NIS2 is live. OT operators have 72 hours to report incidents. Most aren't ready.

NIS2 expanded the scope of its predecessor significantly. Where NIS1 covered operators of essential services in a relatively narrow set of sectors, NIS2 pulls in energy, transport, water, wastewater, health, digital infrastructure, manufacturing of critical products, food production, and more. For the first time, a large share of the industrial OT estate in Europe is explicitly in scope for a cybersecurity regulation with real enforcement teeth.

The headline requirement is the 72-hour notification window: a significant incident must be reported to the national competent authority within 72 hours of detection. A preliminary report is due within 24 hours. A detailed final report is due within one month. The clock starts when the organization knows about the incident, not when it has finished investigating it. For most OT environments, where detection capability is limited and incident response procedures have never been written, the clock runs out before anyone has established what happened.

IT environments have been living with breach notification requirements for years under GDPR and sector-specific regulations. They have SIEM platforms, incident response runbooks, legal counsel briefed on notification obligations, and communications templates ready to go. OT environments typically have none of these. The historian logs a process parameter change; it does not log a lateral movement event. The PLC records a command; it does not record where that command originated.

The detection gap is the compliance gap. An organization cannot report an incident it has not detected. NIS2 does not require perfect detection, but it does require that organizations have taken appropriate technical and organizational measures — and that standard is defined against the state of the art. In practice, the regulator's first question after a late or missing notification will be about whether reasonable detection capability existed. For most OT operators, the honest answer is no.

The practical response to NIS2 for OT operators is not to build a full SOC. It is to answer four questions the regulation will eventually ask: What counts as a significant incident in your environment? Who is responsible for making the notification decision? What contact does the notification go to, and through what channel? And what is the minimum information you can provide within 72 hours that satisfies the preliminary report requirement?

Those four questions drive concrete actions: a written incident definition, a designated responsible person, a tested notification pathway, and a minimum-viable incident report template. None of those require a large program. They require a decision and a document. For an operator who has never been in scope for cybersecurity regulation before, NIS2 is the moment to build the foundation. The alternative is discovering the gap during the incident itself.