Industrial OT cybersecurity from the plant floor to NIS2

OT (Operational Technology) covers the systems that control physical processes: PLC, SCADA, DCS, HMI, RTU and the industrial network linking them. It differs from IT in three key points. First, priority: IT puts confidentiality first, OT puts availability and physical safety first because a stop or a control failure can cause property and personal damage. Second, lifecycle: a PLC may operate for 20 years versus 3-5 years for an IT server, which completely changes patching policy. Third, protocols: Modbus, OPC UA, DNP3, IEC 61850 or PROFINET instead of HTTP, SMB or RDP.

Probably yes if it operates in energy, drinking water, wastewater, transport, manufacturing (medical devices, chemicals, food, specific manufactured products), waste management, digital infrastructure or research. NIS2 distinguishes between essential and important entities by sector and size. The Spanish transposition requires registration with the competent authority, deployment of risk-management measures and incident notification on short timelines. A scoping exercise upfront avoids problems later.

The Purdue Model breaks the industrial architecture into levels 0 through 5: level 0 are the physical sensors and actuators, level 1 the controllers (PLC, RTU), level 2 supervision and HMI, level 3 plant operations, level 3.5 an industrial DMZ, level 4 plant-floor corporate systems and level 5 corporate IT. It is always cited because it provides a common map to design segmentation, decide which traffic is allowed between levels and apply IEC 62443 to something tangible.

No, unless the client explicitly asks for active testing. The standard methodology in OT environments is non-intrusive: passive asset discovery from traffic captures, documentary review, interviews with operations and maintenance, and hot configuration review with the plant owner's consent. Active testing is reserved for mirrored environments, scheduled shutdowns or windows agreed with the production owner.

IEC 62443 is the how, NIS2 is the what. NIS2 requires technical and organizational measures proportionate to risk but does not prescribe how to implement them in an industrial environment. IEC 62443 provides the concrete methodology: zones-and-conduits risk assessment, Security Levels, system requirements, supplier requirements and lifecycle. In practice, a serious industrial audit uses NIS2 as the legal driver and 62443 as the technical yardstick.

NIS2 sets an early-warning notification within 24 hours of becoming aware of a significant incident, a more detailed incident notification within 72 hours and a final report within one month. The notification goes to the designated CSIRT or competent authority, which in Spain includes INCIBE-CERT for the private sector and CCN-CERT for public administration and strategic infrastructure. An industrial incident-response retainer reduces the friction of meeting these timelines.

For three practical reasons. First, vendors often don't release patches at office-software cadence and when they do, the patch needs to be validated against the process. Second, stopping a PLC to patch it means stopping the line, with an operational cost measurable in thousands or millions of euros per hour. Third, many systems run on hardware or operating systems out of support. In serious OT environments, vulnerability management combines patching where feasible, compensating controls where not, and planning with operations.

Depends on scope. A point audit on a single plant usually takes 4-8 weeks, including fieldwork and reporting. A full NIS2 + IEC 62443 project for a mid-sized industrial group with multiple sites typically takes 4 to 9 months, depending on the number of locations, the documentary starting point and the availability of operational staff for interviews and validations.

Yes. The report documents scope, methodology (IEC 62443, NIS2, NIST SP 800-82, MITRE ATT&CK for ICS), collected evidence, prioritized findings, Security Level per zone and remediation plan. It is designed to integrate with an existing management system (ISO 27001, ENS, ISO 27019 where applicable) and serve as traceable evidence for external auditors, NIS2 competent-authority inspections and incident coordination with INCIBE-CERT and CCN-CERT.