Industrial organisations are facing an unprecedented wave of cybersecurity legislation. NIS2, the Cyber Resilience Act (CRA) and the EU Machinery Regulation each introduce new obligations, but they are not three separate problems to solve. Together, they reflect a broader shift towards more resilient, secure and trustworthy industrial environments.
As part of our contribution to Agoria's Practical Guide for Cyber Security in Operational Technology (OT), one observation kept resurfacing throughout the discussions: many organisations approach these regulations individually, while the underlying cybersecurity challenges are deeply interconnected.
In our previous article, The 5 Biggest OT Cybersecurity Risks Manufacturers Face Today, we explored the risks threatening modern production environments. This final article takes the next step by examining how Europe's evolving regulatory landscape is encouraging organisations to tackle those risks through one coherent cybersecurity strategy rather than three independent compliance projects.
1. NIS2, CRA and the Machinery Regulation Each Address a Different Challenge
At first glance, these regulations appear to have little in common. Each has its own terminology, implementation timeline and legal obligations.
In reality, they complement one another:
-
NIS2 focuses on organisations. It requires companies operating in critical and important sectors to strengthen their cybersecurity governance, manage cyber risks and report significant incidents.
-
The Cyber Resilience Act (CRA) focuses on products with digital elements. It introduces cybersecurity requirements throughout the lifecycle of connected products placed on the European market.
-
The Machinery Regulation focuses on machinery itself, ensuring modern industrial equipment—including connected and AI-enabled machines—is designed and operated safely, with cybersecurity becoming an integral part of machine safety.
Different legislation, yet one common objective: Creating resilient industrial organisations that can safely operate in an increasingly connected world.
2. The Biggest Mistake Is Treating Them as Three Separate Projects
Faced with several new regulations, many organisations naturally split the work across different teams.
-
Compliance specialists focus on NIS2.
-
Product teams analyse the Cyber Resilience Act.
-
Engineering departments prepare for the Machinery Regulation.
At first glance, this seems like a logical approach. After all, each regulation has its own terminology, scope and legal requirements.
The challenge is that this often results in three parallel projects tackling many of the same underlying cybersecurity challenges. Different teams perform separate risk assessments, produce their own documentation and introduce individual governance processes, even though they are ultimately working towards the same objective.
In reality, many of the technical and organisational measures required by these regulations overlap. Whether you're preparing for NIS2, the CRA or the Machinery Regulation, you'll likely be looking at the same core capabilities, including:
- secure remote access;
- strong identity and access management;
- visibility into connected assets;
- network segmentation between IT and OT;
- incident detection and response;
- supplier and third-party risk management.
Rather than treating each regulation as a separate compliance exercise, organisations can often achieve better results by strengthening these foundational cybersecurity capabilities. Doing so not only improves security, but also supports compliance across multiple regulatory frameworks at the same time.
3. One Cybersecurity Programme Supports Multiple Regulatory Requirements
Instead of asking: "How do we comply with this regulation?"
A better question is: "Which cybersecurity capabilities do we need as an organisation?"
For many manufacturers, those capabilities include:
- clear cybersecurity governance;
- comprehensive asset visibility;
- secure IT/OT architecture;
- controlled remote access;
- supplier risk management;
- vulnerability management;
- incident response;
- employee awareness.
Once these foundations are established, complying with individual regulations becomes significantly easier.
Compliance becomes the outcome of good cybersecurity, and not the objective itself.
4. Frameworks Help Translate Compliance into Practice
One of the biggest challenges organisations face is moving from legal requirements to practical implementation. This is where recognised cybersecurity frameworks become valuable.
Depending on an organisation's context, frameworks such as:
- IEC 62443 help secure industrial automation and control systems.
- CyFun provides Belgium's national cybersecurity maturity framework and an efficient path towards demonstrating NIS2 conformity.
- ISO/IEC 27001 establishes governance, risk management and continuous improvement across the organisation.
These frameworks should not be viewed as competing alternatives. They complement one another.
The Agoria whitepaper highlights how organisations can combine governance frameworks with OT-specific standards to build a practical cybersecurity programme rather than simply pursuing certification.
5. Compliance Should Be the Result, Not the Goal
Cybersecurity legislation will continue to evolve. Today's priorities include NIS2, the Cyber Resilience Act and the Machinery Regulation, but they are unlikely to be the last regulations industrial organisations will need to navigate. At the same time, the rapid adoption of artificial intelligence, connected machinery and increasingly digital supply chains will continue to reshape both the opportunities and the risks facing manufacturers.
Organisations that treat every new regulation as a separate compliance project risk finding themselves in a constant cycle of catching up. Each new requirement demands additional assessments, new documentation and separate implementation efforts, often addressing the same underlying cybersecurity challenges.
A more sustainable approach is to focus on building strong cybersecurity foundations. By investing in robust governance, secure IT/OT architectures, effective risk management and well-defined operational processes, organisations create capabilities that support multiple regulatory requirements simultaneously.
In other words, compliance should not be the objective—it should be the outcome of a mature cybersecurity strategy. Organisations that adopt this mindset will not only find it easier to meet today's regulatory expectations, but will also be better prepared for future legislation and an ever-evolving threat landscape.
The Bottom Line
Although NIS2, the Cyber Resilience Act and the Machinery Regulation each introduce their own legal obligations, they all encourage organisations to move in the same direction: towards stronger cybersecurity, better governance and more resilient industrial operations.
Rather than asking which regulation deserves your attention first, it is often more valuable to step back and identify the cybersecurity capabilities your organisation needs to strengthen. Areas such as governance, secure IT/OT architectures, asset visibility, supplier risk management and incident response are not tied to a single regulation, rather they form the foundation on which multiple compliance requirements can be met.
By investing in these capabilities, organisations not only simplify compliance with today's regulations, but also build the resilience needed to respond to tomorrow's threats and future legislative changes.
How Easi Supports Your OT Security Strategy
At Easi, we help organizations secure their IT/OT ecosystem. Our approach includes:
- OT security assessments
- Network segmentation strategies
- Secure remote access implementation
- Continuous monitoring and response
👉 Discover more about our approach on IT security and OT security
👉 Contact us for tailored guidance
.png?width=200&height=200&name=GNEY%20(1).png) |
|
Gerrit Neyrinck |
Easi x Agoria: Practical Guide for Cyber Security in Operational Technology
This concludes our three-part OT cybersecurity series inspired by our contribution to Agoria's Practical Guide for Cyber Security in Operational Technology (OT).
Throughout this series, we've explored:
- Why OT Cybersecurity Is No Longer Just an IT Problem
- The 5 Biggest OT Cybersecurity Risks Manufacturers Face Today
- How industrial organisations can approach NIS2, the Cyber Resilience Act and the Machinery Regulation through one integrated cybersecurity strategy
If you're looking for a concise executive overview of today's OT cybersecurity landscape—including current regulations, common risks and practical guidance for industrial organisations—we invite you to download Agoria's Practical Guide for Cyber Security in Operational Technology (OT).
This whitepaper brings together the key concepts, risks and frameworks every manufacturing leader should understand.
> Download it here <
