Who NIS2 covers in the energy sector
Energy is one of the sectors of high criticality under the NIS2 Directive (Annex I). An essential entity is, as a rule, a large entity from such a sector: 250 or more employees, or turnover above EUR 50 million and a balance sheet total above EUR 43 million. Medium-sized enterprises from these sectors (50–249 employees, or turnover up to EUR 50 million, or a balance sheet of EUR 10–43 million) are important entities.
In practice this group includes producers of electricity and heat, transmission and distribution system operators, and district heating companies. A role in the chain does not exempt anyone from the assessment: a company of an energy group that runs a single CHP plant assesses its own classification, using its own employment and turnover data.
The Polish model is based on self-identification. An entity assesses on its own whether it is essential or important and files an electronic application for entry in the register kept by the Minister of Digital Affairs. A change of data in the register is reported within 14 days of the change. A sector regulator can also enter an entity by decision. Deadlines for individual categories of entities follow from a notice of the Minister of Digital Affairs, so the first step is to check the notice for your own category.
Timeline: what is already running and what is still ahead
As of 3 November 2026 the position is as follows: the Act entered into force on 3 April 2026, the register of essential and important entities was created in the first month of application, and existing operators of essential services were entered ex officio. From 3 October 2026 operators of essential services report major incidents under the new rules.
The most important dates facing an energy company are listed below. One word of caution: the provisions on high-risk vendors are subject to a motion of the President to the Constitutional Court, and no ruling was found in verified sources, so OT procurement planning should assume that this part may change.
- 3 April 2027: end of the 12 months for the obligations of chapter 3 of the Act (information security management system, documentation, incident procedures, contact persons).
- 3 April 2027: deadline by which the Minister of Digital Affairs launches the remaining functionalities of the S46 system.
- 3 April 2028: first cybersecurity audit of an essential entity and the earliest date for most financial penalties.
- After the first audit: an audit at least once every 3 years.
Incidents handled in 2025 by sector
Article 21 risk management measures in a power plant
Article 21 of the Directive lists measures an organisation must implement in proportion to risk: risk analysis and system security policy, incident handling, business continuity, supply chain security, security in acquisition and maintenance of systems, assessment of the effectiveness of measures, cyber hygiene with training, cryptography, access control with asset management, and multi-factor authentication.
In the energy sector the weight of these measures lies on the OT side. Turbine controllers, boiler automation, substation SCADA systems and remote access for service technicians are assets that a typical IT security programme does not cover. ISA/IEC 62443 is a natural reference point here: part 3-2 leads to risk assessment and division of the installation into zones and conduits, part 3-3 defines system requirements in seven foundational areas and four security levels, and part 2-4 sets requirements for integrators and service providers. The standard is voluntary, but the absence of adequate measures can be assessed in an audit as insufficient diligence.
The key auditor question is usually not whether a policy exists, but what follows from it for a specific controller. That is why the first measurable result is an inventory of OT assets with an owner for each, its remote access channels and the date of the last configuration change.
Incident reporting: 24 hours, 72 hours, one month
Article 23 of NIS2 and the provisions of the KSC Act introduce a three-stage procedure. An early warning goes to the competent CSIRT without delay, and no later than 24 hours after detecting a major incident. The notification of a major incident is filed without delay, and no later than 72 hours after detection. The final report arrives within one month of the notification. Reports go through the S46 system.
The energy sector is not an abstraction here. In 2025 the NASK CSIRT classified 52 incidents in energy (table A6 of the CERT Polska report), and at the end of December 2025 the first coordinated sabotage attacks on the energy sector in Poland's history were recorded, including a large CHP plant. We discuss the details of the reporting procedure in a separate article on the 24 and 72 hour deadlines.
NIS2/KSC transition window in Poland
Management liability and penalties
Article 20 of the Directive makes the management body responsible for approving measures and for infringements. The Polish Act goes in the same direction: the head of the entity oversees the information security management system, decides on funding and must complete cybersecurity training every year.
Penalties under Article 34 of the Directive: up to EUR 10 million or 2% of worldwide turnover for essential entities (the higher amount applies) and up to EUR 7 million or 1.4% for important ones. Under the Polish Act the penalty for an essential entity is up to EUR 10,000,000 or 2% of revenue, not less than PLN 20,000, and for the most serious infringements it reaches PLN 100 million. Penalties under Article 73(1)–(4) can be imposed for the first time after 3 April 2028, which gives plants a window to build evidence.
How to collect audit evidence
A cybersecurity audit of an essential entity assesses whether measures work, not only whether documents exist. A good evidence pack for the energy sector consists of several layers, and each should answer the question: who, what, when.
Part of the evidence lies outside the IT department. A register of physical and logical access of contractors to critical zones, a record of admissions to work on control systems and confirmations of safeguards before work are material that an auditor will compare with OT logs. A digital work order process provides such evidence as a record with the author and time of each action, which supports meeting the access control and asset management requirement but does not replace the other measures.
- OT asset register with owner, firmware version and remote access channels.
- Risk assessment with division into zones and conduits, and board decisions approving the measures.
- Incident procedure with a rehearsed 24 h / 72 h / one month reporting scheme and a list of two contact persons.
- Register of vendors and service technicians with the scope of their OT access.
- Records of cybersecurity training of the head of the entity and employees.
- Logs of admissions to work on control systems and confirmations of safeguards.
Video
Frequently asked questions
Is a district heating company covered by NIS2?
District heating and cooling is part of the energy sector in Annex I of the Directive. A heating company is an essential or important entity depending on size, so it should assess its own employment and turnover thresholds.
When do penalties start?
Penalties under Article 73(1)–(4) of the Act can be imposed for the first time after 2 years from the Act's entry into force, that is after 3 April 2028. The most serious infringements fall under a separate regime.
Is the IEC 62443 standard mandatory?
No, it is a voluntary standard. It is, however, a recognised benchmark for Article 21 measures in an OT environment, so applying it makes it easier to show the adequacy of measures in an audit.
Which evidence from the occupational safety area helps in an audit?
Records of contractor admissions to work on control systems, confirmations of safeguards and a register of access to zones. They provide audit evidence for access control but do not replace risk assessment or incident procedures.
Sources
Collect NIS2 audit evidence from on-site work
Using your own facility as an example, we will show which records of admissions and contractor work support the access control requirements. Book a call or a demo.
Let's talk