Since 15 August, a Dutch energy company has to be able to show that its OT security is in order. That applies to office IT, and just as much to the SCADA environment and the substations. That takes people who understand process environments, and they are scarce.
On 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) and the Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten, Wwke) came into force. If you are part of the electricity chain, you may also fall under the European network code on cybersecurity.
Which rules apply to OT security in the energy sector?
Three frameworks overlap. Each asks something different.
The Cybersecurity Act
The Cbw is the Dutch transposition of NIS2 and covers more than 8,000 organisations in 18 sectors, including energy. You have to register in the national entity register, take measures to manage the risks to your network and information systems, and report significant incidents to your CSIRT and the competent authority. In most cases an initial report is due within 24 hours. The board is ultimately responsible and must know enough to assess risks and measures.
My advice: read "network and information systems" broadly. In an energy company it also includes the SCADA environment, substation control and the engineering workstations. An ISMS that only covers office IT is then incomplete.
The Critical Entities Resilience Act
The Wwke applies to around 500 organisations that the responsible ministry designates as critical entities, including in the energy sector. Once designated, you have 9 months for a risk assessment and 10 months to put appropriate technical, organisational and physical measures in place. Incidents that cause significant disruption must be reported within 24 hours. The act goes wider than cyber: sabotage, terrorist offences and extreme weather are in scope too. So OT security has to work with physical security and business continuity here.
Network code on cybersecurity for electricity
The electricity sector is also subject to Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024, which sets rules for the cybersecurity of cross-border electricity flows. It entered into force on 13 June 2024. The code covers risk assessment, baseline security requirements, certification of products and services, monitoring, incident reporting and crisis handling for so-called high-impact and critical-impact entities. Whether you are in scope depends on the processes you run.
Why OT security needs a different profile from IT security
In OT, availability comes first. A scan that is harmless in the office can freeze an older PLC. A patch needs a maintenance window, sign-off from the supplier and sometimes recertification of the installation. The people who know these systems best are process engineers. Not security specialists.
The common yardstick is the ISA/IEC 62443 series, cybersecurity standards for industrial automation and control systems (IACS). In 2021 the IEC recognised the series as a horizontal standard, applicable across many sectors. 62443 splits responsibility between asset owners, automation product suppliers, integrators and service providers. As an energy company you are the asset owner. The most relevant parts are then 2-1 (security programme for asset owners), 2-3 (patch management in IACS environments), 3-2 (security risk assessment for system design) and 3-3 (system security requirements and security levels). Parts 2-4 and 4-1 matter mainly in procurement: what do you require from integrators and product suppliers?
Which OT security profiles does an energy company need?
I see the same five tasks come up again and again at energy companies. Not every organisation needs five full-timers for them. But every task has to sit with someone.
The OT security architect designs segmentation into zones and conduits, sets the target security level per zone and turns 62443-3-2 and 3-3 into a target architecture. If there is no up-to-date risk assessment of the process domain yet, this is your first hire.
The ICS/OT security engineer does the hands-on work: firewalls between IT and OT, secure remote access for suppliers, hardening of engineering workstations and the patch process in line with 62443-2-3. Look for someone who can talk to process engineers and knows when to leave something alone.
The OT detection specialist sets up passive network monitoring, knows industrial protocols and makes sure the SOC understands OT alerts. Without this role, meeting the reporting duties under the Cbw and the Wwke in the process domain gets hard. You simply won't see the incident.
The OT GRC specialist maps which requirements from the Cbw, the Wwke and the network code apply to which system, builds the security programme in line with 62443-2-1 and provides the evidence the board needs. A NIS2 generalist without OT experience often underestimates the technology here.
And then someone to pull it together: an interim OT security lead. After a Wwke designation or ahead of a major audit, you need someone who coordinates, talks to the board and keeps the line open to asset management and operations.
Where hiring goes wrong
The most common mistake: putting a good IT security specialist into an OT environment and hoping for the best. Someone who is strong in cloud or office networks has no feel for what an active scan does to an old RTU. So ask OT candidates about a time they deliberately chose not to intervene.
Another one: merging all the roles into a single "OT security officer" who has to do everything. In a smaller organisation one person can combine two roles. Just be honest about what will be left undone.
Suppliers get forgotten a lot too. Many OT environments are maintained by integrators and manufacturers with remote access. Put it in the role profile that the candidate can draft and test supplier requirements, for example based on 62443-2-4. Otherwise the biggest access route stays out of view.
Then there is speed. When a grid operator came to us for a security architect, the deadline for submitting candidates was one day after my first call with the candidate. I want the CV with the manager the same day. Good candidates ask two things in that first call: what is the deadline, and how many days a week do I need to be in the office? At that grid operator it was two to three fixed days. For someone living on the other side of the country, that decides whether they respond at all. So put that information in your request up front.
And don't wait for the Wwke designation to arrive. OT specialists with energy experience are scarce and often booked well ahead. Start recruiting only then and you lose a good part of the 9 months for the risk assessment.
What to do now
- Check that your organisation is in the national entity register, and whether you are, or could be, designated as a critical entity under the Wwke.
- Find out whether you fall under the network code on cybersecurity as a high-impact or critical-impact entity.
- List your OT assets and every external party with remote access to the process domain.
- For each task above, write down who does it today, internally or externally, and where the gap is.
- Choose per gap: interim, secondment or permanent hire. Start with the profile that takes longest to fill.
- Make sure the board sees the OT risks and the status of the measures regularly. Under the Cbw the board is ultimately responsible.
We provide freelance and interim OT/ICS security specialists from a network of 7,000+ vetted professionals, and present the first candidate within 4 hours. See our OT/ICS security expertise, read what is happening in the energy sector or call or email me if you have a gap to fill. For the broader NIS2 approach, see demonstrating NIS2 compliance and our NIS2 page.
