Regulatory Compliance
CIP-015-2 Expanded INSM Scope: The Compliance Timeline to 2031
FERC approved CIP-015-2 on 10 August 2026, and the approval was announced the following week. The headline is straightforward: int...
Blogs
Insights on OT Cybersecurity, Functional Safety & Industrial Resilience.
Regulatory Compliance
NIS2 Incident Reporting for OT: Running the 24-Hour Clock on a Live Plant
The Article 23 timeline is not complicated to describe. An early warning within 24 hours of becoming aware of a significant incide...
Regulatory Compliance
NIS2 Enforcement Has Started: What the First Actions Tell Industrial Operators
NIS2 moved out of the preparation phase some time ago. In member states that transposed on or near time, supervisory authorities n...
Regulatory Compliance
You May Owe Both: How NIS2 and the Cyber Resilience Act Overlap for Equipment Makers
Industrial manufacturers selling into Europe often assume they face one EU cybersecurity regime. They usually face two, and the tw...
Regulatory Compliance
Does NIS2 Require a CISO? What Article 20 Actually Demands
The short answer is no. NIS2 does not require you to appoint a Chief Information Security Officer, and no amount of searching the...
Regulatory Compliance
How to Comply with the Cyber Resilience Act Before December 2027
Reporting obligations under the EU Cyber Resilience Act went live on 11 September 2026. The rest of the regulation applies from 11...
Regulatory Compliance
NIS2 Supplier Questionnaires: Building an Evidence Pack as a North American OT Vendor
NIS2 does not regulate you if you are a control system vendor in Houston or a systems integrator in Calgary. It regulates your Eur...
Regulatory Compliance
Does the Cyber Resilience Act Apply to Your PLC, HMI or IIoT Gateway?
The EU Cyber Resilience Act regulates products with digital elements. That phrase is deliberately wide, and it is wider than most...
Regulatory Compliance
The NIS2 Patchwork: What Four CJEU Referrals Mean for Vendors Selling Into Europe
On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the European...
Regulatory Compliance
CRA Reporting Requirements: What Article 14 Means for US and Canadian OT Manufacturers
Since 11 September 2026, any manufacturer placing a product with digital elements on the European market has had a legal duty to r...