What is NIS2?
Directive (EU) 2022/2555, known as NIS2, replaces the first NIS directive. It widens the sectors and entities in scope and strengthens obligations on risk management, incident reporting and management accountability.
Where does the Resilience Act stand?
In France, NIS2 is transposed by the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, known as the “Resilience Act”. As of 28 September 2026, it is debated in plenary session at the National Assembly from 7 October 2026.
According to ANSSI, obligations will apply once the law, its decrees and orders are published. That is a window to prepare before they become enforceable.
Which industrial sectors are in scope?
The directive distinguishes “sectors of high criticality” and “other critical sectors”, with size thresholds. Those relevant to industry include:
- Energy (electricity, gas, heating, hydrogen)
- Drinking water and wastewater
- Production, processing and distribution of food
- Manufacturing, including electrical equipment, machinery, electronics and vehicles
- Chemicals
Expected measures
Entities in scope must notably manage cybersecurity risk, secure their supply chain, control access, ensure business continuity and report significant incidents to the authority. Management is accountable for implementation.
Why OT is the hard part
NIS2 measures are often designed with business IT in mind. On an industrial site they run into PLCs that cannot easily be patched, contractor remote access and poorly segmented networks.
The IEC 62443 family of standards provides a recognised framework for these issues: zones and conduits, target security levels, requirements for systems and components.
Checklist
- Check whether your activity and size fall within NIS2 scope
- Map your OT systems and their flows
- Inventory remote access, especially contractors’
- Segment industrial networks into zones and conduits
- Define an incident handling and reporting process
- Brief management on its accountability
- Build a prioritised roadmap before the decrees are published
Information current as of 28 September 2026. Laws and timelines change: this guide is not legal advice.
Related servicesOT assessment and hardening: IEC 62443 and NIS2 readiness