OT Regulation

The first NIS directive (2016, in the Netherlands the Wbni from 2018) made cybersecurity a legal duty for the largest operators. Since then the European Union has widened and deepened this into law, in four layers that overlap:

• Cyber security of organizations in critical sectors: NIS2, in the Netherlands the Cyberbeveiligingswet.
• Overall resilience of the most critical organizations against all kinds of disruption — sabotage, natural disasters, terrorism, pandemics: the CER Directive, in the Netherlands the Wwke.
• Sector-specific cybersecurity rules for electricity: the Network Code on Cybersecurity.
• Products: the Cyber Resilience Act, which obliges manufacturers to deliver secure products.

Two legal forms matter. A directive (NIS2, CER) sets goals that each member state writes into its own national law, so the details and dates differ per country. A regulation (the Network Code, the Cyber Resilience Act) applies directly in every member state, word for word.

The United States has no single law for the cybersecurity of critical infrastructure. CISA, the Cybersecurity and Infrastructure Security Agency, counts 16 critical infrastructure sectors, and each sector's rules come from its own agency:

• Electricity: the NERC CIP (Critical Infrastructure Protection) Reliability Standards for the bulk electric system. NERC, the North American Electric Reliability Corporation, writes them; FERC, the Federal Energy Regulatory Commission, approves and enforces them.
• Pipelines and railroads: Security Directives of the Transportation Security Administration (TSA), emergency directives that are renewed every year.
• Drinking water: the Environmental Protection Agency (EPA), under section 1433 of the Safe Drinking Water Act (as amended by America's Water Infrastructure Act of 2018): a risk and resilience assessment and an emergency response plan, recertified every five years. There is no mandatory cybersecurity standard for water systems.
• All sectors: CISA publishes advisories and receives incident reports but does not regulate OT operators. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) will make incident reporting mandatory across sectors once CISA publishes its final rule, which has not happened as of October 2026.

There is no US counterpart of the EU's product law for industrial equipment; requirements for suppliers come through contracts and, in electricity, the CIP standards.

The United Kingdom's main law is the Network and Information Systems Regulations 2018 (the NIS Regulations), the UK implementation of the first EU NIS directive, kept in UK law after Brexit. They apply to operators of essential services (OES) in energy, transport, health, drinking water and digital infrastructure. Regulators assess operators with the Cyber Assessment Framework (CAF) of the National Cyber Security Centre, version 4.0 since August 2025.

The Cyber Security and Resilience (Network and Information Systems) Bill would amend the NIS Regulations with stricter reporting and a wider scope. As of October 2026 it is in the House of Lords (report stage scheduled for 26 October 2026) and has not received Royal Assent, so it is not yet law.

There is no single UK law like the EU's resilience directive, and no law like the EU's Cyber Resilience Act for industrial products; the UK product security regime covers consumer devices only.

NIS2 (Directive (EU) 2022/2555) obliges organizations in critical sectors to manage cybersecurity risk and report significant incidents. Member states had to transpose it into national law by 17 October 2024. The Netherlands was late: the Cyberbeveiligingswet was adopted by the Senate on 7 July 2026 and entered into force on 15 August 2026. It replaces the earlier Wet beveiliging netwerk- en informatiesystemen (Wbni). The general NIS2 obligations are explained on the Security page linked above; here is what they mean in Dutch practice.

The NERC CIP Reliability Standards apply to the organizations that own or operate the bulk electric system, the high-voltage backbone of the North American grid. Each standard has a number and a version, and versions take effect on their own dates. CIP-002 to CIP-014 are enforced today; CIP-012-2 (protecting communications between control centers), for example, took effect on 1 July 2026. A package of revisions for virtualized systems takes effect on 1 July 2028, CIP-015-1 (internal network security monitoring) on 1 October 2028 and CIP-003-11 on 1 July 2029.

Pipelines and railroads designated by TSA follow TSA Security Directives instead, renewed every year: for pipelines, Security Directive Pipeline-2021-01G (valid 16 January 2026 to 15 January 2027) and Pipeline-2021-02G (3 May 2026 to 2 May 2027). TSA proposed a rule in November 2024 to make these duties permanent; reportedly it is still not final as of October 2026, so check its current status.

The NIS Regulations 2018 apply to operators of essential services above thresholds set per service. The Cyber Security and Resilience Bill would amend them: stricter incident reporting, more types of organization in scope, and the power for regulators to designate critical suppliers. Until it receives Royal Assent the 2018 Regulations apply as they are.

The Cbw has four duties:

• Duty of care (zorgplicht): take appropriate, risk-based technical and organizational measures for the network and information systems the services depend on. For an energy company, that explicitly includes OT: control systems, substation automation, remote access and suppliers.
• Registration (registratieplicht): register in the NCSC entity register through MijnNCSC, including the organization's domain names.
• Incident reporting (meldplicht): for a significant incident, an early warning within 24 hours, an incident notification within 72 hours and a final report within one month of the incident notification.
• Board responsibility: board members are accountable for the measures and must follow cybersecurity training; they have two years to comply with that training duty.

For electricity, NERC CIP comes down to these duties:

• Categorize (CIP-002): sort the BES Cyber Systems (the cyber systems of the bulk electric system) into high, medium and low impact. Almost every other requirement depends on that rating.
• Protect: security management controls (CIP-003), personnel and training (CIP-004), electronic and physical security perimeters (CIP-005, CIP-006), system security (CIP-007), recovery plans (CIP-009), configuration and vulnerability management (CIP-010), information protection (CIP-011) and supply chain risk management (CIP-013).
• Report (CIP-008, for high- and medium-impact systems): a Reportable Cyber Security Incident to the E-ISAC (the Electricity Information Sharing and Analysis Center) and CISA within one hour of determining it, an attempt to compromise by the end of the next calendar day, and updates within seven calendar days of new information.

TSA's pipeline directives require a cybersecurity coordinator available 24/7, incident reports to CISA within 72 hours, a TSA-approved Cybersecurity Implementation Plan (segmentation between IT and OT, access control, monitoring, patching), an incident response plan that is exercised, and an assessment program. NERC CIP has no board-training duty like the Cbw's.

The NIS Regulations give an operator of essential services two main duties:

• Security measures: take appropriate and proportionate technical and organizational measures to manage the risks to the network and information systems the service depends on, and to prevent and minimize the impact of incidents. Regulators use the NCSC's CAF to assess them.
• Incident notification: notify the competent authority, without undue delay and no later than 72 hours after becoming aware, of any incident with a significant impact on the continuity of the essential service.

The Regulations put these duties on the operator; they have no separate board-training duty like the Dutch Cbw.

Supervision is organized per sector. For energy the supervisor is the Rijksinspectie Digitale Infrastructuur (RDI, the Dutch Authority for Digital Infrastructure), which supervises nine Cbw sectors in total. RDI has named supply-chain risk one of its supervision priorities for the energy sector in 2026.

The National Cyber Security Centre (NCSC-NL) has a different role: it runs the entity register and the incident-reporting portal, acts as a computer security incident response team (CSIRT; some sectors have their own designated CSIRT), and gives registered organizations threat information and support during incidents. It does not supervise or fine. A significant-incident report goes through the NCSC portal to both the CSIRT and the supervisor. That split matters in practice: the CSIRT helps you handle the incident, while the supervisor checks whether you meet the law.

NIS2 requires member states to allow fines with a maximum of at least €10 million or 2% of worldwide annual turnover, whichever is higher, for essential entities, and at least €7 million or 1.4% for important entities.

For electricity, FERC approves and enforces the CIP standards, and NERC and its Regional Entities audit compliance. Penalties can reportedly exceed $1.5 million per violation per day (the maximum is adjusted for inflation each January). Pipelines and railroads answer to TSA, drinking water systems to EPA.

CISA plays the CSIRT role: it publishes advisories and the Known Exploited Vulnerabilities catalog, receives incident reports and helps during incidents, but it does not supervise OT operators or fine them. For electricity, the E-ISAC, run by NERC, receives CIP-008 reports alongside CISA. The split is the same as elsewhere: the agency that helps you handle the incident is not the one that checks whether you meet the rules.

Each sector has a competent authority. For electricity in Great Britain it is the Secretary of State for Energy Security and Net Zero and the Gas and Electricity Markets Authority (Ofgem), acting jointly; for oil, the Secretary of State alone; for drinking water in England, the Secretary of State for Environment, Food and Rural Affairs. In practice the Department for Energy Security and Net Zero (DESNZ) sets energy policy and Ofgem handles day-to-day compliance, and the Drinking Water Inspectorate does the work for water, according to the regulators' own guidance. In 2026 DESNZ consulted on adding baseline cyber conditions to all Ofgem licenses and on reviewing which energy operators fall under NIS.

GCHQ is the single point of contact and the CSIRT; in practice that is the National Cyber Security Centre (NCSC), part of GCHQ. As in the Netherlands, the NCSC helps but does not fine; the competent authorities do. Under the 2018 Regulations a penalty can reach £1 million for a non-material contravention, £8.5 million for a material one and £17 million where there is or could be a significant risk to or impact on the service. According to summaries of the Bill, it proposes higher, turnover-based maximums and daily fines.

The organizations that are essential regardless of size include those designated as critical entities under the CER Directive. Medium-sized organizations in the sectors of high criticality, and medium-sized or large organizations in the other listed sectors (such as manufacturing, chemicals and food), are important entities. Size follows the EU definition of small and medium-sized enterprises (staff headcount and turnover); most small organizations are out of scope.

In electricity, scope is set system by system. CIP-002 rates each BES Cyber System as high, medium or low impact on the reliability of the grid, and the obligations scale with that rating: the higher the impact, the more requirements apply. The size of the company does not matter.

TSA's directives apply to the pipelines, liquefied natural gas facilities and railroads that TSA has designated as critical. The water rules apply to community water systems serving more than 3,300 people.

An organization is an operator of essential services when it provides a listed service above a threshold set for that service: in energy, for example, more than 250,000 customers for electricity distribution or supply, or at least 2 GW of generation. There is no split into essential and important entities: every operator of essential services has the same duties.

According to the government's factsheets, the Cyber Security and Resilience Bill would bring data centers, managed service providers and large load controllers into scope, and let regulators designate critical suppliers. Colocation data centers with at least 1 MW of rated IT load, and enterprise data centers with at least 10 MW, would fall under it, with Ofcom as their regulator.

The Wwke has been in force since 15 August 2026, on the same day as the Cbw.

• Designation. The government designates critical entities in 11 sectors, including energy; the law provides for designation within one month of entry into force. Roughly 500 organizations are expected to be designated, and they have about 10 months after designation to comply.
• Risk assessment of the organization's own risks, first within nine months of designation and then at least every four years.
• Resilience plan with the measures to prevent, absorb and recover from disruptions.
• Reporting of significant disruptions within 24 hours.
• Supervision is arranged per sector by the responsible ministry; for energy, RDI's own 2026 supervision plan names it as supervisor.

Critical entities also fall under the Cbw for their cybersecurity. For an OT team the two laws meet in practice: physical security of a substation and the cybersecurity of its control system are parts of one resilience story, and a single event can trigger both reporting duties.

There is no direct counterpart: no US law designates critical entities and requires an all-hazards resilience plan from them. Parts of the idea exist per sector. In electricity, the CIP standards include one for the physical security of transmission (CIP-014). Community water systems serving more than 3,300 people must assess their risks from malevolent acts and natural hazards and keep an emergency response plan, recertified every five years under the Safe Drinking Water Act.

There is no single UK law like the CER Directive. Resilience duties are spread over emergency-planning law, sector licenses and government protective-security advice for critical national infrastructure (CNI). Data centers were designated CNI on 12 September 2024. For an OT team the practical point is the same as elsewhere: physical security and cybersecurity of a site are one resilience story.

The code was adopted in March 2024 and entered into force on 13 June 2024. It applies to transmission system operators (TSOs), distribution system operators (DSOs), significant generation assets and information and communication technology (ICT) service providers whose services have a high or critical impact on cross-border electricity flows. Its measures cover risk management, minimum and advanced security controls, supply-chain security, a cybersecurity management system, verification, information sharing, crisis management and exercises.

The code works in stages, and most of them still lie ahead:

• Each member state appointed a competent authority by 13 December 2024. In the Netherlands that was the Authority for Consumers and Markets (ACM); since 1 January 2026 it is RDI.
• In 2025 a preliminary selection of entities was made, based on provisional thresholds of an electricity cybersecurity impact index; RDI stated that this brought no obligations yet.
• According to published planning summaries, a Union-wide cybersecurity risk assessment for electricity was due in draft in mid-2026 and in final form around the end of 2026, followed by proposals for minimum, advanced and supply-chain controls around early 2027. These dates may shift.
• Final designation of high-impact and critical-impact entities is expected in the Netherlands around mid-2028. From then on, designated entities must report cyberattacks with a possible cross-border effect within four hours, and the entity-level risk assessment cycles begin.

The counterpart for the North American grid is NERC CIP itself: the standards apply across the interconnected bulk power system, and CIP-008 already requires reporting within one hour of determining a reportable incident. There is no designation step to wait for; what still lies ahead are the revisions for virtualized systems (1 July 2028) and internal network security monitoring (1 October 2028).

The EU network code does not apply in Great Britain, which left the EU energy framework and forms its own synchronous area. Cybersecurity of electricity operators there runs through the NIS Regulations, supervised by DESNZ and Ofgem, and the 2026 proposals to add cyber conditions to Ofgem licenses.

• In force since 10 December 2024.
• Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting their products, including products already on the market.
• From 11 December 2027 the main obligations apply to products placed on the market from then on: security by design and by default, vulnerability handling, security updates during a stated support period, and conformity assessment before a product carries the CE marking.
• The European Commission published guidance on applying the CRA on 27 July 2026.

For an OT supplier, the CRA turns good practice into law: a secure development process, a way for researchers to report vulnerabilities, published advisories and a support period buyers can rely on. Suppliers that already follow IEC 62443-4-1 (secure development) and 62443-4-2 (component requirements) have a head start (see IEC 62443).

The United States has no law that sets security requirements for industrial products. Buyers set them through contracts, usually by asking for IEC 62443-4-1 (secure development) and 62443-4-2 (component requirements). In electricity, CIP-013 requires a supply chain risk management plan, which shapes what utilities demand from their vendors. For consumer wireless devices there is a voluntary label, the U.S. Cyber Trust Mark; industrial equipment is not its target. A US manufacturer that sells in the EU must still meet the CRA there.

The United Kingdom has no equivalent of the CRA for industrial products. Its product security (PSTI) regime, in force since 29 April 2024, covers consumer connectable products only. Buyers of industrial equipment set requirements through contracts, often based on IEC 62443-4-1 and 62443-4-2, and a UK manufacturer that sells in the EU must meet the CRA there.

Key dates as of October 2026:

• 1 July 2026: CIP-012-2 (communications between control centers) in effect.
• 15 January 2027: TSA Security Directive Pipeline-2021-01G expires unless renewed; Pipeline-2021-02G follows on 2 May 2027.
• 1 July 2028: the CIP revisions for virtualized systems take effect.
• 1 October 2028: CIP-015-1 (internal network security monitoring) takes effect.
• 1 July 2029: CIP-003-11 takes effect.
• Not yet dated: CISA's final rule under CIRCIA, which starts cross-sector incident reporting.

Key dates as of October 2026:

• 2018: NIS Regulations in force.
• 29 April 2024: the PSTI product security regime for consumer connectable products applies.
• 12 September 2024: data centers designated as critical national infrastructure.
• August 2025: version 4.0 of the NCSC's Cyber Assessment Framework.
• 27 March to 22 May 2026: DESNZ consultation on cyber conditions in Ofgem licenses.
• 26 October 2026: Lords report stage of the Cyber Security and Resilience Bill (scheduled); its duties apply only after Royal Assent and commencement.