NIS2 and industrial OT: technical assessment and improvement
NIS2 concerns organizations within its legal scope. Their relevant network and information systems may include PLCs, SCADA and industrial networks. GCG supports technical gap assessment and improvement.
What we deliver
Scope determination
Mapping the organisation and its OT systems as input to the scope assessment. Specialist advice on legal applicability is sought where needed.
Gap analysis
Assessing the current state against applicable risk-management requirements. Relevant parts of IEC 62443 support the technical assessment.
Technical execution
Network segmentation, hardening, secure remote access, OPC UA security.
Documentation & reporting
Risk registers, security policy, and network diagrams.
Periodic review
Annual or biennial compliance updates.
Frequently asked questions
Does our organization fall under NIS2?
What's the difference between IT and OT security?
Related expertise
Scope and responsibility
GCG is not a notified body, certification body or legal adviser. Legal and certification conclusions require specialist review. NIS2 notifications of significant incidents follow the applicable national route. This does not automatically constitute a CRA notification.
According to the NCSC, the Dutch Cyberbeveiligingswet entered into force on 15 August 2026. Sources checked: 9 September 2026.
NCSC: Dutch Cyberbeveiligingswet (opens in a new tab) European Commission: NIS2 (opens in a new tab)
What needs to change in your installation?
Tell us what is already installed and what you are running into.