NIS2 for OT: From Regulation to Industry Practice

When discussing and trying to make sense of NIS2 we quite often end up discussing how to achieve compliance with the rules and regulations forgetting the reason why got NIS2 in the first place. This presentation will dig into the current threat landscape and give an insight into the NIS2 legislation and the cybersecurity requirements.

How do you secure and modernize critical infrastructure built in the 1980s to meet today's cybersecurity demands? In this case study, you'll hear how a major district heating operator is tackling exactly that challenge. With a sprawling operational area and no direct end-user contact, the company must navigate the balance between functionality, regulation (NIS2 and CER), usability, and cost.
Discover how internal design principles – inspired by NIS2 and CER requirements – are being developed to guide future renovations and expansions. Learn practical steps for immediate security enhancements, including the creation of procedures, implementation of technical measures, and the training of key personnel. Walk away with concrete ideas on how to turn regulation into resilience, ensuring both compliance and operational excellence.

What NIS2-related requirements and expectations do vendors meet from customers, and how are they handled in practice? In this presentation, Rockwell shares experiences from working with industrial clients navigating the directive.

You’ll hear how Rockwell balances technical setups with documentation and compliance, and what it means in day-to-day collaboration with customers. The presentation also reflects on how customer expectations vary, and how Rockwell adapts to these differences.

The ISO 27000 series count more the 50 standards supporting the ISO 27001 requirement standard. Many have heard of ISO 27002, but ISO 27003 seems completely unknown to most people – even though it might be the most relevant standard to use if you want to be ISO 27001 compliant or certified. Niels will share his many years of experience as lead auditor, implementer, management consultant and systems manager in build-up, implementation, compliance and certification. What is the do´s and don’ts if you want to use standards as tool for information security. What are the actual requirements, and what are the most common failures to comply.

Morten from INIT Denmark will be presenting real life examples of a technical implementations that was done to mitigate risks and vulnerabilities identified in a customer environment.

When it comes to NIS 2 compliance, relying on vendors isn't enough—you can outsource services, but not your responsibility. In this talk, we’ll dive into the real risks of assuming your supply chain has everything under control and explore what you can do to strengthen your vendor management processes. During the presentation we will go through practical steps to strengthen oversight, reduce exposure, and stay compliant without drowning in bureaucracy. Expect real-world examples, not just theory—because when regulators come knocking, “Our vendor handles that” won’t cut it.