NIS2 for water and wastewater, in plain words.
Who it covers, the ten measures it asks for, the 24 and 72 hour clock, the fines,
where Norway stands, and where knowing your own plant comes in.
NIS2 is the European Union's law for cybersecurity in essential services, Directive (EU) 2022/2555. It replaced the first NIS directive and widened it a great deal. Drinking water and waste water are both on its list of sectors of high criticality (Annex I), next to energy, transport and health. If you run a water or wastewater utility of medium size or larger in the EU, it very likely applies to you.
Who it covers
Suppliers and distributors of drinking water, and operators that collect, dispose of or treat waste water. The directive generally applies to medium-sized and larger organisations, and member states can add smaller ones that matter. Large ones in Annex I are usually essential entities, medium-sized ones important entities: both have duties, and essential ones are supervised more closely.
What it asks for
Article 21 lists the measures. In plain words:
- a policy for analysing risk and securing information systems
- a way of handling incidents
- business continuity: backups, disaster recovery, crisis management
- supply chain security: the risks that come with every supplier and service provider
- security when systems are bought, built and maintained, including handling vulnerabilities
- a way of checking that all of the above actually works
- basic cyber hygiene and training
- cryptography and encryption where it fits
- security around people, access control and asset management: knowing what you have
- multi-factor authentication and secure communications where it fits
The clock when something happens
Article 23 sets the deadlines for a significant incident: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month after the notification. Article 34 sets the fines: for essential entities up to at least EUR 10 million or 2% of worldwide annual turnover, whichever is higher, and for important entities up to at least EUR 7 million or 1.4%. Management can be held personally responsible.
And in Norway?
Norway is not in the EU but follows through the EEA agreement, which takes longer. The Digital Security Act (digitalsikkerhetsloven) came into force on 1 October 2025 and implements the first NIS directive; NIS2 has not yet been implemented in Norwegian law (Schjødt, 2025). Water utilities that prepare for NIS2 now will not be caught out when it arrives.
Where knowing your own plant comes in
Two of the measures are quietly the hardest. Asset management means knowing what every instrument and reading in the plant is, and most utilities have that knowledge in people's heads and in drawings that are years out of date. Supply chain security means that every new tool, AI included, is a new risk to assess: where does it send data, and can it change anything?
That is why we build the way we do: a model of the plant made from its own exports, kept inside the fence, that can only read, and that says what it does not know. It does not make a utility compliant on its own. Nothing does. But it turns “what do we actually have?” from a question into a file.
This is a plain summary, not legal advice. The directive's own text is the authority.