In a nutshell: Legacy OT systems in industry prevent rapid NIS2 implementation, while non-regulated companies also adopt NIS2 as a de facto security standard.
Industrial companies cite legacy operational technology as the main barrier to NIS2 implementation. While non-obligated operators use the directive as a benchmark, aging OT infrastructure and fragmented supply chains pose significant practical hurdles for the actually regulated enterprises.
Regulation of network and information security (NIS2) creates substantial implementation obstacles in industrial companies. Particularly critical are aging operational technology systems that will continue running in many production facilities for years to come — they cannot be easily modernized to comply with the NIS2 Directive’s requirements.
For CISOs, this presents a structural dilemma: legacy OT hardware and software are often proprietary, unpatched, and without manufacturer support. A rip-and-replace strategy is economically unrealistic and would halt production. At the same time, NIS2 demands risk management, incident response, and security governance across all critical systems — including these non-modernizable components.
Adding to this are fragile supply chains: industrial value creation is distributed across networks of Tier-1 through Tier-N suppliers. Every weak point in this chain can become an attack vector; however, NIS2 also requires transparency and security oversight throughout the entire supply chain — a coordination challenge difficult to solve in decentralized, globally distributed manufacturing networks.
Symptomatic of the situation is that even companies not directly subject to NIS2 are already adopting the directive as a quasi-standard for their security architecture. This signals that NIS2 has long become the baseline for market viability — raising pressure on all operators, regardless of regulatory scope.
Source: www.security-insider.de · Published 8 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.