If you ask most manufacturers what keeps them busy when preparing for NIS2, cybersecurity is usually the first answer.
And understandably so. New regulations, stricter governance requirements and increasing cyber threats have pushed cybersecurity higher on the agenda than ever before.
Yet, in practice, cybersecurity is rarely the biggest obstacle to becoming NIS2-ready. More often, the real challenge is much simpler.
Do you actually know your Operational Technology (OT) environment well enough to prove that it is secure, managed and ready for an audit?
At Contec, this is one of the first questions we ask when working with manufacturers. Not because organisations lack expertise, but because industrial environments naturally evolve over time. Production lines are expanded, equipment is upgraded, suppliers require remote access and new systems are introduced. Before long, the OT landscape becomes far more complex than anyone originally planned.
That is exactly why preparing for a NIS2 audit starts long before the audit itself.
NIS2 goes beyond cybersecurity
One of the biggest misconceptions about NIS2 is that it focuses only on IT security. It doesn’t.
For manufacturers operating critical or important infrastructure, NIS2 requires organisations to demonstrate that both IT and OT environments are properly managed, documented and protected. That means cybersecurity is only one part of a much broader picture that also includes governance, risk management, business continuity, incident response, supplier management and operational resilience.
For many organisations, the OT environment is where that broader picture becomes most challenging.
Why OT deserves special attention
Unlike traditional IT systems, OT environments often combine equipment and technologies that have evolved over many years.
PLCs, SCADA platforms, industrial networks, HMIs, historians, MES applications and third-party systems frequently need to work together, even if they were never originally designed to do so.
That doesn’t necessarily mean something is wrong. It simply means that preparing for a NIS2 audit requires a clear understanding of what exists today, how systems interact and where potential risks or gaps may be hiding.
From our experience, organisations are often surprised by how much valuable knowledge exists only in the minds of engineers and maintenance teams, rather than in documentation.
An audit, however, requires evidence, not assumptions.
What we typically see in manufacturing
Every production site is different, but several themes appear again and again during OT assessments.
None of these automatically represents a cybersecurity incident. Together, however, they make it much harder to demonstrate compliance during a NIS2 audit.
-
OT assets that have never been fully documented
-
Legacy equipment still supporting critical production
-
Supplier access that has evolved over time without regular review
-
Backup and recovery procedures that have never been tested
-
Different teams using different versions of the same information
-
Incomplete network documentation
OT assets that have never been fully documented
Preparing for a NIS2 audit starts with understanding your OT environment
Rather than jumping directly into technical controls, we encourage manufacturers to first establish a structured understanding of their OT landscape.
At Contec, our OT NIS2 Audit Readiness approach is built around eight practical building blocks that help organisations move from uncertainty to audit readiness:
1. Define the OT scope
Identify critical assets, production systems and responsibilities while clearly defining what belongs within the OT domain.
2. Perform an OT risk assessment
Evaluate cyber risks, operational risks and potential vulnerabilities using a structured, risk-based approach.
3. Establish OT policies and procedures
Document how access management, backups, change management, patching and lifecycle management are handled.
4. Prepare an Incident Response Plan
Ensure responsibilities, escalation procedures and reporting obligations are clearly defined before an incident occurs.
5. Strengthen business continuity
Review backup strategies, disaster recovery procedures and operational resilience to minimize production disruption.
6. Review supplier management
Understand who has access to your OT environment, under what conditions and how those relationships are governed.
7. Improve asset and lifecycle management
Maintain an accurate inventory of OT assets while managing updates, maintenance and end-of-life equipment.
8. Assess technical security measures
Evaluate the current security posture of the OT environment and identify practical improvements that reduce risk while supporting compliance.
None of these steps should be viewed as a paperwork exercise. Together, they provide a structured way to understand the current state of your OT environment, identify improvement opportunities and demonstrate compliance during an audit.
Audit readiness is about more than passing an audit
One of the most important things we tell customers is that preparing for NIS2 should not be seen as a one-time compliance project.
The organisations that gain the most value are usually those that use the process to improve the way their OT environment is managed overall.
- Better documentation makes maintenance easier.
- Clearer responsibilities improve operational resilience.
- Structured asset management simplifies future upgrades.
Well-defined procedures reduce uncertainty when incidents occur.
In other words, many of the activities required for NIS2 also contribute to safer, more reliable and more efficient production environments.
How Contec helps
Preparing an OT environment for NIS2 requires more than understanding the regulation. It requires understanding how industrial environments actually operate.
That is where Contec brings a different perspective.
With decades of experience in industrial automation, Industrial IT and manufacturing integration, we help organisations bridge the gap between regulatory requirements and the day-to-day reality of production environments. Our approach combines technical OT expertise with practical audit preparation, ensuring that improvements are not only compliant on paper but also realistic to implement and maintain.
Start preparing before the audit begins
Waiting until an audit is scheduled often means working against the clock.
Starting earlier gives organisations the opportunity to understand their OT environment, close gaps in a structured way and build confidence before compliance becomes urgent.
If your organisation is preparing for NIS2, or simply wants a clearer understanding of its OT readiness, our specialists are ready to help assess your current environment and define a practical roadmap towards compliance.
