management and exposure to wholesale markets (OMIE, MIBGAS) that bring it close to the financial sector in several aspects: risk management criteria, controls over market operations, continuity requirements over billing. We design an integrated NIS2 + ISO 27001 + market-controls package, without entering pure financial regulation (DORA applies to financial entities, not to a typical retailer).