Who NIS2 applies to
Directive (EU) 2022/2555 (NIS2) sets cybersecurity risk-management and incident-reporting duties for entities in the sectors it covers, such as energy, transport, health, banking and digital infrastructure, split into essential and important entities. Scope depends on the sector and on how the entity is classified under national transposition law. It does not depend on owning a building. Owning an office block does not, in itself, bring an organisation into scope. Confirm this with the client's legal adviser or the national competent authority.
Why building systems matter
Building operational technology (OT) includes HVAC and BMS, access control, CCTV, lifts, and fire and life-safety systems. Many were once isolated. Now they use IP networks, remote monitoring and vendor access, which widens the attack surface. An attacker who compromises a building controller or a vendor account can disrupt operations, or move into other networks if zones are not separated.
Design measures that help
- Asset inventory and classification. List every networked building device, its owner, function and criticality. Everything else depends on this list.
- Network segmentation. Separate BMS, access control, CCTV, fire and corporate or guest networks into zones, with controlled routes between them and firewalls at zone boundaries.
- Secure remote access. Vendor access should be time-limited, logged, multi-factor where possible, and never a permanent open route.
- Monitoring and logging. Plan log collection from OT devices and servers to a monitored location, with synchronised time sources.
- Update and patch planning. Specify how firmware is updated and tested, including devices that are hard to patch.
- Frameworks. Use IEC 62443 concepts for OT zones and conduits where the project calls for them.
Incident reporting readiness
For in-scope entities, NIS2 sets reporting timelines: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month. Design the logging and network visibility needed to meet those timelines, and make sure building operators know who to contact. Confirm the details against the national law that applies.
Checklist for design teams
- Ask the client whether the entity is in scope, and under which sector and classification.
- Produce the OT asset inventory as a design deliverable, with network diagrams.
- Show zones and conduits on the ELV network drawings, not only the physical routes.
- Specify remote-access solutions and vendor access procedures in the specification.
- Coordinate with the client's IT and security team on logging, monitoring and incident response.
Cybersecurity policy and the operator's security obligations remain the responsibility of the operator. We design the network and systems layer to support them.