Electricity, Gas, Water: the NIS2 readiness gap across Europe’s utilities

NIS2 utilities compliance is not moving at the same pace across sectors. Electricity is the most cybersecurity mature utility sector in Europe, gas is improving, and water and wastewater remain the sector ENISA rates most at risk, since their criticality still exceeds their current cybersecurity maturity.

That gap comes down to how different these sectors really are. It is tempting to discuss “the utility sector” as though electricity, gas and water organisations share a common cybersecurity profile. They do not.

Their infrastructure, investment levels, market structures, regulatory histories and operational risks can be very different. ENISA’s latest sector assessment makes that clear, and it means NIS2 utilities compliance cannot be treated as a single, uniform target.

ENISA’s 2026 NIS360 assessment identifies electricity as one of Europe’s most critical sectors.

That is unsurprising. Almost every other essential service depends on it.

Electricity also benefits from established European coordination through transmission system operators, distribution system organisations, regulators and operating processes across borders.

The EU’s Network Code on Cybersecurity for the electricity sector came into force in June 2024. It complements NIS2 by introducing requirements specific to the sector for electricity flows across borders, including recurring risk assessments, common minimum requirements, monitoring, reporting and crisis management.

This does not mean electricity has solved cybersecurity.

It does mean that many organisations are operating within a relatively developed regulatory and sector coordination environment.

ENISA reports that the gas sector has begun to move out of its cybersecurity risk zone.

It attributes the improvement to stronger information sharing, better collaboration and more effective implementation of risk management measures.

That is encouraging, but gas infrastructure continues to combine operational technology, geographically distributed assets, specialist equipment and dependencies within and between countries. Progress should therefore be understood as improving maturity rather than the disappearance of risk.

For NIS2 utilities compliance, this is where the gap is sharpest. Drinking water and wastewater both sit within the risk zone in ENISA’s 2026 assessment. In simple terms, their criticality exceeds their current level of cybersecurity maturity.

Water organisations can face particularly difficult structural conditions. They may operate large numbers of small, unattended locations. Equipment can remain in service for many years. Local authorities or regional operators may have limited security resources. Specialist suppliers may require remote access to treatment, pumping and monitoring equipment.

The sector is also fragmented. A large national energy group and a small regional water operator may both provide essential services, but they do not have comparable budgets or internal capabilities.

NIS2 applies the principle of proportionality, but proportionality does not remove the need to understand and manage the risk.

Utilities often depend on several organisations to deliver a complete service: equipment manufacturers, systems integrators, mobile operators, roaming partners, connectivity providers, cloud platforms and application suppliers. When something fails, each participant may only see its own part of the chain.

The device may be connected to a radio network, but is its data reaching the utility’s application? Where is the traffic breaking out? Which route is it taking? Has the device stopped communicating, or has the application stopped responding?

That lack of complete understanding makes ordinary troubleshooting harder. During a cyber incident, it can become a major constraint.

Across critical sectors, ENISA’s 2025 investment research highlights three persistent challenges for NIS2 compliance:

• patching
• business continuity
• supply chain risk management

Half of respondents identified patching as a major implementation difficulty, 49% pointed to business continuity and 37% highlighted supply chain risk management.

Twenty eight per cent said they took longer than three months to patch critical vulnerabilities, while almost one in three had not conducted a cybersecurity assessment during the previous 12 months.

Each of these issues is particularly relevant to utilities.

• A vulnerable field device may not support a current operating system.
• A treatment or distribution process may not be easily interrupted for maintenance.
• A third party engineer may be the only person able to support a specialist system.
• A replacement may require a capital programme lasting several years.

The answer therefore has to combine immediate risk reduction with a realistic modernisation plan.

Historically, operational systems were often protected by isolation. Digitalisation has changed that.

Utilities are using connected sensors, smart meters, mobile workforces, distributed energy resources, cloud analytics and remote maintenance to improve efficiency and service performance. The operational benefit is clear, but every connection creates a dependency that needs to be understood.

The challenge is not merely whether a device is secure. It is also:

• who can communicate with it
• which networks carry the traffic
• where the traffic exits the mobile network
• which systems receive the data
• whether the route can change
• whether remote access is controlled
• which organisation holds the relevant logs
• how quickly an abnormal event can be investigated

This is where connectivity becomes part of the cybersecurity architecture rather than a commodity purchased only on price and coverage.

Public disclosures from major energy groups show the direction of travel. E.ON describes governance across the group, direct reporting to management and supervisory boards, an information security management system based on ISO standards and continued investment in identity, cloud security, detection and vulnerability management.

Enel describes a cybersecurity framework covering IT, OT and IoT, supported by security by design, assurance, access control, incident readiness, exercises and a global CERT. These are not claims of universal NIS2 compliance, nor are they representative of every utility.

They do illustrate what mature implementation increasingly looks like: governance, risk, engineering, monitoring, response and testing working as one system.

The next divide may not be between organisations that have read NIS2 and those that have not.

It may be between organisations that can operate and evidence their controls and those that still depend on assumptions.

Increasingly, that divide comes down to five capabilities: knowing every critical connected asset, seeing whether it is communicating, distinguishing a cyber incident from a carrier, roaming, routing or application failure, controlling remote support without exposing the device publicly, and reconstructing the network events surrounding an incident.

The strongest utilities are beginning to treat those capabilities as part of operational resilience.

Others are still discovering how much of their critical infrastructure sits outside the visibility of their traditional security tools.

This whitepaper sets out what NIS2 for utilities means in practice, sector by sector and country by country, and gives you a structured 90-day plan to improve readiness without waiting for a multi-year transformation programme.