If a Dutch water board or drinking water company can fund only one security hire, it should be someone who understands the process automation. Policy can follow.
That is my advice on cyber security in the water sector, and it carries more weight since the rules changed this summer.
What the law now asks of water utilities
The Cyberbeveiligingswet, the Dutch law implementing NIS2, has applied since 15 August 2026. Organisations in scope must register with the National Cyber Security Centre (NCSC), carry out a risk analysis, take proportionate measures and report an incident to their CSIRT and supervisor within 24 hours. The board approves the measures and oversees how they are carried out.
Drinking water and waste water have a clear set-up. The NCSC acts as CSIRT and the Human Environment and Transport Inspectorate (ILT) is the supervisor, under the Ministry of Infrastructure and Water Management. The NCSC's referral guide lists the 21 Dutch water boards separately, under flood defence and water management, with CERT-WM as their CSIRT.
A water board is also a public body. BIO2, the Dutch government's baseline for information security, was published in the Staatscourant, the official gazette, on 2 March 2026. It covers every government entity. Where a public body falls under the Cyberbeveiligingswet, the law makes BIO2 mandatory; where it does not, BIO2 applies through mandatory self-regulation.
Overlapping regimes are not new. In a 2020 letter to parliament about Waternet, the minister for infrastructure and water management wrote that the ILT supervised only the part of the organisation responsible for supplying drinking water. Decentralised authorities, the letter said, regulated their own cyber security.
Expect, then, a law and a baseline at once, often with two lines of supervision. You need people who understand both sides of that.
Why OT knowledge comes first
A treatment plant or a pumping station runs on process automation: PLCs and SCADA, with telemetry back to a control room. The equipment stays in place for years, sometimes decades, and nobody reboots it for a patch on a Tuesday afternoon.
An information security adviser from corporate IT can write perfectly good policy. If they do not know how a process network behaves, or why you never point a scanner at one without warning, that policy stays on paper. The engineers will rightly set it aside.
Someone with OT experience starts by mapping what is actually installed, which connections reach the outside world and who has remote access. That mapping is where the legally required risk analysis begins, and the policy can then be written around what really exists.
Reverse the order and you spend months on a document nobody on the plant floor recognises.
OT security specialist or information security adviser?
You will need both in the end. What separates them is what each delivers in the first few months.
An OT security specialist works alongside the process automation engineers and the maintenance team. They draw up an inventory of installations and network segments, review remote access and supplier connections, and put the first controls in place without taking the plant offline. At interview, ask about a previous environment that resembles yours and what they got done there in month one.
An information security adviser or GRC specialist makes sure you can prove what you do. They map controls to BIO2 and to the duty of care in the Cyberbeveiligingswet, set up the incident reporting procedure and make sure the board knows what it is signing off. That work has to happen, all the more so now the ILT can come and inspect. It simply goes far better once the OT inventory exists.
With budget for one role, start with OT. If a strong information security officer is already in post, an OT specialist is the natural addition. Our pages on OT and ICS security and GRC and compliance describe both profiles.
Do not expect one person to inventory the installations, write the policy and build the reporting procedure. Those are two jobs.
Where hiring for a water board stalls
People who combine OT and security are thin on the ground, and energy companies, grid operators and manufacturers are after the same profile. What I wrote about OT security roles in the energy sector applies to water just as much.
Water boards add public procurement to the mix. They buy under the Dutch Public Procurement Act 2012 (Aanbestedingswet); the procurement policy of the Drents Overijsselse Delta water board, for instance, names that act as its framework. In a tender, the maximum hourly rate is fixed. If a candidate wants a little more, there is almost no room to move.
So I tell candidates that honestly in the very first conversation. Leave it until later and you lose them after the intake, which costs you days.
My advice to procurement teams: before the request goes live, check whether the rate cap works for an OT profile. Set it at the level of a general IT adviser and the OT specialists will walk away before you have spoken to them. For the rest of how a Dutch public-sector request works, see hiring cyber security contractors for Dutch government.
What to do now
- Check that your organisation is in the NCSC's register of entities, and who reports an incident within 24 hours.
- Ask your maintenance team for a current overview of installations, networks and remote connections. If none exists, you know which role to fill first.
- Record which part of the organisation falls under which supervisor, and where BIO2 applies.
- Before you publish, test the rate cap in your tender against the going rate for OT security specialists.
Looking for an OT security specialist or an information security officer for a water board or drinking water company? Our page on water and waste water covers security in that sector. If you would rather talk through which role you need first, call or email me.
