NIS2 for water utilities: scope, supervision and readiness

Does NIS2 apply to our water or waste water business?

NIS2 covers two kinds of water undertakings in Annex I: suppliers and distributors of water intended for human consumption (point 6), and undertakings that collect, dispose of or treat urban, domestic or industrial waste water (point 7). Both are covered only where the activity is not a non-essential part of the business. A distributor for which water distribution is a non-essential part of distributing other goods falls outside the sector, and a waste water operator whose treatment is incidental to its main activity may also fall outside it. Whether you are in scope therefore depends first on what the water activity actually is within your group, not on the name of the company.

Once an entity is in scope, Article 2 applies the medium-sized enterprise ceilings from Recommendation 2003/361/EC. Water undertakings above those ceilings are essential entities under Article 3(1)(a). Smaller in-scope water undertakings are generally important entities unless another Article 3(1) category makes them essential, for example where a national authority has identified them as critical entities under the CER Directive, which Recital 30 treats as essential. Confirm the headcount and turnover tests against the group's consolidated figures, and confirm with your national competent authority how the transposition law applies to your structure, because the authority and the supervision regime depend on that answer. Note that NIS2 issues no certificate of compliance: supervisors oversee you through inspections, audits, scans and information requests, and an independent auditor or certification body can assess your controls, but only it can issue a report or certificate.

Essential or important: how status changes the supervision

Annex I water suppliers and waste water undertakings that exceed the medium-sized enterprise ceilings fall under Article 3(1)(a) and are essential entities. Size alone decides the category here, so a utility that grows past the ceilings moves into the essential group even if it was previously treated as important. The consequence is the full supervisory regime: the authority can inspect on site, check off site, and act before any failure is proven.

Ex ante supervision: The competent authority can oversee the entity before an incident, rather than only reacting to one.
Article 32 tools: On-site inspections, off-site supervision including random checks, regular and targeted security audits, ad hoc audits, and security scans.
Higher fine ceiling: Article 34(4) sets a maximum of at least EUR 10 000 000 or at least 2% of worldwide annual turnover for infringing Article 21 or 23, whichever is higher.
Size check: Confirm the headcount, annual turnover and balance sheet thresholds against the Recommendation 2003/361/EC definitions, including linked and partner enterprises.

Ask your national authority how it applies Article 32 to water undertakings and whether it has published guidance on size calculation.

How the all-hazards approach applies to water plants and networks

NIS2 asks water operators to plan for failures beyond cyberattacks, including theft, fire, flood, power and telecom outages, and unauthorized physical access. The cards below cover the utility and facility components where Article 21 and the point 13.1.2 expectations apply, with the evidence each one produces and what to confirm with your supervisor.

Facility protection from utility failures

Point 13.1.2 expects entities to protect facilities from failures of supporting utilities where appropriate. For a treatment plant, pumping station or network control room, this means mapping which process controls depend on electricity, water supply, compressed air, cooling and communications, then deciding how each dependency is protected. The evidence is a dependency map, the protective measures chosen for each, and the reasoning behind any dependency left unprotected. Confirm with your supervisor how they expect the map to be kept current as plants change.

Redundant utilities

Where appropriate, point 13.1.2 asks entities to consider redundant utilities. Operators usually weigh redundant power feeds, a second water source or alternative supply routes for chemical dosing and process cooling. The decision is a risk trade-off the management body must approve under Article 20, so record the options considered, the choice made and the residual risk. Ask your supervisor whether they expect redundancy for all critical process units or only for those whose failure would affect water supply to customers.

Protection of power and telecom lines

Recital 79 names telecommunication and power failures as events the all-hazards approach must cover. For utilities, power and telecom cabling runs across pump stations, remote sites and field cabinets, often outside the fence line. Protecting these lines means physical routing away from flood-prone or easily accessed paths, segregated conduits, and documented repair arrangements. Evidence includes route surveys, cable inventories and records of inspections. Confirm with your supervisor whether they expect the protection of lines that your operator does not own.

Contracted emergency fuel for backup power

Backup generators only help if they have fuel for the length of an outage. Point 13.1.2 expects entities to contract emergency supplies such as fuel for emergency power. Operators should hold supply agreements with delivery times that match the autonomy of their generators, test fuel quality periodically, and record how long each site can run before refueling. The evidence is the contract, the fuel stock records, delivery test results and the runtime calculation per site. Ask suppliers to confirm delivery under flood and road-closure conditions, since these are the events the all-hazards approach names.

Monitoring and testing of power and environment

Point 13.1.2 expects entities to monitor and test power, temperature, humidity and connectivity. For water sites, this covers supply voltage, UPS and generator status, cabinet temperature, humidity in control rooms and the health of links to central control. Monitoring alerts are useful only when someone acts on them, so the evidence should include alert thresholds, response records and periodic generator load tests. Use the results as input to the risk assessment and to the incident reporting process, and confirm with your supervisor which test frequency they consider adequate.

Physical access and intrusion

Recital 79 lists unauthorized physical access and theft among the events to plan for. Water facilities are often unstaffed, spread across wide areas and reachable through remote cabinets, so access control, intrusion detection, visitor logs and cabinet locks form part of the cyber and physical risk picture. The evidence is the access control policy, the list of sites and their protections, access logs and periodic reviews of who holds keys or badges. Confirm with your supervisor how physical security findings are linked to the Article 21 risk assessment.

Backups and redundancy that supervisors will ask to see

Supervisors will test whether a water or waste water undertaking can keep supplying water, or keep treating wastewater, when a control system, server room or telecommunications link fails. The link to NIS2 runs through the business continuity and crisis management duties in Article 21, read together with the point 13.1.2 expectations on utility failures, redundant utilities and monitoring of power, temperature, humidity and connectivity. For a utility, that means the backup and redundancy design must cover the SCADA servers, historian and HMI systems, the controllers and networks that run pumping and treatment, the billing and customer systems, and the monitoring tools that show operators the plant is running. Each system needs its own recovery expectations, because losing a billing database is a different problem from losing the telemetry that tells an operator a chlorine dosing loop has stopped.

The organization sets its own recovery objectives. For each critical system it should document the maximum tolerable downtime, the maximum acceptable data loss, the order in which systems are restored, and the manual fallback operators use while systems are down. The Directive does not prescribe a duration, so these targets must come from the utility's own impact analysis and be approved by management. Supervisors will expect to see who set them, when they were last reviewed, and how they connect to the risk assessment. Confirm with your national competent authority and sector guidance whether any specific expectations apply to your operations.

The evidence that convinces a supervisor is a record of testing rather than a backup policy. Keep restore test reports that show the backup of each critical system was restored to an isolated environment, how long it took against the recovery objective, and what failed. Keep failover records for redundant controllers, network paths and power supplies, including the dates of tests and the results. Record emergency fuel contracts and generator tests where they support the power continuity measures. Where a restore or failover test did not meet its target, the record should show the corrective action and the retest. Teams building this evidence often need outside help for a first clean-room restore exercise, which is a scoped piece of work with its own written plan.

What supervision costs and who pays for each part

This table compares the cost and effort components a water or waste water utility will meet when a national authority supervises its NIS2 compliance, showing who is paid, whether each part is one-time or recurring, and what drives it up. No figures are given, so use the table to build the questions you put to your authority and to any quote you request in writing.

Cost component	Who is paid or who does the work	One-time or recurring, and what drives it	What to ask for or confirm
Internal staff time for risk assessment and policies	Your own operations, IT and management staff	Mostly one-time for the first assessment, then recurring for reviews. Driven by the number of sites, plants and network segments in scope.	Ask the authority which risk assessment outputs it expects and how often it expects them refreshed.
Independent security audit required by the authority	An independent audit body or assessor selected under the authority's rules	Recurring if the authority orders periodic audits, plus one-time for ad hoc audits. Driven by the size of the operational technology estate and the audit scope.	Ask the authority which audits apply to your entity, who selects the auditor, and who pays the audit body.
Security scans and authority inspections	Your scanning provider, or tools run by your own team, plus staff who support the inspection	Recurring. Driven by the number of internet-facing and supervisory control systems and how often scans are run.	Ask whether the authority runs its own scans and what it expects you to provide before an on-site inspection.
Logging, monitoring and backup tooling	Software licenses or open-source platforms hosted in your own infrastructure, plus staff to run them	Recurring for storage, licenses and operations. Driven by log volume, retention periods and the number of plants connected.	Request a written scope covering retention, backup location and restore testing for control systems and billing data.
Redundancy and emergency power or fuel contracts	Equipment vendors, fuel suppliers and contractors who maintain generators and redundant utilities	Partly one-time for installation and recurring for contracts, testing and fuel. Driven by the number of critical sites and the required autonomy period.	Confirm with your authority and your critical entity assessment, if any, which sites need redundant power and telecommunications.
Implementation partner for systems and evidence	An outside firm you engage to prepare systems, configurations, documentation and evidence	Mostly one-time for the initial build, with optional recurring retainers for upgrades and testing. Driven by the number of systems, the depth of documentation and whether work is fixed-scope.	Ask for a written scope, deliverables, timelines and a quote that separates build work from ongoing support. The partner does not issue audit reports or certificates.

How a water utility moves from scoping to supervisor-ready evidence

This sequence turns an uncertain NIS2 position into a documented, tested and handed-over evidence pack that the utility can present to its national competent authority. Each phase closes with a named output, and the order keeps scope decisions ahead of the technical work that depends on them.

Confirm scope and status with the authority
The utility first establishes whether it is an Annex I water supplier, distributor or waste water undertaking, whether its water distribution or waste water activity is essential or a non-essential part of other activity, and whether its size places it above the medium-sized ceilings, which decides essential or important status. Where the utility is also identified as a critical entity under the CER Directive, the competent authorities of both regimes need to be engaged. The utility owns this decision, and legal counsel or an implementation partner can prepare the analysis, but the national authority's view is what the utility should confirm. The step closes with a written scope statement and a recorded status, signed off by management.
Run a gap assessment against Article 21
Next, the current security program is compared with each of the ten minimum measures in Article 21(2), covering policies, incident handling, business continuity and backup management, supply chain security, access control, cryptography and the other listed areas. The assessment covers the operational technology environment that runs treatment plants, pumping stations and SCADA systems, not only the corporate IT estate. Where the water utility falls under the sector-specific detail of Implementing Regulation (EU) 2024/2690, that regulation applies to other entity types, so the utility should confirm with its authority which technical benchmarks it will use. The output is a gap register ranked by risk, with a named owner and a review date for each gap.
Complete an all-hazards risk assessment
The risk assessment considers threats beyond cyberattacks, including theft, fire, flood, telecommunication or power failures and unauthorized physical access, consistent with the all-hazards approach in Recital 79. Each asset, from intake works and treatment units to control rooms, power supplies and communications links, is linked to the hazards that could disrupt water supply or waste water treatment. The utility decides which risks to accept, reduce or transfer, and management approves the outcome. The step closes with a risk register that maps each high-priority risk to a remediation item in the gap register, so that no significant hazard is left without a documented treatment decision.
Remediate backup and redundancy gaps
Where the risk assessment shows that a single point of failure could interrupt service, the utility plans remediation for the affected utilities and systems. Point 13.1.2 of the Annex to Implementing Regulation (EU) 2024/2690 asks, where appropriate, for protection against utility failures, consideration of redundant utilities, protection of power and telecommunications lines, contracted emergency supplies such as fuel for emergency power, and monitoring and testing of power, temperature, humidity and connectivity. Work may include backup power arrangements, alternate communication paths, tested restoration of control system backups and documented supplier contracts. Operations, engineering and any outsourced partner each carry defined tasks. The output is a remediation tracker with completed changes, configuration records and updated runbooks, and it should be checked against the risk register before the next step begins.
Collect evidence and test controls
The utility gathers evidence that each control operates as written, such as approved policies, access reviews, backup restore records, monitoring logs, training records and supplier contracts. Testing then checks that the controls work in practice, including restoration of backups to a test environment, failover of redundant systems and a tabletop exercise of the incident reporting path. Testing should be recorded with date, scope, tester and result. Where the utility wants independent assurance, an external assessor can test the controls, but only that assessor issues a report. The output is an evidence index that links each Article 21 measure to its evidence, its test record and any open exception.
Close exceptions and approve the program
Open exceptions from testing are either fixed, formally accepted by management with a documented rationale, or scheduled for remediation with an owner. Management then reviews and approves the Article 21 measures and the risk management decisions, consistent with its oversight duty under Article 20. Mandatory management training should be recorded for members of the management body. The output is a signed management approval record and a closed or accepted exception log, which together show that the program has been overseen at the right level rather than delegated without review.
Hand over the supervisor-ready evidence pack
The final step assembles the evidence pack for the competent authority: scope statement and status decision, gap register, risk assessment, remediation records, evidence index, test results, exception log and management approval. The pack is organized so that an inspector or auditor can trace each requirement to its evidence without a walkthrough. The utility keeps the pack current as systems and risks change, because NIS2 creates no certificate and supervisors review the evidence directly during inspections, information requests and security audits. The output is a versioned, indexed pack with a named custodian, and the utility should confirm with its authority the format and channel it expects.

What must be in place before a supervisor or auditor visits

A supervisor inspecting a water or waste water utility will start with documents and then test whether the systems behind them work. The six items below are the records and capabilities that connect the Article 21 measures, the Annex I scope and the Article 23 reporting duties, and each one can be checked before anyone arrives.

Approved risk assessment

The risk assessment is the starting point for every Article 21 measure and should cover IT and OT systems that treasure treatment, pumping, dosing, and waste water process control rely on. Check that it is dated, signed off by the management body, lists threats such as theft, fire, flood and power or telecommunications failure under the all-hazards approach, and states which risks were accepted and why. A risk assessment that predates the current network is a finding waiting to happen.

Asset and network inventory across OT and IT

Utilities often run SCADA, PLCs, historians and remote telemetry alongside corporate IT, and supervisors expect both to appear in one inventory. Confirm that every asset has an owner, a location, a criticality rating and a record of its connections to other networks. Compare the inventory with live network discovery, because undocumented remote access links are the most common gap between what the paperwork says and what is running.

Named owners for each Article 21 measure

Each of the ten Article 21(2) measures needs one accountable person who can explain the control, show its evidence and report its status. For a utility this often means the operations manager owns OT segmentation, the facilities lead owns utility failure protection, and the IT lead owns access control and backups. Check that the owner list matches the job descriptions and that each owner has signed the duty in writing, so no measure is orphaned when someone leaves.

Tested backup and recovery records

Backups count only when restoration has been tested, and the redundancy expected for critical process systems should be documented. Check the dates of the last restore test for both IT and OT configuration backups, the recovery time the utility has actually achieved, and whether backups are stored apart from the systems they protect. Record redundant power, emergency fuel contracts and monitoring of power, temperature, humidity and connectivity at the sites that host critical equipment.

Incident response and Article 23 reporting procedures

The utility needs a written procedure that moves an incident from detection to the early warning, the notification and the final report within the Article 23 deadlines. Check that the procedure names who decides whether an incident is significant, who contacts the competent authority, how service recipients are informed, and how the timeline is recorded. A tabletop exercise with the actual operational staff is better evidence than a document nobody has rehearsed.

Management body approval and training records

Article 20 makes the management body responsible for approving and overseeing the Article 21 measures and requires its members to complete cybersecurity training. Check for minutes that show the board approved the risk management measures, the date of approval, and training certificates or attendance records for each member. Supervisors often ask for these first because they show whether the organization's leaders have actually taken responsibility for the program.

Who owns the controls and who prepares the evidence

The utility owns its NIS2 obligations. Under Article 20, the management body must approve and oversee the Article 21 risk-management measures, and its members can be held liable for infringements. No partner can take that accountability over. The utility also decides its risk appetite, accepts residual risk, and signs off on policies, incident decisions and supplier choices. Day-to-day operators, such as those running treatment plants, pumping stations and distribution networks, remain responsible for following the procedures that the controls depend on.

Governance decisions: Management approves the risk assessment, the policy set and the scope of the Article 21 measures.
Accountability: Management body members complete the cybersecurity training that Article 20 requires and answer to the authority for the outcome.
Operational ownership: Asset owners maintain the inventory of operational technology such as SCADA and control systems, and decide what runs where.
Incident decisions: The utility makes the call to report under Article 23 and communicates with its national authority.
Supplier decisions: The utility selects and contracts its providers and keeps the authority to terminate them.

Before engaging anyone, confirm internally which named person holds each of these decisions and where that assignment is recorded.

Questions water utilities ask before bringing in outside help

Is a small water supplier in scope of NIS2?

It depends on whether the supplier is an Annex I entity and whether it exceeds the medium-sized enterprise ceilings. Annex I covers suppliers and distributors of water intended for human consumption, except distributors for which water distribution is a non-essential part of distributing other goods. Article 2(1) brings in Annex entities that qualify as medium-sized enterprises or exceed those ceilings. A small supplier below those thresholds is generally outside NIS2 unless another rule applies, such as a national measure or designation under the CER Directive. Confirm the headcount, turnover and balance sheet figures against the SME definition in Recommendation 2003/361/EC with your national competent authority before deciding.

What drives the cost and effort of NIS2 work for a utility?

The main drivers are the size and number of sites, how many operational technology and IT systems fall within the risk assessment, the maturity of existing controls, and how much evidence must be gathered for supervisors. Costs fall into three groups: the outside party's fees for gap analysis, implementation or testing, the utility's internal staff time, and recurring costs such as monitoring, backups and periodic audits. No supplied figure sets these costs, so ask every bidder for a written scope listing systems, sites, deliverables and assumptions, plus a separate price for one-time work and for any retainer. Ask which items depend on the utility providing data or access.

How long does NIS2 preparation take for a water utility?

The timeline is set by the number of in-scope systems, the state of the current asset inventory, procurement cycles for hardware or backup infrastructure, and how quickly management approves the risk management measures. Work on redundancy, utility failure protection and emergency supplies can depend on physical works that take longer than software changes. Ask each provider for a milestone plan with dependencies on the utility's side, and check whether it aligns with your national transposition timetable and any supervisory requests. Avoid accepting a duration that is not tied to a written scope.

What does the outside work need from the utility's own staff?

Several parts of NIS2 cannot be delegated. Management must approve and oversee the Article 21 measures, and staff who understand plant operations must confirm which processes are critical and what a failure would affect. Operators must supply asset lists, network diagrams, control system configurations, backup records and access rosters. Expect the utility to name owners for each control and to attend reviews. Ask the provider to list these tasks and the hours they expect from each role so the utility can plan operational cover.

Can a water utility do NIS2 preparation in-house?

A utility can do much of the work in-house if it has staff with security, IT and operational technology skills and the time to maintain the evidence. The harder questions are independent testing, objective assessment of the risk analysis, and handling incidents within the reporting deadlines in Article 23. Many utilities keep ownership internally and buy specialist support for defined pieces, such as a gap analysis, technical hardening or testing. Whatever the split, the organization remains responsible for its controls, and only an independent auditor or assessor can issue audit reports or certificates.

How does supervision differ for essential and important water utilities?

Essential entities face ex ante supervision, which means authorities can inspect and audit them before an incident happens, while important entities face ex post supervision that is triggered after evidence of non-compliance. Under Article 32, essential entities may face on-site inspections, off-site checks, regular and targeted security audits by an independent body or the authority, ad hoc audits and security scans. Article 34(4) sets maximum fines for infringing Article 21 or 23 for essential entities at least EUR 10 000 000 or at least 2% of total worldwide annual turnover, whichever is higher. Ask providers how they will prepare evidence for both supervision models.

Does a water utility need a NIS2 certificate?

No. NIS2 creates no certificate of compliance, so a utility cannot obtain a NIS2 certificate as such. National competent authorities oversee compliance through inspections, audits, scans, information requests and fines. Some utilities pursue ISO/IEC 27001 or other frameworks as supporting evidence, but a certificate under those frameworks does not replace supervision. Ask any provider to confirm in writing that it prepares evidence and does not issue attestations or certifications.

How to choose a consultant for water sector NIS2 work

Before you sign with a consultant, confirm that they understand operational technology and utility environments, not only corporate IT. A consultant who has worked only on office networks will tend to scope the work around identity, email and cloud, and will miss the SCADA historians, PLCs, remote telemetry links and pumping station controllers that a water undertaking actually depends on. Ask who on the team has worked on OT networks, how they handle systems that cannot be patched during service hours, and how they treat safety constraints when testing or changing a control. Ask for a named lead, not a sales contact, and check that the lead can explain how the all-hazards measures in point 13.1.2 of Implementing Regulation (EU) 2024/2690 apply to a treatment plant with backup power and emergency fuel contracts.

Require a written, fixed scope before any work starts. The scope should list the sites and systems covered, the deliverables (for example, gap analysis, policies, asset inventory, evidence register, backup and redundancy test plan), the responsibilities of your staff and the consultant's staff, and the acceptance criteria for each deliverable. Ask the consultant to state in writing what they will not do. A credible answer usually includes that they will not operate or change your control systems, will not issue a compliance certificate, will not decide which incidents are significant for reporting purposes, and will not act as your management body. If a proposal is vague about exclusions, expect the gaps to surface later as change requests.

Confirm the consultant's role in the assessment itself. No consultant can issue a NIS2 report or certificate. NIS2 creates no certificate of compliance, and the national competent authority oversees compliance through inspections, audits, scans and information requests, while an independent body may carry out audits on its behalf. Your consultant prepares systems, documentation and evidence for that process. Ask them to show how they will organize evidence so that your national authority can test it, and check the national authority's own guidance on what it expects. Reject any offer that promises a guaranteed pass, a certificate or an authority endorsement.

How DeployOpen scopes and prepares utility systems and evidence

DeployOpen works on NIS2 for drinking water and waste water utilities as an implementation partner. We prepare self-hosted open-source systems, controls and evidence inside the utility's own infrastructure, while the utility keeps ownership of its controls and its management decisions.

How we scope

Confirm which water supply or waste water activities fall within Annex I and which are non-essential parts of other activity.
Record the written scope, deliverables and timelines before any work starts, since engagements are fixed-scope.
Map OT, SCADA, backup and utility-dependency assets that the all-hazards measures must cover.

How we build

Configure self-hosted open-source logging, monitoring and backup platforms in the utility's own data centers or cloud accounts.
Design redundancy and backup restore tests for critical control and records systems, with documented recovery targets set by the utility.
Test security controls through application, infrastructure and OT-adjacent testing where the written scope includes it.

How we hand over

Deliver configuration baselines, runbooks, architecture records and test results the utility's management can review.
Document evidence for each Article 21 measure in the scope, showing what it proves and where it is stored.
Train operators on incident detection and the reporting steps the utility must run within its own process.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer after handover, under written terms.
Coordinate with the utility's auditors, consultants and national competent authority requests when evidence is asked for.
Confirm with the utility's legal counsel which national transposition law and supervisor apply to its entity.

NIS2 for drinking water and waste water utilities