Legacy OT Systems Slow Down NIS2 Implementation

The implementation of the NIS2 Directive poses a significant challenge for many companies in the industry. Particularly affected are businesses that rely on outdated Operational Technology (OT) systems. These systems, which often no longer meet current security standards, complicate the integration of new security measures required by the NIS2 Directive.

The NIS2 Directive, which has been mandatory for companies in critical sectors since its introduction in 2021, aims to improve cybersecurity in the EU. While some companies that are not directly subject to the directive still align with its requirements, many of the actually affected businesses struggle with implementation. The complexity of existing supply chains and the dependence on legacy systems contribute to the delays.

Challenges from Outdated Systems

Legacy OT systems are often not only technologically outdated but also limited in their architecture and functionality. These systems were frequently developed at a time when cybersecurity was not a focus. Integrating new security solutions into these old systems is not only technically challenging but can also lead to operational disruptions that are costly for companies.

Another issue is the lack of interoperability between modern security solutions and existing legacy systems. Many companies find themselves forced to make extensive adjustments to meet the NIS2 requirements. This not only requires financial investments but also time and expertise, which are often insufficient in many cases.

The complexity of supply chains further exacerbates the challenges. Companies often rely on a variety of suppliers who apply different security standards and practices. This leads to a fragmentation of security measures and complicates the implementation of uniform standards required for compliance with the NIS2 Directive.

Alignment with NIS2 Even Without Obligation

Interestingly, companies that are not directly subject to the NIS2 obligation are increasingly aligning with the guidelines. These companies recognize the importance of cybersecurity and the potential risks associated with inadequate security measures. The NIS2 Directive provides a framework that enables these companies to enhance their security strategies and better prepare for potential threats.

The willingness to align with the NIS2 requirements demonstrates a growing awareness of the need for cybersecurity across the industry. Companies that act proactively can not only protect their own systems but also strengthen the trust of their customers and partners. This is particularly important at a time when cyberattacks are becoming more frequent and sophisticated.

The NIS2 Directive has the potential to sustainably change the cybersecurity landscape in the EU. Nevertheless, implementation remains a challenge for many companies, especially those reliant on outdated systems. The need to modernize these systems and adapt to new requirements will play a central role in the coming years.