Beyond ISO 27001: NIS2, operational technology and IEC 62443

On Monday 2 November, supermarkets in several European countries reported that, overnight, someone had remotely changed the settings on their refrigeration controllers, in some stores setting fridges and freezers to 50°C. Delhaize discarded food in dozens of stores , Carrefour reported 15 of its 700 Belgian stores affected and Coop seven of its Swedish stores. In Ireland, Musgrave said 13 SuperValu stores had been hit by a suspected cyber attack affecting a specific refrigeration model. The refrigeration manufacturer Danfoss told Dutch broadcaster NOS that 17 facilities using its systems in the Netherlands had been affected.

It was the second wave. In October, hundreds of French supermarkets suffered the same kind of attack , spoiling tonnes of food, melting parts of refrigeration units and, in some stores, causing fires. The European Commission convened its cyber task force with ENISA and Europol, Belgian prosecutors opened a criminal investigation, and as of this week nobody had claimed responsibility. The EU’s food commissioner described the attacks as a deliberate attempt to disrupt the food supply, while stressing that food security itself wasn’t at risk.

None of this required sophisticated malware. Security researchers quoted in the coverage describe refrigeration controllers reachable from the internet, protected by default or easily guessed passwords, and often installed and managed by third-party refrigeration contractors rather than the retailer’s own IT team. A supermarket freezer isn’t what most people picture when they hear “industrial control system”. It is one.

That’s why cyber security in operational environments is different, and why it can’t be left outside the main security programme. Many organisations within the scope of NIS2 don’t only run laptops, Microsoft 365 and SaaS. They depend on industrial control systems, SCADA, PLCs, HMIs, engineering workstations, sensors, safety systems, production machinery, building automation and utilities infrastructure. When something goes wrong there, the consequences aren’t limited to data loss or a service outage. They can reach production, machinery, physical processes, product quality, environmental controls and safety.

When cyber security moves into operational technology , the concern is no longer only whether information is protected. It’s whether physical systems continue to operate safely, reliably and predictably. IEC 62443 is the mature framework written specifically for that problem, and it sits comfortably alongside ISO 27001 and NIS2.

Key takeaways

• This week’s supermarket attacks show how ordinary OT has become, and how exposed. Refrigeration controllers reachable from the internet with weak passwords were enough to spoil food in hundreds of stores.
• For many organisations, NIS2 is moving cyber security out of the server room and onto the factory floor. Risk assessments need to include the systems that run production, utilities and physical processes.
• ISO 27001, NIS2 and IEC 62443 aren’t competitors. ISO 27001 provides the management framework, NIS2 the regulatory driver, and IEC 62443 the OT-specific depth.
• OT changes the balance of priorities. Integrity and availability often matter as much as, or more than, confidentiality, because a compromised system can change what a machine physically does.
• Industrial equipment runs for decades and often can’t simply be patched, so segmentation, controlled remote access, monitoring and change management carry more of the load.
• Suppliers matter even more in OT. An OT supplier may have access not just to your information, but to the process that creates your product or delivers your service.
• Implementing IEC 62443 doesn’t equal NIS2 compliance, but it gives a detailed structure for achieving many of the outcomes NIS2 expects in industrial environments.

Why this matters now

NIS2 requires essential and important entities to manage the risks to the network and information systems they use for their operations or to provide their services, taking what the Directive calls an all-hazards approach. For a pharmaceutical manufacturer, a food producer, a water utility or a medical device maker, the systems the service depends on include the plant.

That means cyber governance has to extend beyond the corporate estate into factory networks, production lines, industrial controllers, specialist engineering systems, remote maintenance connections and embedded devices. For many organisations, NIS2 is moving cyber security out of the server room and onto the factory floor.

Scope is worth checking carefully. NIS2’s food sector covers industrial production, processing and wholesale distribution rather than retail stores as such, so a supermarket’s shop floor may sit outside it while its distribution centres and food suppliers sit inside. The lesson of this week applies either way: the same controllers run cold stores, processing plants and warehouses.

Ireland, with its concentration of pharmaceutical, medical device and food manufacturing, has a large share of organisations in exactly this position. The Directive hadn’t been transposed into Irish law at the time of writing, but its expectations are already arriving through customer contracts, supplier questionnaires and group security requirements, and the organisations preparing now are the ones that won’t be scrambling later.

ISO 27001, NIS2 and IEC 62443 are not competitors

Each plays a different role:

• ISO 27001 provides the organisation-wide information security management system: risk management, governance, policies, controls, responsibilities, monitoring and continual improvement.
• NIS2 provides the regulatory driver. It requires in-scope organisations to implement appropriate and proportionate technical, operational and organisational measures to manage cyber risk, and holds management accountable for them.
• IEC 62443 provides deeper guidance for industrial automation and control systems, written for the technical and operational realities of those environments.

Put simply: ISO 27001 provides the management framework, NIS2 creates the regulatory driver, and IEC 62443 helps address the specific realities of OT and industrial systems.

One caution. Implementing IEC 62443 doesn’t automatically mean NIS2 compliance. NIS2 also covers governance, incident reporting, management accountability and much more. IEC 62443 helps with how to secure industrial environments well, which is a large part of what NIS2 expects of organisations that run them.

What IEC 62443 is

IEC 62443 isn’t one standard. It’s a family of standards and technical reports, developed by the ISA99 committee and the IEC, and recognised by the IEC as a horizontal standard in 2021, meaning it applies across industries. At a high level:

• 62443-2-x: security programmes, policies, operations and the responsibilities of service providers.
• 62443-3-x: system-level security, risk assessment and security architecture.
• 62443-4-x: secure product development and component-level security requirements.

What makes the series distinctive is that it looks at security from every side of an industrial system: the asset owners who operate it, the system integrators and service providers who build and maintain it, the manufacturers who make its products, and the components, systems and operational environment themselves. Nobody secures an industrial system on their own, and IEC 62443 makes that shared responsibility explicit.

IT security is not the same as OT security

Traditional IT security often puts a lot of weight on confidentiality. In OT, integrity and availability can matter as much, or more. The same CIA questions produce very different answers:

In IT, a compromised system may expose information. In OT, a compromised system may change what a machine physically does. The supermarket attacks were exactly that: nothing was stolen, a setpoint was changed, and the physical result was warm freezers and food in the bin. An integrity failure might mean a batch made outside specification, equipment damaged, or a safety function that no longer works as designed. An availability failure might mean an essential service stops.

None of this makes confidentiality unimportant in OT. Production data, formulations and engineering credentials are valuable, and stolen credentials are often how the attack on the plant begins. It means the balance between the three properties is different, and a risk assessment written for the office won’t capture it.

Legacy technology makes OT different

Industrial systems are built to last. Controllers, HMIs and the servers that support them may stay in service for 10, 15, 20 years or longer. Many run unsupported operating systems, old firmware or proprietary protocols, sit inside equipment that can’t tolerate downtime, or can’t be patched without the manufacturer’s approval and a planned shutdown.

In corporate IT, the answer to an unsupported server may be “replace it”. In OT, that server may be attached to equipment expected to operate for another fifteen years.

That’s why OT security relies much more heavily on:

• network segmentation
• compensating controls around systems that can’t be fixed
• tight access restrictions
• monitoring for unexpected behaviour
• controlled remote access
• strong change management

rather than assuming every vulnerability can simply be patched.

Zones and conduits

The most practical idea in IEC 62443 is zones and conduits . The environment is divided into zones of assets with similar security requirements, and every communication path between zones is a conduit, deliberately limited and controlled. A simplified example:

Traffic should flow between neighbouring zones only, through conduits that allow just what’s needed. Corporate IT shouldn’t talk directly to a controller, and nothing outside should reach the safety systems at all.

The point is containment. The key question is: if an attacker compromises one part of the environment, how far can they move? In OT security, the question isn’t only who can access the network. It’s how far they can travel once they’re inside it. Industrial ransomware this year has tested exactly that. Of the 1,140 ransomware incidents Dragos recorded against industrial organisations in the second quarter of 2026, 65% hit manufacturers, yet Dragos found no case where the attacker directly manipulated a control system. Plants stopped because the ERP, virtualisation and identity systems they depended on were encrypted or shut down. Where the boundary between IT and OT was well designed, the plant had a choice about whether to keep running. Where it wasn’t, it didn’t.

It’s also where IEC 62443 most directly supports NIS2. The Directive’s focus on resilience and reducing the impact of incidents is, in an industrial setting, largely a question of how well the zones hold.

Security levels

IEC 62443 lets an organisation set protection requirements according to the capability of the threat it’s defending against. Security levels run from SL 1, protection against casual or accidental misuse, to SL 4, protection against a well-resourced, highly motivated attacker with specialist industrial knowledge. A safety system and a reporting server don’t need the same level, and the standard gives a structured way to decide which needs what.

Those levels are set against seven foundational requirements:

1. Identification and authentication control
2. Use control
3. System integrity
4. Data confidentiality
5. Restricted data flow
6. Timely response to events
7. Resource availability

Because each zone can have a different level for each requirement, the model naturally reflects OT’s priorities: a high level for system integrity and resource availability where a process must not be disturbed, and a lower one for data confidentiality where the information itself is not sensitive.

NIS2 and OT

NIS2’s Article 21 lists the cyber risk management measures in-scope organisations must take. Almost every one has a direct OT equivalent:

• Risk analysis and security policies: does the risk assessment include production and utilities systems?
• Incident handling: do incident response plans cover an OT incident, and who decides whether to stop the plant?
• Business continuity, backups and crisis management: can the plant run if corporate IT is down, and are controller programs and configurations backed up?
• Supply chain security: how are integrators, equipment vendors and maintenance contractors managed?
• Secure acquisition, development and maintenance, including vulnerability handling: are security requirements specified when machinery and control systems are bought?
• Assessing the effectiveness of measures: are OT controls tested, or only assumed?
• Access control and asset management: who can reach which systems, and is there an OT asset inventory?
• Multi-factor authentication: does it extend to remote engineering access?

The useful question for any NIS2 programme is this: when your organisation assesses its “network and information systems”, have you included the systems that actually operate production, utilities or physical processes?

This is where IEC 62443 earns its place. NIS2 says what outcomes are expected. IEC 62443 provides a detailed, OT-specific structure for achieving many of them.

Supply chain and remote access

Industrial environments depend heavily on outside parties: equipment manufacturers, system integrators, maintenance engineers, managed service providers, specialist contractors and industrial software vendors. Many of them have remote access, privileged accounts, access to controllers and engineering workstations, and detailed knowledge of how critical systems are built.

A supplier in a normal office environment may have access to your information. An OT supplier may have access to the process that creates your product or delivers your service.

That makes supplier risk in OT a sharper version of the same problem. For every external party with access, it’s worth knowing:

• who has remote access, and through which route
• how access is authenticated, and whether MFA is enforced
• whether access is permanent or granted only when needed
• whether sessions are logged and supplier activity monitored
• whether credentials are shared between engineers
• whether access can be revoked quickly
• whether the supplier itself meets an appropriate security standard

IEC 62443-2-4 sets out the security capabilities expected of service providers, which gives asset owners a recognised standard to point to in contracts. It also maps directly to NIS2’s supply chain security requirement. The supermarket attacks are a sharp illustration. Refrigeration in large retail estates is commonly installed, monitored and maintained by specialist contractors, with remote access that makes their job possible. That access is part of the retailer’s attack surface whether or not the retailer’s own security team knows it exists.

Asset management comes first

Can you secure an OT environment if you don’t know what’s connected to it? Asset discovery and inventory are foundational, and in many plants they’re the first real gap. A useful OT inventory records:

• what industrial assets are deployed, and where
• what software and firmware they run
• which systems they communicate with
• who supports them, and who has access
• which are obsolete, and which can’t be patched
• which are safety-critical
• which are externally connected

A simple test after this week: would you know whether your refrigeration, building management or energy controllers can be reached from the internet, and what password protects them? Most organisations that build an OT inventory properly for the first time find connections they didn’t know existed: a vendor’s cellular modem in a control cabinet, a historian reachable from the office network, an engineering laptop that also browses the internet.

The disappearing air gap

Many industrial environments were historically assumed to be isolated. That’s increasingly unrealistic. Modern OT may connect to corporate IT, cloud platforms, analytics services, remote support, IIoT sensors, mobile devices, vendor platforms and, increasingly, AI systems.

That connectivity brings real business value: better maintenance, less downtime, better quality data. It also brings exposure. The air gap is increasingly being replaced by controlled connectivity, so the quality of those controls matters enormously. An organisation still describing its plant as air-gapped should probably check. The controllers in this autumn’s supermarket attacks weren’t connected through some elaborate route. They were reachable from the internet.

Product security and IEC 62443-4-x

IEC 62443 isn’t only about how asset owners run industrial systems. The 4-x parts address how manufacturers build secure industrial products: a secure development lifecycle covering security requirements, secure design, implementation, testing, vulnerability handling, patching and end-of-life, plus the technical security capabilities each component should provide.

That matters more as industrial equipment becomes more software-driven and connected, and product security is becoming regulated in its own right. The EU Cyber Resilience Act brings security requirements for products with digital elements, including many industrial components, into force from December 2027, and the new Machinery Regulation adds protection against corruption to machinery safety requirements from January 2027. For asset owners, the practical consequence is simple: it’s increasingly reasonable to ask suppliers how their products are built, and to expect evidence against 62443-4-1 and 4-2.

Using IEC 62443 within an ISO 27001 control framework

For organisations that already run an ISO 27001 ISMS , IEC 62443 fits naturally. As we covered in making the Statement of Applicability work , Annex A is a starting point, not a boundary. Where the risk assessment identifies OT-specific risks, IEC 62443 can inform additional controls, for example:

• industrial network segmentation into defined zones and conduits
• controlled, time-limited remote engineering access
• PLC and controller configuration management and backup
• an OT-specific asset inventory
• engineering workstation hardening and restricted use
• industrial change management aligned with production and safety processes
• separation of safety systems from control and business networks

These sit in the same risk treatment framework and the same SoA as everything else, linked to the same risks, owners and evidence. Annex A isn’t the boundary of your security programme. Where OT risk exists, IEC 62443 can provide the additional control depth the organisation needs.

Practical questions to ask now

1. Do we operate OT, ICS or industrial systems?
2. Are those systems included in our cyber risk assessment?
3. Do we maintain an accurate OT asset inventory?
4. Do we understand which systems are critical to production or safety?
5. Are IT and OT networks appropriately segmented?
6. Who can remotely access the OT environment?
7. Are supplier and engineering connections monitored?
8. What legacy or unsupported systems remain?
9. What compensating controls protect systems that can’t be patched?
10. Could an IT compromise spread into production?
11. Are OT incidents included in business continuity and incident response planning?
12. Have we considered IEC 62443 when defining OT security controls?

If you can’t answer these confidently, there may be a gap between your corporate cyber security programme and your operational environment.

Closing

IEC 62443 isn’t only for large industrial enterprises. This week’s attacks didn’t target refineries or power stations. They targeted supermarket freezers. Any organisation that depends on connected physical systems, a single production line, a cold store, a building management system, a treatment plant, can use its principles. As more physical systems become connected, the distinction between IT risk and operational risk matters more, and NIS2 accelerates that by requiring organisations to consider the resilience of the systems their essential and important services depend on.

Cyber security in operational technology is ultimately about more than protecting information. It’s about making sure the systems responsible for physical processes continue to operate safely, reliably and predictably, even when somebody is deliberately trying to disrupt them.

ISO 27001 can provide the governance framework, NIS2 the regulatory driver, and IEC 62443 the specialised OT security structure needed where cyber risk meets the physical world.

If you’d like help bringing OT into the scope of your ISMS or your NIS2 programme, get in touch . Our NIS2 , ISO 27001 and Technical Security services all cover this ground.