NIS2 for energy companies: scope and what compliance involves

Does NIS2 apply to our energy company, and what does compliance involve?

NIS2 covers electricity, district heating and cooling, oil, gas and hydrogen undertakings listed in Annex I, and undertakings in these subsectors that exceed the medium-sized enterprise ceilings are essential entities. Smaller in-scope energy undertakings are generally important entities unless another Article 3(1) category makes them essential, and a customer or regulator asking for NIS2 alignment should expect you to confirm which of the two you are before any scoping work starts. Ask your legal or regulatory team to check the category against the entity's headcount, turnover and balance sheet, and to confirm which national law applies, because the Member State where your entity is established determines the supervisor and the transposition rules you follow.

There is no certificate of compliance under NIS2. The national competent authority oversees your compliance through inspections, security audits, security scans, information requests and, where breaches are found, administrative fines. Cost and timeline depend on your size, your subsector (an electricity transmission operator and a small district heating network face very different control estimates), the maturity of your existing controls and how your Member State has transposed the Directive. Your organization owns its controls and their accountability, and management remains responsible under Article 20. An implementation partner such as DeployOpen can prepare systems, controls and evidence, including business continuity and physical protection records, but only the national authority, or an independent assessor the organization engages, reaches a conclusion on compliance. Ask any partner for a written, fixed scope before work begins, and confirm with your authority which evidence it expects.

What makes NIS2 work for an energy operator more or less expensive

For an energy undertaking, the size of the compliance effort is set less by the NIS2 text itself than by a handful of scope and architecture decisions made early. The cards below cover the decisions that move cost most, and for each one, how to control it through scope choices and phased work.

Essential or important status

Annex I energy undertakings above the medium-sized enterprise ceilings are essential entities, and essential entities face ex ante supervision, while others in scope are generally important and face ex post supervision. Both carry the same Article 21 and Article 23 duties, so the status changes how much proactive evidence a supervisor expects, not the list of measures. Confirm your status with your national competent authority and the Article 3 categories before sizing any work.

Sites and grid or generation assets

The number of substations, generation plants, district heating networks, hydrogen or gas sites, and control centers multiplies the systems that need asset inventories, access reviews, backups and physical protection checks. Consolidating control functions into fewer, well-documented sites reduces the surface you must evidence. Ask each asset owner to list the systems that could affect operations so that scope is drawn from an inventory, not from memory.

OT and IT segmentation

Operational technology such as control systems, protection relays and SCADA networks usually carries older equipment, long patch cycles and vendor-controlled access. Clear zones and conduits between corporate IT and OT networks limit how many systems must meet the full set of measures for access control, monitoring and recovery. Decide the zone boundaries early, because retrofitting segmentation after evidence collection has started is one of the more expensive corrections.

Third-party operators and vendors

Energy companies often rely on outsourced operators, maintenance contractors, remote monitoring providers and managed security services. Each of these adds supplier risk assessments, contract clauses and access reviews that the operator must be able to show. Decide which functions stay in-house, and for outsourced work, confirm early which evidence the provider can produce and how quickly, since that dependency sets much of the timeline.

Evidence maturity today

Organizations that already run documented policies, asset inventories, tested backups and logged access reviews need far less new work than those starting from informal practice. Most of the cost sits in turning existing practice into records a supervisor can inspect. Run a gap analysis against Article 21 and the implementing regulation requirements, and classify each gap as documentation, technical change or operational proof, since each costs differently.

CER critical entity status

Recital 30 says entities identified as critical entities under the CER Directive should be considered essential under NIS2, and the two sets of authorities should cooperate. If you are identified under CER, expect added physical resilience and all-hazards continuity work, and a second authority to coordinate with. Confirm your CER status with your national authority before deciding whether physical protection and continuity programs run as one project or two.

How CER critical entity status changes the picture

Energy operators identified as critical entities under the CER Directive, Directive (EU) 2022/2557, should be treated as essential entities under NIS2, according to Recital 30. That places them in the stricter supervisory regime, where the national competent authority supervises ex ante rather than only after an incident or on evidence of non-compliance. The recital also expects the two sets of competent authorities to cooperate and exchange information without undue delay, so a CER identification is not a separate track that stays out of view of the NIS2 supervisor.

Start by asking your national authority in writing whether your entity, or any of your sites or subsidiaries, has been identified as a critical entity under CER. Ask which authority acts as your NIS2 competent authority, which authority holds your CER file, and how information will be shared between them. Confirm the answer for each Member State where you operate, because transposition and designation details differ by country. Record the answers, since they determine whether you plan for essential status from day one and which physical and cyber resilience evidence the supervisor will request.

If you are identified under CER, plan for one body of evidence used by two authorities. Business continuity, the business impact analysis and physical protection measures are duties under both regimes, so the same facility records, test results and incident logs should support both. Assign one owner to keep the CER and NIS2 documentation aligned, and agree with your legal team how an incident is reported to each authority within the timelines that apply. Do not assume that a CER designation reduces your NIS2 obligations; treat it as a signal that supervision will be closer.

Business continuity and physical protection for energy assets

The control room and operational technology (OT) environment are where a physical event or a power or telecom failure can stop operations fastest, so they are usually the first place a business impact analysis looks. Recital 79 of NIS2 describes the all-hazards approach, which covers theft, fire, flood, telecommunication or power failures and unauthorized physical access, not only cyber intrusion. For an energy operator, that means the control room must keep working, or fail safely, under each of those events.

Continuity targets for OT systems: Derive recovery priorities for supervisory control, SCADA historians and engineering workstations from the business impact analysis required by point 4.1.3 of Implementing Regulation (EU) 2024/2690.
Physical access to the control room: Record who can enter, how access is logged and how visitors and contractors are escorted.
Fire and environmental protection: Document fire detection, suppression and the monitoring of temperature and humidity in equipment rooms.
Backup control capability: Confirm that a secondary control location or manual operating procedure exists and has been exercised.
Configuration and recovery records: Keep tested backups of controller configurations so that a rebuild can be evidenced.

Confirm with your national competent authority and your OT vendors which of these items they expect as documented evidence, and how often they expect the backup control arrangement to be tested.

How a NIS2 readiness program moves from scoping to evidence

The sequence turns an energy undertaking's legal position into a documented, tested set of Article 21 measures and an evidence pack that a national competent authority can review. Each phase produces an output that the next phase depends on.

Confirm scope and entity classification
Establish which energy subsector the organization operates in (electricity, district heating and cooling, oil, gas or hydrogen), whether it is an undertaking under Annex I, and whether it exceeds the medium-sized enterprise ceilings that make it essential. Check whether it has been identified as a critical entity under the CER Directive, since recital 30 of NIS2 points toward essential status in that case. Confirm the Member State with jurisdiction and any sector-specific rules that may displace parts of NIS2. The output is a written classification memo signed off by management, with the competent authority named for each relevant jurisdiction.
Assign governance and management accountability
Confirm that the management body approves the cybersecurity risk-management measures, oversees their implementation and has completed the training Article 20 requires. Name an accountable owner for NIS2 within the organization and record the reporting line to the board. Decide which duties will be supported by a vCISO, a consultant or a managed provider, and which must stay with executives. The output is an approved governance charter, a roles and responsibilities matrix and board minutes that record the decisions.
Run the gap assessment against Article 21
Compare current controls against the ten minimum measures in Article 21(2) and the technical requirements in Implementing Regulation (EU) 2024/2690 where they apply to the organization. For energy operators, pay particular attention to operational technology, remote access, supplier access and physical protection of facilities. Record each gap with its owner, the evidence that exists today and the evidence a supervisor would expect. The output is a gap register that lists every measure with a status and a reference to the supporting document or system record.
Perform the risk assessment and business impact analysis
Identify the network and information systems that support electricity, heat, fuel, gas or hydrogen operations, and assess threats across the all-hazards scope, including theft, fire, flood, power and telecommunications failures and unauthorized physical access. Carry out a business impact analysis and derive continuity requirements for those systems from it, as the implementing regulation requires. Document how utility failures, backup power and emergency fuel supply affect each critical process. The output is a risk register, a business impact analysis and a set of continuity requirements that feed the remediation plan.
Plan and execute remediation
Turn each gap and each risk treatment decision into a dated work item with an owner and an acceptance test. Typical work includes segmentation of operational technology networks, hardened remote access, backup and restore testing, redundant power and connectivity for critical sites, monitoring of environmental conditions, and contracts that secure emergency supplies. Where a supplier is part of the fix, record the contract clause or assurance obtained. The output is a remediation tracker where each item closes only when its test result is stored as evidence. Ask any implementation partner to state in writing which items it will deliver and which remain with the organization.
Test controls and incident response
Verify that the controls work as designed. Test backups by restoring them, run tabletop or technical exercises for the incident reporting path, and confirm that the early warning, notification and final report steps under Article 23 can be executed within the required periods. Check that logs needed for reconstruction are retained and reviewed. The output is a test log with dated results, exercise reports and corrective actions, which show the controls operate and not only exist on paper.
Assemble the evidence pack for the supervisor
Compile a structured evidence pack that maps each Article 21 measure to its policy, procedure, technical record, test result and owner. Include the classification memo, governance records, the gap register, the risk assessment, the business impact analysis, the remediation outcomes and the test reports. Keep the pack current, since supervisors may request information or run inspections and security scans at any time. The output is a versioned evidence index that a competent authority can navigate without interviews. Note that NIS2 issues no certificate: the national competent authority decides whether the organization complies, and DeployOpen prepares systems and evidence but does not issue any attestation.

What the 24-hour early warning means for operations

Under Article 23(4)(a) of NIS2, an essential entity must submit an early warning without undue delay and in any event within 24 hours of becoming aware of a significant incident. The clock starts at awareness, not at the moment the incident began, and the early warning is a short first notice that tells the authority the incident exists and whether it may be caused by unlawful or malicious acts or could have cross-border effects. The stages that follow are the incident notification and the final report in Article 23. Operationally, the 24 hours is measured from the moment someone on the operator's side can reasonably conclude that a significant incident has occurred, so the decision point for classifying an event is itself a control that auditors and supervisors will ask about.

For an electricity, gas, district heating or hydrogen operator, most significant incidents will start in operational technology: a SCADA alarm that does not clear, a protection relay behaving unexpectedly, or a loss of visibility at a substation. Plan on-call rotations that include OT engineers, not only IT staff, and write down who holds decision rights to declare a significant incident, who approves the early warning, and who can deputize if the named person is unreachable. Keep the decision matrix short enough to use at 3 a.m. and rehearse it against a sample OT scenario, because a 24-hour window is consumed quickly when the first question is who is allowed to decide.

Confirm the national reporting portal, its login arrangements, the required early warning template and the competent authority or CSIRT that receives it, since these are set by each Member State's transposition law rather than by NIS2 itself. Ask the authority whether it accepts reports from a shared mailbox or only named individuals, and whether energy operators must also report under the CER Directive or sector rules, which can run on parallel clocks. Keep the portal contacts and template in the incident runbook, and test the submission path during an exercise so the first real use is not the first time anyone has logged in.

Who gets paid for what in an energy NIS2 program

This table compares the main cost components of an energy NIS2 program, who is paid for each, whether it is one-time or recurring, and what drives it up or down. Use it to structure written scopes and quotes so each cost has a clear owner. Management time and monitoring are often the largest recurring items, so ask every supplier to price them separately.

Cost component	Who is paid or carries the cost	One-time or recurring, and what drives it
Internal staff and management time	The energy undertaking's own staff and management body	Both. Initial scoping, Article 20 approval and training are one-time; reviews, reporting drills and evidence upkeep recur. Size depends on the number of sites, subsectors covered and legacy OT estate.
External gap assessment or consultant	Consultant or advisory firm	Mostly one-time. Depends on how many electricity, gas, oil, hydrogen and heating assets are in scope and how many existing policies can be reused. Ask for a written scope.
Implementation partner for systems and evidence	Implementation partner such as DeployOpen, paid under a fixed-scope agreement	One-time for build and hardening, then recurring for upgrades and support. Driven by the number of self-hosted platforms, integrations with OT and SCADA environments, and the evidence the supervisor will request.
Business continuity and physical protection work	Engineering, facilities and continuity specialists, often internal	One-time for business impact analysis and redundancy design, recurring for testing of power, temperature and connectivity monitoring. Driven by site count and utility dependencies.
Security testing	Testing firm, such as DeployOpen for applications, infrastructure and OT-adjacent systems	Recurring in most programs. Driven by the number of internet-facing and critical systems, and by whether testing covers operational networks, which needs careful planning.
Managed monitoring for reporting deadlines	Managed SOC or monitoring provider	Recurring. Driven by monitored asset count, hours of coverage and the 24-hour early warning requirement under Article 23(4)(a). Ask who makes the reporting decision and how escalation works.
Tooling and licences	Software vendors and hosting providers	Both. Licence fees recur. Self-hosted open-source platforms remove some licence costs but add hosting, backup and maintenance effort inside the client's infrastructure.
Independent assessment where the client engages one	Independent auditor or certification body, if used	Periodic. NIS2 creates no certificate of compliance, so any assessment is a voluntary choice. Its scope and frequency depend on the client's chosen framework and assurance needs.
Fines exposure (not a cost to budget for)	National competent authority, if non-compliant	Not a budget line. Article 34(4) sets maximum fines for essential entities at least EUR 10 000 000 or at least 2% of worldwide annual turnover, whichever is higher. Use this as the reason to fund the rows above.

Who owns controls, who prepares evidence, and who decides compliance

The electricity, district heating and cooling, oil, gas or hydrogen undertaking remains legally responsible for its NIS2 obligations. Under Article 20, the management body must approve the Article 21 risk-management measures, oversee their implementation and can be held liable for infringements. Members of the management body are also expected to complete cybersecurity training. Day-to-day control ownership sits with named people inside the operator, such as the CISO, the operations technology lead, facilities management and business continuity owners.

Management body approval: Board or executive minutes that approve the measures, the budget and the risk appetite.
Named control owners: A register that assigns each Article 21 measure and each sub-requirement to an accountable person.
Business impact analysis: Continuity requirements derived from the operator's own analysis, as the implementing regulation requires.
Incident reporting decisions: Staff authorized to decide when an incident is significant and to submit the 24-hour early warning.
Operational technology scope: Ownership of control system networks, which often sit outside standard IT governance.

Confirm that your board has a documented role in approving these measures and that each control has one named owner before any partner begins work.

How to choose a partner for an energy NIS2 program

An energy NIS2 program touches operational technology, physical sites and regulated reporting duties, so a partner must understand both the directive and the plants it will touch. The cards below set out the checks that separate a capable implementation partner from a generic one, and the questions to put to each candidate before a scope is agreed.

OT and energy sector experience

Ask for evidence that the partner has worked on operational technology in electricity, gas, district heating or oil environments, not only on office IT. Check whether their team understands control networks, historian and SCADA segmentation, vendor remote access and change windows that cannot be stopped for patching. Ask who on the team has done this work and whether that person will be on your engagement.

Knowledge of national transposition

NIS2 binds entities through national laws, so the same energy undertaking can face different registration steps, reporting channels and supervisors across Member States. Confirm that the partner knows which national law applies to your establishment, which competent authority will supervise you, and how that authority expects evidence to be presented.

Fixed scope and written deliverables

Require a written scope that lists systems, sites, subsidiaries, deliverables and acceptance criteria before work begins. A clear scope shows which controls the partner will implement, which the organization must own, and which evidence the assessor will receive. Reject proposals where deliverables are described only as ongoing support.

Separation of preparation and assessment

The party that configures controls and assembles evidence should not also be the party that tests or certifies them. Ask the partner to confirm in writing that it will prepare systems and documentation only, and that any independent assessment will be carried out by a separate auditor or certification body chosen by you.

Data handling inside your environment

Operational and incident data from energy sites can be sensitive. Confirm that the partner will work inside your cloud accounts, data centers or air-gapped networks, that access is granted and logged under your control, and that any copies of logs or configurations leave your environment only under an agreed written procedure.

Verifiable references

Ask for references you can contact, and for examples of deliverables with names removed, such as a control mapping or an incident reporting runbook. Where a candidate cannot name clients, ask how it will show relevant work through the people who would staff your project and through documented outputs you can review.

NIS2 energy questions buyers ask before hiring help

Are energy companies essential or important under NIS2?

Most energy undertakings in scope are either essential or important, and size is the first test. Annex I covers electricity, district heating and cooling, oil, gas and hydrogen. An Annex I entity that exceeds the medium-sized enterprise ceilings is essential under Article 3(1)(a). Other in-scope energy entities are important, unless another Article 3(1) category makes them essential. Check your headcount, turnover and balance sheet against the Article 3 thresholds and your national transposition law, because the classification sets how supervision works. Essential entities face ex ante supervision, and important entities face ex post supervision. Both carry the same Article 21 and Article 23 duties, so the classification changes when and how a regulator looks at you, but it does not lower the duties. Ask any prospective partner to record the classification reasoning in writing before scoping starts.

How do NIS2 fines work for essential energy companies?

For infringements of Article 21 or Article 23, essential entities face a maximum fine of at least EUR 10 000 000 or at least 2% of total worldwide annual turnover in the preceding financial year, whichever is higher. The percentage limb matters most for large groups, because once 2% of turnover exceeds the flat amount, exposure rises with revenue. These figures are the floor for maximum levels under Article 34(4), so confirm the actual ceilings in your Member State's transposition law. Authorities weigh the general conditions in Article 34 when setting an amount, and they can also use other enforcement measures. The fine is only one cost. Remediation orders and additional audits can follow a serious finding, so plan budget for evidence and fixes before an inspection starts.

Does CER critical entity status change who supervises us?

CER status does not create a new NIS2 supervisor, but it adds a second regulator you must coordinate with. Recital 30 of NIS2 says entities identified as critical entities under the CER Directive, Directive (EU) 2022/2557, should be considered essential entities under NIS2. It also says the two sets of competent authorities should cooperate and exchange information without undue delay. In practice, your NIS2 competent authority still oversees compliance with Article 21 and Article 23, while the CER authority oversees physical resilience. Confirm the designated authorities in your Member State, since national law names them. Build one evidence set that both authorities can read, covering business continuity, physical protection and incident handling. When an inspection touches both regimes, the same records should answer both sets of questions.

What does a NIS2 energy program need from our own staff?

Several parts of the program must stay with your people, whoever helps you:

Management body approval and oversight of the Article 21 measures, which is the governance duty in Article 20.
Ownership of the business impact analysis, because continuity requirements for network and information systems are derived from it (Implementing Regulation 2024/2690, Annex, point 4.1.3).
Operational owners for physical protection, utility dependencies and emergency fuel contracts (point 13.1.2).
A named person who can run the 24-hour early warning and the later notifications under Article 23.

Outside partners can prepare systems, configuration baselines, logs and evidence, but your staff must understand and operate them after handover. Ask for a responsibility matrix in the written scope. Expect time from operations, OT engineering, facilities and legal teams throughout the work.

Can our team run NIS2 readiness in-house?

Often yes for the parts you already run, but the gaps usually sit in evidence and reporting. A team with mature change control, asset inventory and incident response has a head start. Measure your current state against the Article 21 measures and the implementing regulation's requirements for your entity type, and check whether your Member State adds rules. Work that many energy operators hand to outside help includes the gap analysis itself, segmentation review across mixed IT and OT estates, hardening, evidence capture, and rehearsing the 24-hour early warning. DeployOpen implements, customizes and documents systems inside your own infrastructure under a fixed scope agreed in writing, and your staff keep ownership of the controls. Ask any provider which deliverables they will hand over and which decisions stay with you.

Is there a NIS2 certificate that proves energy compliance?

No. NIS2 creates no certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines under Articles 32 to 34. There is no badge to buy. Buyers and regulators will instead ask for evidence such as policies, risk assessments, the business impact analysis, incident records and test results. ENISA's NIS2 technical implementation guidance, published in June 2025 for Implementing Regulation 2024/2690, includes examples of evidence and mappings to ISO/IEC 27001:2022 and NIST CSF 2.0. Such mappings help structure the work, but they do not replace the national authority's judgment. Independent auditors and certification bodies issue reports and certificates for standards such as ISO 27001. DeployOpen prepares systems and evidence but does not issue audit reports, attestations or certifications, so ask any vendor to state exactly which document they will deliver.

How DeployOpen prepares energy systems and evidence for NIS2

DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside the client's own infrastructure, so energy operators can show NIS2 controls working in their own environment. The organization keeps ownership of its controls and decisions, while DeployOpen prepares the systems and evidence that supervisors and independent assessors review.

How we scope

We agree a written, fixed scope covering the electricity, gas, oil, district heating or hydrogen systems in question before work starts.
We map which operational technology, IT and hosting environments fall within the energy entity's network and information systems.
We confirm with the client which essential or important status applies and which CER Directive critical entity obligations also apply.

How we build

We implement and harden open-source platforms in your cloud accounts, data centers or air-gapped networks, with configuration you can inspect.
We set up business continuity measures derived from a business impact analysis, including backup, redundancy and tested restoration.
We configure logging and monitoring that records the data needed to judge whether an incident is significant and reportable.

How we hand over

We document system configurations, control procedures and test results in a form your compliance team and external auditors can review.
We prepare evidence packs for Article 21 measures, including physical protection and utility failure controls, for supervisory inspections.
We run incident reporting exercises against the 24-hour early warning deadline so your staff know the process before a real event.

How we support

Ongoing support, upgrades and continuous security testing are available as a retainer after handover.
We can run security testing of applications, APIs, cloud and infrastructure, including scenarios for energy operations, under the agreed scope.
Confirm with us in writing which support, testing and evidence refresh activities are included in your retainer and at what frequency.

NIS2 for energy companies