In the industrial world, where OT/ICS systems control manufacturing processes, critical infrastructure, and supply chains, cybersecurity is no longer solely an IT department concern. The NIS2 Directive makes it clear - the board bears personal responsibility for organizational security.
The New Legal Reality
From IT to OT - Expanded Scope of Responsibility
Traditionally, cybersecurity focused on IT systems - servers, workstations, databases. OT (Operational Technology) systems operated in isolation, often with the belief that an “air gap” provided sufficient protection.
This era is ending for several reasons:
Why OT is now in the spotlight:
┌─────────────────────────────────────────────────────────┐
│ 1. IT/OT Convergence │
│ - Integration of production systems with ERP │
│ - Remote monitoring and management │
│ - IIoT (Industrial Internet of Things) │
├─────────────────────────────────────────────────────────┤
│ 2. Rise in Industrial Attacks │
│ - Colonial Pipeline (2021) - supply disruption │
│ - JBS Foods (2021) - production shutdown │
│ - Norsk Hydro (2019) - $70M in losses │
├─────────────────────────────────────────────────────────┤
│ 3. Legal Regulations │
│ - NIS2 - expansion to important entities │
│ - IEC 62443 as reference standard │
│ - Sector-specific requirements (energy, transport) │
└─────────────────────────────────────────────────────────┘What Does NIS2 Say About Board Responsibility?
The NIS2 Directive introduces unprecedented requirements for management accountability:
Article 20 - Governance:
- Management bodies must approve cybersecurity risk management measures
- Must oversee their implementation
- Can be held liable for infringements
- Must undergo cybersecurity training
Consequences in numbers:
| Category | Financial Penalties | For Board Members |
|---|---|---|
| Essential entities | up to EUR 10M or 2% of turnover | Ban from executive functions |
| Important entities | up to EUR 7M or 1.4% of turnover | Personal liability |
📚 Read the complete guide: SOC: Security Operations Center - what it is, how it works, how to choose
The Gap Between Policy and Reality
The “Paper Security” Problem
Many organizations have extensive security documentation - policies, procedures, business continuity plans. The problem is that often these exist only on paper.
Typical symptoms of "paper security":
├── Policies written for audit, not for practice
├── Procedures not updated for years
├── DR/BC plans untested or never used
├── No OT asset inventory
├── Unknown actual security level
└── Assumption: "it can't happen here"The Questions Regulators Will Ask
In case of an incident, regulators won’t just ask “do you have a security policy?”. They will ask:
- Did the board know about OT-related risks?
- Were adequate actions taken to address identified threats?
- Was security effectiveness regularly tested?
- Do response procedures work in practice?
- Was the organization prepared for known attack scenarios?
Reality in Many Organizations
OT security status - common observations:
┌─────────────────────────────────────────────────────────┐
│ Inventory │
│ ❌ Incomplete list of OT devices │
│ ❌ Unknown firmware/software versions │
│ ❌ No network connection mapping │
├─────────────────────────────────────────────────────────┤
│ Segmentation │
│ ❌ Flat IT/OT network │
│ ❌ No security zones (Purdue Model) │
│ ❌ Direct internet access to controllers │
├─────────────────────────────────────────────────────────┤
│ Monitoring │
│ ❌ No OT traffic visibility │
│ ❌ Logs not collected or analyzed │
│ ❌ No anomaly detection for industrial protocols │
├─────────────────────────────────────────────────────────┤
│ Response │
│ ❌ IR procedures untested │
│ ❌ No controller configuration backups │
│ ❌ Unknown system recovery time │
└─────────────────────────────────────────────────────────┘IEC 62443 as the Foundation for OT Security
Why IEC 62443?
The IEC 62443 standard is an international framework dedicated to industrial automation system security. NIS2 references it as a benchmark for organizations in the industrial sector.
IEC 62443 Structure:
IEC 62443-1-x: Terminology and concepts
IEC 62443-2-x: Policies and procedures
IEC 62443-3-x: System requirements
IEC 62443-4-x: Component requirements
Key elements:
├── Security Levels (SL 1-4) - security levels
├── Zones and Conduits - communication zones and channels
├── Security lifecycle - security management lifecycle
└── Maturity levels - organizational maturity levelsSecurity Levels in Practice
The standard defines four Security Levels:
| SL | Description | Adversary |
|---|---|---|
| SL 1 | Protection against casual violations | Errors, accidents |
| SL 2 | Protection against intentional low-resource attacks | Script kiddies |
| SL 3 | Protection against sophisticated attacks | Organized groups |
| SL 4 | Protection against state-level attacks | APT, nation-state |
Key question: What SL level is required for your systems, and what level do you actually achieve?
Practical Steps for the Board
Step 1: Know Your Actual State
You cannot manage what you don’t know. The first step is an honest assessment of current OT security status.
OT/ICS Security Audit should include:
OT Audit Scope:
1. INVENTORY
├── All OT devices (PLC, HMI, SCADA, DCS)
├── Network connections and IT/OT touch points
├── Software and firmware versions
└── Users and permissions
2. ARCHITECTURE ASSESSMENT
├── Network segmentation (Purdue Model compliance)
├── Remote access points
├── Data flows between zones
└── Boundary protection mechanisms
3. VULNERABILITY ANALYSIS
├── Known CVEs for OT devices
├── Default passwords and configurations
├── Outdated software
└── Open ports and services
4. PROCESS ASSESSMENT
├── Change management procedures
├── Backup and recovery
├── Monitoring and response
└── Staff trainingStep 2: Determine Required Security Level
Based on business risk analysis and regulatory requirements, determine the target security level.
NIS2 Compliance Assessment for OT/ICS will help determine:
- Whether the organization falls under NIS2 (essential/important entity)
- What requirements must be met
- Where the biggest gaps are
- Prioritized remediation plan
Step 3: Build an OT Security Program
OT Security Program Elements:
┌─────────────────────────────────────────────────────────┐
│ GOVERNANCE │
│ ├── OT security policy │
│ ├── Roles and responsibilities (including board) │
│ ├── Budget and resources │
│ └── Reporting to management │
├─────────────────────────────────────────────────────────┤
│ PROTECTION │
│ ├── Network segmentation (zones and conduits) │
│ ├── Access control (including remote) │
│ ├── Vulnerability management │
│ └── System hardening │
├─────────────────────────────────────────────────────────┤
│ DETECTION │
│ ├── OT traffic monitoring │
│ ├── Anomaly analysis │
│ ├── SOC integration │
│ └── Threat intelligence │
├─────────────────────────────────────────────────────────┤
│ RESPONSE │
│ ├── IR procedures for OT │
│ ├── Business continuity plan │
│ ├── Configuration backup │
│ └── Exercises and tests │
└─────────────────────────────────────────────────────────┘Step 4: Test and Verify
Having procedures is not the same as them working. Regular testing is essential.
Types of tests:
| Test | Frequency | Purpose |
|---|---|---|
| Vulnerability scanning | Quarterly | Gap identification |
| OT penetration testing | Annually | Security verification |
| Tabletop exercises | Semi-annually | Response procedures |
| DR/BC tests | Annually | System recovery |
| Compliance audit | Annually | IEC 62443/NIS2 compliance |
The Board’s Role - Specific Obligations
What Does NIS2 Require from Management?
Board obligations under NIS2:
1. APPROVAL
└── Cybersecurity risk management measures
2. OVERSIGHT
└── Implementation and effectiveness of measures
3. TRAINING
└── Regular cybersecurity competency development
4. ACCOUNTABILITY
└── Personal liability for violationsPractical Actions for Board Members
1. Regular security briefings:
- Monthly reports on OT security status
- Review of key indicators (KRI/KPI)
- Information on incidents and near-misses
- Sector threat intelligence updates
2. Engagement in decisions:
- Approving OT security budget
- Accepting residual risk level
- Decisions on technology investments
- Review of audit results
3. Building security culture:
- Communicating the importance of OT security
- Supporting security teams
- Zero tolerance for shortcuts
- Leading by example
Consequences of Inaction
Scenario: Attack on an Unprepared Organization
Incident Timeline:
T+0: Ransomware infects IT network
T+2h: Malware spreads to OT (no segmentation)
T+4h: Production lines stop
T+24h: Recovery attempts - no PLC configuration backups
T+72h: Production still down, losses mounting
T+7days: Partial restoration, but without full functionality
T+30days: Report to regulator, proceedings begin
Consequences:
├── Financial
│ ├── Operational losses: no production for weeks
│ ├── Recovery costs: external experts, equipment
│ ├── Regulatory fines: up to EUR 10M
│ └── Compensation: contracts, customers
├── Legal
│ ├── Regulatory proceedings
│ ├── Civil lawsuits
│ └── Personal board liability
└── Reputational
├── Loss of customer trust
├── Negative PR
└── Impact on company valueHow to Demonstrate Due Diligence?
In case of an incident, the board will need to demonstrate that:
- They knew the risks - regular reports, briefings, training
- They took action - budget, projects, investments
- They oversaw implementation - meeting minutes, decisions
- They tested effectiveness - audit results, tests, exercises
- They responded to changes - updates following industry incidents
Where to Start?
Minimum Immediate Actions
Board Checklist - Priority Actions:
☐ Commission inventory of all OT systems
☐ Order OT security assessment (gap analysis)
☐ Designate person responsible for OT security
☐ Plan budget for 2024/2025
☐ Establish regular board reporting
☐ Complete OT cybersecurity trainingTransformation Roadmap
Phase 1: Visibility (0-3 months)
- Complete OT inventory
- Network and data flow mapping
- Critical system identification
Phase 2: Protection (3-9 months)
- IT/OT network segmentation
- Remote access control
- Critical system hardening
Phase 3: Detection (6-12 months)
- OT traffic monitoring
- SOC integration
- Response procedures
Phase 4: Maturity (12+ months)
- IEC 62443 compliance
- Regular tests and audits
- Continuous improvement
Summary
OT cybersecurity is no longer a technical issue left to the IT department. NIS2 clearly states - the board bears responsibility for organizational security, including industrial systems.
Key takeaways:
- Responsibility is personal - board members can face individual consequences
- Paper policies are not enough - actual security status matters
- Know your state - without an audit, you don’t know what to protect
- Regular testing is mandatory - procedures must work in practice
- Time to act is now - NIS2 is already in effect
The question is not “will an incident occur?” but “will the board be able to prove the organization was prepared?”
Need support assessing OT security status or preparing for NIS2 requirements? Contact us - we’ll conduct an OT/ICS security audit, IEC 62443 compliance assessment, and NIS2 requirements analysis.
Why the OT evidence looks different from IT
A board that has satisfied itself about IT security often assumes the same answers cover the plant. They do not, and the difference is not a matter of effort. In IT, a critical patch is applied within days; in OT, it waits for a maintenance window that may be six months away, and sometimes it never comes because the vendor will not certify the change. In IT, an asset inventory is generated automatically; in OT, half the devices cannot be scanned without risking the process they control.
So the evidence of due diligence in OT is not “we patched”, it is “we knew, we assessed, and we compensated”: a documented risk acceptance for what cannot be patched, plus the compensating control — segmentation, monitoring, physical restriction — that was put in its place. Producing that record in a form that survives an inspection is the substance of NIS2 for OT environments.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
- SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
- Network Security — Network security is a set of practices, technologies, and strategies aimed at…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
Learn More
Explore related articles in our knowledge base:
- Personal board liability for cybersecurity under NIS2
- How Does the NIS2 Directive Affect Enterprises? A New Era of Business Cybersecurity
- KSC and NIS2: why is the board now personally responsible for cyber security?
- NIS2 national implementation: how the directive is changing cybersecurity law across Europe
- What Are the Penalties for Non-Compliance with the NIS2 Directive? Guide to Consequences of Violating New Cybersecurity Regulations
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
Frequently asked questions
What responsibility does the board bear for OT security under NIS2?
NIS2 (Article 20) requires management bodies to approve risk management measures, oversee their implementation, undergo cybersecurity training, and bear personal liability for violations. Penalties include up to EUR 10 million or 2% of turnover, and for board members — a ban on holding management positions.
What is IEC 62443 and why is it important for OT security?
IEC 62443 is an international standard dedicated to industrial automation system security, referenced by NIS2 as a benchmark. It defines four security levels (SL 1-4), zones and communication conduits, and a security lifecycle for OT environments.
How can the board prove due diligence in the event of an OT cyber incident?
The board must demonstrate that it was aware of risks (regular reports, briefings, training), took adequate actions (budget, projects, investments), supervised implementation (meeting minutes), tested effectiveness (audit results, exercises), and responded to changes (updates after industry incidents).
Where should the board start with OT system protection?
Minimum immediate actions include: commissioning an inventory of all OT systems, ordering an OT security assessment (gap analysis), appointing a person responsible for OT security, planning the budget, establishing regular reporting to the board, and undergoing OT cybersecurity training.
