Drinking water is the essential service with the shortest path to the population: between a command in an automation system and the glass at the tap there is no intermediary to correct an error. Treatment plants, pumping stations and distribution networks are now run by SCADA systems and automatic dosing equipment, linked by telemetry across long distances and often over public communications infrastructure. Manipulating a disinfection process, stopping the pumps or falsifying quality monitoring data can have immediate health consequences, in a service that cannot be suspended while a fault is repaired.
Directive (EU) 2022/2555 (NIS 2) lists drinking water in Annex I, among the sectors of high criticality, separately from waste water. The obligations cover risk analysis, technical and organisational measures, incident reporting and operational continuity, and they apply equally to administrative IT networks and to the industrial control systems that keep the service running.
Legal framework
At European level:
- Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex
At national level (Romania):
- GEO no. 155/2024: Official Gazette no. 1332/2024
- Law no. 124/2025: Official Gazette no. 638/2025
- DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
- Order on disruption criteria and risk assessment: Official Gazette no. 776/2025
The Drinking water sector
Essential entities:
Suppliers and distributors of water intended for human consumption, excluding distributors for which distribution of water for human consumption is a non-essential part of their general activity of distributing other commodities and goods.
- Regional and local water and sewerage operators, for abstraction, treatment and distribution
- Drinking water treatment plants
- Operators of transmission mains, storage reservoirs and pumping stations
- Entities responsible for water quality monitoring and reporting to public health authorities
Sector-specific cyber threats
- Unauthorised access to the SCADA systems of treatment and pumping stations
- Manipulation of disinfection processes and chemical dosing
- Disruption of telemetry between abstraction points, reservoirs and the distribution network
- Ransomware affecting water quality monitoring and reporting systems
- Falsification of measurement data, which delays detection of a real problem
- Attacks on billing and customer systems, exposing personal data
NIS 2 requirements for the drinking water sector
Mandatory measures:
- Inventory and classification of critical IT and OT assets
- Security policies approved at management level, with explicit responsibilities
- Network segmentation and separation of OT and IT communication channels
- Traffic monitoring and anomaly detection (IDS/IPS)
- Access control and multi-factor authentication, including for remote supplier access
- Incident response and business continuity plans, tested annually
- Cybersecurity training for operations and maintenance teams
- External security audits and attack simulations
- Monitoring of equipment and IT service suppliers
Critical interdependencies
- Total dependency on electricity supply for pumping and treatment
- Direct links with waste water infrastructure and with urban networks
- Immediate impact on the health system in the event of contamination
- Dependency on communications networks for telemetry and regulatory reporting
Securing drinking water systems is ultimately a public health measure. NIS 2 requires operators to approach cyber risk proactively, and for a service that cannot be interrupted, the ability to operate safely without automated systems remains as important as protecting them.
The other sectors in this series
The NIS 2 Directive covers eleven sectors of high criticality. Each has its own essential entities, specific threats and mandatory measures.