Since 15 August 2026, OT security in the Dutch energy sector has been about proof. From that date the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw) and the Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten, Wwke) apply, and electricity companies also have the European network code on cybersecurity to deal with. Anyone running grids, power plants, storage or district heating needs at least four OT profiles for this: an OT security architect, an ICS security engineer, someone covering detection in the process network, and an OT specialist in governance and compliance.
Which rules apply to OT security in the energy sector?
Three frameworks overlap, and each asks different things of your OT team.
The Cybersecurity Act
The Cbw is the Dutch transposition of NIS2. According to the Dutch government, it covers more than 8,000 organisations in 18 sectors, including energy. Organisations must register in the NCSC's entity register, take measures to manage the risks to their network and information systems, and report significant incidents to their CSIRT and the competent authority. According to RVO, an initial report is due within 24 hours in most cases. The board is ultimately responsible and must have enough knowledge to assess risks and measures.
In an energy company, "network and information systems" also covers the SCADA environment, substation control and the engineering workstations. An ISMS that only covers office IT is therefore incomplete.
The Critical Entities Resilience Act
The Wwke applies to around 500 organisations that the responsible ministry designates as critical entities, including in the energy sector. According to the Dutch government, a designated organisation has 9 months to complete a risk assessment and 10 months to put appropriate technical, organisational and physical measures in place. Incidents that cause significant disruption must be reported within 24 hours. The Wwke goes wider than cyber: sabotage, terrorist offences and extreme weather are in scope too. So OT security has to work with physical security and business continuity.
Network code on cybersecurity for electricity
Electricity companies also face Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024, which sets sector-specific rules for the cybersecurity of cross-border electricity flows. It entered into force on 13 June 2024. According to ENTSO-E, the code covers risk assessment, baseline security requirements, certification of products and services, monitoring, incident reporting and crisis handling for so-called high-impact and critical-impact entities. Whether your organisation is in scope depends on the processes you run.
Why OT security needs a different profile from IT security
In OT, availability comes first. A scan that is harmless in the office can freeze an older PLC. A patch needs a maintenance window, sign-off from the supplier and sometimes recertification of the installation. Systems often stay in service far longer than office IT, and the people who know them best are process engineers, not security specialists.
The common yardstick is the ISA/IEC 62443 series, a set of cybersecurity standards for industrial automation and control systems (IACS). In 2021 the IEC recognised the series as a horizontal standard, meaning it applies across many sectors. 62443 divides responsibilities between four groups: asset owners, automation product suppliers, integrators and service providers. For an energy company acting as asset owner, the most relevant parts are 2-1 (security programme for asset owners), 2-3 (patch management in IACS environments), 3-2 (security risk assessment for system design) and 3-3 (system security requirements and security levels). Parts 2-4 and 4-1 matter mainly in procurement: what do you require from integrators and product suppliers?
Which OT security profiles does an energy company need?
We see the same five roles come up again and again at energy companies. Not every organisation needs all five full time, but each of these tasks has to sit with someone.
- OT security architect. Designs segmentation into zones and conduits, sets the target security level per zone and turns 62443-3-2 and 3-3 into a target architecture. This is the first profile to hire if there is no up-to-date risk assessment of the process domain yet.
- ICS/OT security engineer. Does the hands-on work: firewalls between IT and OT, secure remote access for suppliers, hardening of engineering workstations and the patch process in line with 62443-2-3. Look for someone who can talk to process engineers and knows when something should be left alone.
- OT detection and monitoring specialist. Sets up passive network monitoring, knows industrial protocols and makes sure the SOC understands OT alerts. Without this profile it is hard to meet the reporting obligations under the Cbw and the Wwke in the process domain, because you simply will not see an incident.
- OT GRC and compliance specialist. Maps which requirements from the Cbw, the Wwke and the network code apply to which system, builds the security programme in line with 62443-2-1 and provides the evidence the board needs. A generalist NIS2 consultant without OT experience tends to underestimate the technology here.
- Interim OT security lead. After a Wwke designation or ahead of a major audit you need someone to coordinate the whole effort, talk to the board and keep the line open to asset management and operations.
Pitfalls when hiring OT security talent
The biggest mistake we see is putting an IT security profile into an OT environment and hoping for the best. Someone who is excellent at cloud or office networks has no feel for what an active scan does to an RTU from another decade. In interviews, ask about experience with process environments and about a time the candidate deliberately chose not to intervene.
A second pitfall is merging the roles into a single "OT security officer" who has to do everything. Architecture, implementation and compliance need different people. Combining two roles in one person is fine for a smaller organisation, but be honest about what will be left undone.
Third: suppliers. Many OT environments are maintained by integrators and manufacturers with remote access. Make sure the candidate can draft and test supplier requirements, for example based on 62443-2-4. Otherwise the biggest access route stays out of view.
Finally, timing. OT specialists with energy experience are scarce and often booked well in advance. Wait for the Wwke designation and recruitment will eat into the 9 months you have for the risk assessment.
What to do now
- Check that your organisation is registered in the NCSC's entity register and whether you could be designated under the Wwke.
- Have it established whether you fall under the network code on cybersecurity as a high-impact or critical-impact entity.
- Draw up an overview of your OT assets and of every external party with remote access to the process domain.
- For each role above, record who covers it today, internally or externally, and where the gap is.
- Decide whether to fill the gaps with interim capacity, secondment or permanent hiring, and start recruiting for the profile with the longest lead time first.
- Make sure the board sees the OT risks and the status of the measures regularly, because under the Cbw the board is ultimately responsible.
MVPeople Group provides freelance and interim OT/ICS security specialists from a network of 7,000+ vetted professionals, and presents the first candidate within 4 hours. Explore our OT/ICS security expertise, read what is happening in the energy sector or get in touch to discuss your capacity needs. For the broader NIS2 approach, see our article on demonstrating NIS2 compliance and our NIS2 page.
Frequently asked questions
Does OT fall under the duty of care in the Dutch Cybersecurity Act?
The duty of care concerns the risks to the security of network and information systems. In an energy company, the systems that control the primary process logically belong to that. So include OT in your Cbw measures.
What is the difference between an OT security architect and an ICS security engineer?
The architect owns the design: zones, conduits, security levels and the risk assessment based on IEC 62443-3-2 and 3-3. The engineer builds and runs the measures, such as firewalls, remote access and the patch process.
Does every energy company have to comply with the network code on cybersecurity?
No. Network code (EU) 2024/1366 deals with the cybersecurity of cross-border electricity flows and with entities that have a high or critical impact. Whether you are in scope depends on your processes. The code is about electricity; a gas or heat company can still fall under the Cbw and the Wwke.