Energy is the most interconnected of all essential services: a fault at one point in the network cascades into transport, healthcare, water supply and communications. The digitalisation of generation, transmission and distribution has put SCADA systems and industrial automation equipment at the heart of operations, from national dispatch and substations to smart meters and control points inside power plants. A good share of these systems were designed for isolated networks and ended up connected to IT infrastructure without ever being built for a hostile environment.
To address these risks, Directive (EU) 2022/2555 (NIS 2) lists energy in Annex I, among the sectors of high criticality, and imposes firm obligations on risk analysis, technical and organisational measures, incident reporting and operational continuity. For energy operators, those requirements cover both the office IT networks and the industrial control systems that keep the grid in balance.
Legal framework
At European level:
- Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex
At national level (Romania):
- GEO no. 155/2024: Official Gazette no. 1332/2024
- Law no. 124/2025: Official Gazette no. 638/2025
- DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
- Order on disruption criteria and risk assessment: Official Gazette no. 776/2025
The Energy sector
Essential entities:
Electricity, district heating and cooling, oil, gas and hydrogen undertakings, including producers, transmission and distribution system operators, market operators and operators of recharging points.
- Transmission and distribution system operators
- Electricity producers, including renewable generation
- Operators of oil and gas transmission, storage and distribution infrastructure
- District heating and cooling operators
- Electricity market operators and nominated electricity market operators
Sector-specific cyber threats
- Unauthorised access to SCADA and industrial control systems
- Manipulation of protection and switching commands in substations
- Ransomware affecting dispatch, billing or metering systems
- Attacks on communications between control centres and field equipment
- Compromise of remote maintenance access held by equipment suppliers
- Theft of operational data on capacity, consumption and network topology
NIS 2 requirements for the energy sector
Mandatory measures:
- Inventory and classification of critical IT and OT assets
- Security policies approved at management level, with explicit responsibilities
- Network segmentation and separation of OT and IT communication channels
- Traffic monitoring and anomaly detection (IDS/IPS)
- Access control and multi-factor authentication, including for remote supplier access
- Incident response and business continuity plans, tested annually
- Cybersecurity training for operations and maintenance teams
- External security audits and attack simulations
- Monitoring of equipment and IT service suppliers
Critical interdependencies
- Direct dependency of transport, healthcare, water and communications on continuous supply
- Cascading effects across interconnected national grids
- Dependency on communications networks for telemetry and market reporting
- Reliance on a small number of specialised equipment and software suppliers
Securing energy infrastructure is a precondition for the security of every other essential service. NIS 2 requires operators to treat cyber risk proactively, and for a sector where a fault propagates in seconds, the ability to operate safely without automated systems matters as much as protecting them.
The other sectors in this series
The NIS 2 Directive covers eleven sectors of high criticality. Each has its own essential entities, specific threats and mandatory measures.