OT Security: NIS2, IEC 62443 and the First Steps

##### 20 Aug 2025

Operational technology (OT) covers every system that controls a physical process, from a bridge control room to a production line. Those systems were deliberately kept apart from office networks for decades, but that separation is disappearing. Since 15 August 2026, many organisations that rely on OT also fall under the Dutch Cybersecurity Act. What does that mean in practice, and where do you start?

What is OT and where do you find it?

OT stands for operational technology: all the systems and devices that drive physical processes. At home that is the washing machine running at a set time or the robot vacuum doing its fixed rounds. In business it means machines on the factory floor, water treatment plants, traffic lights and bridge controls, and loading and unloading in ports and warehouses.

Precisely because OT runs in so many places — often at organisations delivering services in vital infrastructure — securing it is no longer optional. Two frameworks give direction: the IEC 62443 series for industrial automation and the Dutch Cybersecurity Act, the national implementation of NIS2.

Why securing OT differs from securing IT

Applying the IT playbook to OT will stall. The Dutch National Cyber Security Centre (NCSC) points out the differences that shape the approach:

Availability comes first. In IT, confidentiality usually leads; in OT it is continuity. Halting a process for an update can cost production or create unsafe conditions.

Lifecycles are far longer. OT installations often run for fifteen to twenty years, which means systems that still have years to go are running software that lost support long ago.

Patching is not straightforward. Maintenance happens in tight, planned windows and often only with the supplier's approval, because an update can affect an installation's certification or safety function.

Safety and security overlap. In OT an incident touches physical safety as well as data, so security decisions are made together with the safety engineers.

The NCSC's five basic principles

In *Getting started with securing OT/IACS* the NCSC describes five basic principles. They make a workable sequence for organisations that are still at the beginning:

1.Map your risks. Run a risk assessment on the OT environment and connect it to the safety processes already in place.

2.Encourage safe behaviour. A healthy safety culture needs visible management commitment and targeted training for the people on the floor.

3.Protect the systems. Reduce the attack surface (hardening), set up patch management that fits OT maintenance windows, and segment the network between office and process environments.

4.Manage access. Control both physical and digital access to systems and data, including access held by suppliers and maintenance partners.

5.Prepare for incidents. Document an incident response plan, exercise it annually, and keep a backup policy built on the assumption of a breach.

What the Dutch Cybersecurity Act means for OT

The Dutch Cybersecurity Act has been in force since 15 August 2026 and translates the NIS2 directive into national law. For organisations with OT in their primary process, four obligations stand out:

Duty of care. You assess the risks yourself and take appropriate measures — and OT systems are explicitly part of that, not just office automation.

Reporting obligation. A significant incident is reported within 24 hours as an early warning, followed by a fuller notification.

Board accountability. The board is liable for compliance and has to keep its own knowledge up to date.

Supply chain security. Agreements with suppliers and maintenance partners fall within scope, which weighs heavily in OT because external parties often monitor or intervene remotely.

Whether you fall under the act, and who supervises you, depends on your sector. The Dutch Authority for Digital Infrastructure maintains an overview of the supervised sectors and the NCSC collects the practical guidance on the act. Our blog covers the challenges of the act and demonstrable control as the new standard.

IEC 62443: the standard for industrial automation

Where the law states *that* you must take measures, the IEC 62443 series describes *how*. It addresses Industrial Automation and Control Systems (IACS): SCADA systems, PLCs, distributed control systems, and the sensors, actuators and networks that connect them.

IEC 62443 is not one standard but a series of parts, each with its own audience. NEN describes the structure as follows:

Part	What it covers	Mainly for
62443-2-1	The security management system for the IACS environment	End users
62443-2-4	Requirements for supplier services	Procurement and contract management
62443-3-3	System requirements and security levels	End users and integrators
62443-4-1	A secure development process for products	Suppliers
62443-4-2	Technical requirements for individual components	Suppliers and integrators

The security levels in the series make the conversation concrete: designers, suppliers and users can agree in the same language on the protection level a zone needs. Our IEC 62443 standard page shows how that works out in practice.

Five steps to get started

1.Inventory your OT assets. Without a current list of systems, versions and connections, every next step is guesswork.

2.Assess the risks per process, together with the people who keep the installation running.

3.Separate the networks. Segmentation between office and process networks usually delivers the largest risk reduction per euro invested.

4.Put supplier agreements in writing, including the conditions for remote access and reporting deadlines for incidents.

5.Exercise the scenario in which a production process comes to a halt, and test whether restoring your backups actually works.

How uComply helps

One place for your measures. uComply is built on Microsoft Dataverse and integrates with your Microsoft 365 environment: centralised controls and clauses, risk assessments, audit management, supplier reviews and incident registration in a single workflow.

Ready-made content packs for ISO 27001, NEN 7510 and the Dutch Cybersecurity Act among others, so your documentation does not start from zero.

Evidence for the regulator. Recorded assessments, measures and incidents produce the file a supervisor asks for.

Inside your own tenant. Because uComply runs within your own Microsoft environment, your data stays under your own security controls.

*Identifying OT assets, assessing risks and recording measures so they can be demonstrated: that is where OT security becomes concrete. Curious what that looks like for your organisation?*

Let's Chat