NIS2 and OT in Belgium: what it means for your PLC and SCADA systems
NIS2 is not only an IT topic. Control systems are part of the network and information systems that the law protects. This is what changes for OT teams.
In Belgium, the NIS2 law of 26 April 2024 applies since 18 October 2024. The Centre for Cybersecurity Belgium (CCB) is the authority, CyberFundamentals (CyFun) or ISO/IEC 27001 are the reference frameworks, and conformity assessment is mandatory for essential entities. By 18 March 2025, 2,410 organisations had registered. For OT this means an asset inventory, network segmentation, controlled remote access, backups of PLC and SCADA projects, patching and incident reporting within 24 and 72 hours.
Key facts
| Item | Belgium |
|---|---|
| Law | Law of 26 April 2024, published in the Belgian Official Journal on 17 May 2024 |
| Applies since | 18 October 2024 |
| Authority | Centre for Cybersecurity Belgium (CCB), also the national CSIRT |
| Frameworks | CyberFundamentals (CyFun) or ISO/IEC 27001 |
| Conformity assessment | Mandatory for essential entities, optional for important entities |
| Registration | 2,410 organisations registered by 18 March 2025 (CCB) |
| Incident reporting | Early warning within 24 hours, notification within 72 hours, final report within one month (Directive (EU) 2022/2555) |
What it means for OT
- Inventory. List every PLC, HMI, SCADA server, engineering station and network device, with firmware and software versions.
- Segment. Separate OT from IT and limit traffic between zones to what is needed.
- Control remote access. One controlled route for suppliers, with named accounts, multi-factor authentication and logging.
- Back up and patch. Keep tested backups of PLC programs and SCADA projects. Plan updates for SCADA and engineering PCs; Microsoft ended Windows 10 support on 14 October 2025.
- Prepare for incidents. Know who reports what within 24 and 72 hours, and how you run the plant if a SCADA server is lost.
For suppliers and integrators, IEC 62443-2-4 describes the security capabilities a service provider should offer during integration and maintenance. In Flanders, VLAIO supports cybersecurity improvement projects with 50% for SMEs and 35% for large companies that fall under NIS2 and have not yet started a structured cybersecurity policy (VLAIO, 8 December 2025).
Netherlands and France
In the Netherlands, the Cyberbeveiligingswet (Cbw) applies since 15 August 2026 and covers 18 sectors. In France, the bill that transposes NIS2 was adopted by the Senate on 12 March 2025, but on 6 October 2026 it was withdrawn from the National Assembly agenda; at the time of writing France has not adopted its NIS2 law.
Questions we get
Does NIS2 apply to my plant?
It depends on your sector and size. Manufacturing ('critical product manufacturing') is among the NIS2 sectors. Check your scope on the CCB website.
Do we need to certify our OT?
Essential entities need a conformity assessment based on CyFun or ISO 27001. Make sure OT is inside the scope, not only office IT.
Can you help with OT security?
We help with the OT side: inventory, segmentation design, remote access, backups and documentation, together with your IT and security partners.
This page explains public rules in plain language. It is not legal advice.
Sources
- Centre for Cybersecurity Belgium: Publication of the NIS2 law in the Belgian Official Journal (14 Mar 2025)
- Centre for Cybersecurity Belgium: Adoption of the NIS2 Royal Decree (14 Mar 2025)
- Centre for Cybersecurity Belgium: Largest cyber security operation ever in Belgium: 2,410 organizations registered (18 Mar 2025)
- VLAIO: Op 18 oktober 2024 gaat de Europese cybersecurity NIS2-richtlijn van kracht (2 Oct 2024)
- EUR-Lex: Directive (EU) 2022/2555 (NIS2) (14 Dec 2022)
- European Commission: NIS2 Directive: securing network and information systems (2 Jul 2026)
- IEC: IEC 62443-2-4:2015+AMD1:2017 Security program requirements for IACS service providers (withdrawn 15 Dec 2023, replaced by the 2023 edition) (24 Aug 2017)
- Microsoft: Windows 10 support has ended on October 14, 2025 (14 Oct 2025)
- VLAIO: Krijg ook in 2026 VLAIO-steun om te investeren in cyberveiligheid (8 Dec 2025)
- Rijksoverheid: Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf vandaag van kracht (15 Aug 2026)
- Assemblée nationale: Résilience des infrastructures critiques et renforcement de la cybersécurité (dossier législatif) (10 Sep 2025)
- Assemblée nationale: Conférence des présidents, relevé de conclusions du 6 octobre 2026 (6 Oct 2026)
A new line, an upgrade, or AI for your plant?
Tell us about your project and we will set up a technical call.
2800 Mechelen, Belgium E-mail: info@simsolutions.be Enterprise no. / VAT: BE 0680.932.773