For managers and boards of Polish water and wastewater utilities, recent years have been a period of real revolution. On the one hand, the rising tide of cyber attacks on critical infrastructure is making it clear that the threat is real and could have catastrophic consequences. On the other hand, the European Union, through the NIS2 directive, is transforming this threat into a concrete, hard legal obligation with the threat of gigantic sanctions.
Many managers, looking at the list of new requirements - from advanced monitoring systems to network segmentation to business continuity plans - are asking themselves one key question: “How are we going to fund all this?” The directive imposes obligations, but does not directly provide a budget for their implementation. This phenomenon, known as the “unfunded mandate,” is one of the biggest pain points for the public sector and critical infrastructure.
Fortunately, for the water utility sector, the perfect solution to this dilemma is on the horizon. The “Cyber-Secure Water Supply” grant program, funding 100% of eligible costs up to the de minimis aid limit (EUR 300,000 over three years), was explicitly designed to enable companies to finance the investments needed to achieve NIS2 compliance. This is a unique synergy where legal obligation meets a dedicated financing tool.
Shortcuts
- What exactly is the NIS2 directive and why does it apply to water utilities?
- What are the most important obligations that NIS2 imposes on water utilities?
- What are the consequences of not complying with the new regulations?
- How does the “Cyber Safe Water Supply” grant fit into these responsibilities?
- Can you fund the risk analysis required by NIS2?
- How does the grant help secure the supply chain, as NIS2 requires?
- Can grant funds be used to build response and business continuity plans?
- How to fund mandatory training for management and staff?
- Is the grant a one-time aid or part of a long-term strategy?
- What are the risks if we ignore NIS2 and don’t take advantage of the grant?
- Beyond compliance, what are the benefits of implementing NIS2 with a grant?
- What are the first steps to combine the two possibilities?
- NIS2 and Grant: The Perfect Combination of Duty and Opportunity
- How can nFlo help you in this strategic process?
What exactly is the NIS2 directive and why does it apply to water utilities?
The NIS2 Directive is a new pan-European law that aims to strengthen the cyber security of key economic sectors. It replaces and significantly expands the previous NIS Directive. Most importantly, the drinking water supply and sewage collection and treatment sectors are explicitly listed as essential entities. This means that virtually every water and wastewater utility in Poland will have to implement its stringent requirements.
📚 Read the complete guide: Ransomware: Ransomware - what it is, how to protect yourself, what to do after an attack
What are the most important obligations that NIS2 imposes on water utilities?
The directive requires company boards to implement a comprehensive cyber security risk management system. This includes at least ten key areas, including but not limited to: having policies and procedures in place, implementing incident response and business continuity plans, securing the supply chain, testing security regularly, and providing training for personnel. This is a de facto requirement to build a mature security program from the ground up.
What are the consequences of not complying with the new regulations?
The consequences are extremely serious. First, financial penalties. For key entities, which include water utilities, the penalty can be up to €10 million or 2% of the company’s total annual turnover. Secondly, the directive introduces personal liability of board members for negligence, which can result in additional fines and even a ban on their management positions.
How does the “Cyber Safe Water Supply” grant fit into these responsibilities?
The grant program was designed to be directly responsive to the directive’s requirements. The catalog of eligible costs in the grant is almost a mirror image of the list of obligations from NIS2. It is possible to fund both the creation of the necessary documentation (policies, IRP/BCP plans) and the purchase of the technology needed to implement these plans (monitoring systems, firewalls). The grant also covers the cost of training, which is one of the directive’s requirements.
Can you fund the risk analysis required by NIS2?
Yes. Conducting a comprehensive risk analysis is a fundamental obligation imposed by NIS2. At the same time, conducting a cyber security audit, which is a de facto form of such analysis, is a key eligible cost in the grant program. This is a perfect example of synergy - by completing the first step on the way to the grant, we simultaneously meet one of the most important legal requirements.
How does the grant help secure the supply chain, as NIS2 requires?
NIS2 requires companies to verify the security of their suppliers. The grant can fund security audits of key suppliers or the purchase of specialized platforms to assess supply chain risk. It can also cover the cost of implementing technologies (e.g., PAM systems for remote access control) that allow secure collaboration with third-party service companies.
Can grant funds be used to build response and business continuity plans?
Of course. The development and implementation of an Incident Response Plan (IRP) and Business Continuity Plan (BCP) is another hard requirement of NIS2. The “Cyber Secure Water Supply” grant fully funds the cost of consulting services related to the creation of these plans, as well as the purchase of the technology needed to implement them (e.g., backup and disaster recovery systems).
How to fund mandatory training for management and employees?
NIS2 requires that both technical staff and management itself receive regular cyber security training. The grant program explicitly lists raising competence as one of its main goals. This means that an entire, comprehensive training program can be funded - from e-learning for all employees, to advanced certified training for engineers and strategic workshops for management.
Is the grant a one-time aid or part of a long-term strategy?
Although the grant itself is awarded on a one-time basis, it should be seen as a powerful impetus to begin a long-term transformation. Funds from the program allow you to build a foundation - to implement key technologies and processes. This gives the organization a huge “leap” in maturity level. It will already be the company’s job to maintain and further develop these capabilities in the years to come, but this will be a much easier task once you have a solid foundation in place.
What are the risks if we ignore NIS2 and don’t take advantage of the grant?
The risks are twofold. First, the company remains in a state of non-compliance with applicable laws, which, in the event of an audit or incident, risks the aforementioned gigantic financial penalties and personal liability for the board. Second, and perhaps more importantly, the company remains exposed to real attacks that could lead to water contamination, water supply interruptions and an image disaster from which it will be very difficult to recover. To ignore this situation is strategic and operational suicide.
Beyond compliance, what are the benefits of implementing NIS2 with a grant?
Achieving legal compliance is one benefit. The other, equally important, is the real strengthening of operational resilience. Investments funded by the grant - better monitoring, segmentation, contingency plans - translate into a lower risk of unplanned outages, not only those caused by cyber attacks, but also by simple technical failures. It’s an investment in the stability and predictability of the entire enterprise.
What are the first steps to combine the two possibilities?
The first step is to make a strategic decision to treat NIS2 and the “Cyber Secure Water Supply” grant as a single, coherent project. Then, conduct a gap analysis, which will show in which areas the company does not yet meet NIS2 requirements. The results of this analysis become direct input to the grant application, precisely justifying the need to fund specific investments.
NIS2 and Grant: The Perfect Combination of Duty and Opportunity
| NIS2 Directive requirement | How does the “Cyber Safe Water Supply” Grant help fund it? |
|---|---|
| Risk management | Funding for a comprehensive OT audit, which is the basis for risk analysis. |
| Incident handling | Funding for the development of an Incident Response Plan (IRP) and the purchase of SIEM/IDS systems. |
| Business continuity | Funding for the creation of a Business Continuity Plan (BCP) and backup/restoration systems. |
| Supply chain security | Funding for vendor audits and implementation of secure remote access (PAM). |
| Staff training | Funding for comprehensive security awareness programs and technical training for IT/OT. |
How can nFlo help you in this strategic process?
At nFlo, we have deep expertise in both areas. On the one hand, we are experts in implementing NIS2 and IEC 62443 requirements in industrial environments. On the other, we have hands-on experience in preparing effective strategies and audits that form the basis for applying for funding. We understand how to combine the language of regulations with the language of grant applications. Our “Starter Package: Audit and Grant Application” service is designed for exactly that purpose: to conduct an analysis of NIS2 compliance and turn the results into a professional grant application. The Cyber Secure Water Supply call for applications ran from 1 September to 2 October 2025 and is now closed, but the obligations under NIS2 and the Polish National Cybersecurity System Act apply to covered entities regardless of any grant. The compliance analysis is the starting point for meeting them and for preparing an application in future calls, if they are announced.
Where the grant ends and the obligation continues
A grant and a directive do not overlap one to one. Funding programmes typically cover analysis, documentation, part of the technology and training. The obligation also covers what no grant will pay for: keeping the monitoring running once the project closes, exercising the continuity plan, and reviewing the risk assessment every year. A utility that plans only to the edge of the funding is left with a half-finished system and an intact legal duty.
Planning the application around the obligation rather than the other way round is the sequence behind water utility cybersecurity.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Ransomware — Ransomware is a type of malicious software (malware) that blocks access to a…
- Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
- SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
- Backup — Backup, also known as a backup copy or safety copy, is the process of creating…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
Learn More
Explore related articles in our knowledge base:
- Amendment to the NSC Act (NIS2): What new obligations await Polish companies and how to prepare for them?
- Backup Microsoft Entra ID: Why Identity Protection Is Essential Today
- What are the best practices for preventing cyberattacks on local governments?
- Personal board liability for cybersecurity under NIS2
- Board Responsibility for OT Cybersecurity Under NIS2
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Related topics
See also:
