NIS Directive One Year Later: Is It Enough to Secure Critical Infrastructure?

In the past, national infrastructure systems—power grids, water supplies, public transportation networks, and healthcare systems—were physically isolated, running on bespoke systems with minimal connectivity. These Operational Technology (OT) environments were once considered inherently secure due to their separation from the internet. But as the world has increasingly digitized, the boundary between IT (Information Technology) and OT has blurred. Critical infrastructure is now more connected, accessible, and exposed than ever before.

With this interconnectedness comes heightened risk. Sophisticated attackers, whether criminal groups, state-sponsored actors, or opportunists, are now targeting systems that were never designed to defend against external threats. The scale and severity of attacks against infrastructure have grown. The notorious WannaCry ransomware disrupted hospitals and businesses in over 150 countries. The attack on Ukraine’s electricity network plunged large regions into darkness. Norsk Hydro, a major aluminum producer, was crippled for weeks by a ransomware campaign that cost tens of millions in damages.

The message is clear: critical infrastructure is under siege, and its defense is a matter of national security.

Why legislative action was necessary

Faced with the growing number of attacks and the increasing complexity of OT environments, policymakers realized that traditional voluntary cybersecurity measures were no longer sufficient. There was a pressing need for a legislative framework that compelled essential service providers to take cybersecurity seriously.

The Network and Information Systems (NIS) Directive was the first EU-wide piece of legislation focused specifically on improving cybersecurity across essential services and digital service providers. Its objective was to elevate the baseline level of cybersecurity preparedness for systems that underpin society.

In the UK, the directive came into effect in May 2018, placing new legal obligations on a wide range of sectors—including energy, water, transportation, healthcare, and digital infrastructure. It aimed to instill a culture of risk management, robust reporting, and continuous improvement.

The directive’s core objectives and scope

At its core, the NIS Directive is built around several key pillars:

Improving national cybersecurity capabilities
Increasing cooperation between EU member states
Enhancing security measures among operators of essential services (OESs)
Ensuring digital service providers (DSPs) adopt appropriate security controls

The organizations falling under its scope must not only secure their own networks and systems but must also ensure that their suppliers and partners meet comparable standards. This is especially significant in an era when supply chain attacks are on the rise.

A fundamental part of the directive is incident reporting. Organizations are required to notify relevant authorities of any significant security incident. This allows for a coordinated response and a better understanding of threats at the national level. In the UK, the National Cyber Security Centre (NCSC) plays a central role in supporting compliance, offering guidance, and serving as the country’s Computer Security Incident Response Team (CSIRT).

Embracing a principle-based approach

One of the distinguishing characteristics of the NIS Directive is its reliance on a principle-based, rather than prescriptive, approach. This means it does not dictate specific technologies or procedures. Instead, it focuses on desired outcomes, allowing organizations to determine the most appropriate methods for achieving security objectives.

This flexibility is intentional. Organizations differ widely in size, complexity, and risk profiles. What works for a national utility provider may not be suitable for a regional water authority or a digital platform. By allowing each entity to tailor its cybersecurity practices to its specific needs, the directive promotes innovation and practicality.

This approach also supports the integration of cybersecurity into everyday business processes. Rather than being treated as a compliance checkbox or IT responsibility, security becomes embedded into the culture and operations of the organization. The emphasis is on proactive risk management, continuous improvement, and accountability.

Understanding the operational challenges

Despite its intentions, the implementation of the NIS Directive has not been without challenges. For many organizations, particularly those in the OT space, cybersecurity is not a native function. These systems were designed decades ago, often with proprietary hardware and software, and with safety and reliability—not security—as the primary concern.

Retrofitting cybersecurity into these environments is neither simple nor cheap. Legacy systems often lack the processing power to support modern security tools. In some cases, simply applying a patch or update can result in downtime, risking service interruption. For organizations operating under tight budgets and critical uptime requirements, this creates a significant dilemma.

Additionally, the convergence of IT and OT has created new complexities. Traditionally separate teams—each with different priorities, expertise, and cultures—must now collaborate closely. IT teams are accustomed to rapid updates and centralized control, while OT teams prioritize stability, safety, and long-term operability. Bridging these gaps requires not just technical solutions, but also organizational change.

Measuring success: has it worked?

A year after implementation, has the NIS Directive lived up to its promises? There’s no simple answer. On one hand, it has clearly raised awareness. Organizations that previously overlooked cybersecurity as an operational issue have begun investing in security strategies, staff training, and risk assessments. Incident reporting has improved, and there is now greater collaboration between government agencies and critical sectors.

However, progress has been uneven. Some sectors and organizations have embraced the directive and made significant improvements. Others, especially smaller or resource-constrained entities, are still struggling to meet the basic requirements. In many cases, the directive has exposed just how far behind some parts of the infrastructure landscape remain.

One of the key insights to emerge is that compliance does not equal security. An organization may technically meet the requirements of the directive while still being vulnerable to sophisticated attacks. Strong cybersecurity demands more than minimum standards—it requires commitment, resources, and a culture of continuous vigilance.

The continuing threat of cyber exposure

The concept of cyber exposure—understanding and managing the full extent of an organization’s digital risks—has become a central theme in the post-NIS era. To reduce exposure, organizations must first gain visibility. That means knowing what assets exist, where they are, how they’re configured, and what vulnerabilities they carry.

This is particularly challenging in OT environments, where visibility tools are often lacking or difficult to deploy. Without accurate asset inventories and real-time monitoring, organizations are essentially flying blind. They can’t defend what they don’t know they have.

Moreover, the threat landscape continues to evolve. Attackers are becoming more sophisticated, leveraging automation, AI, and global infrastructure to probe for weaknesses. The proliferation of ransomware, supply chain attacks, and zero-day exploits means that reactive security is no longer sufficient.

Building long-term resilience

Improving cybersecurity in critical infrastructure is not a one-year project. It’s a long-term journey that requires sustained effort, investment, and adaptation. The NIS Directive is a strong starting point, but it must be supported by a broader commitment to resilience.

This includes:

Investing in workforce development to address cybersecurity skills gaps
Enhancing threat intelligence sharing across sectors
Promoting research and innovation in OT security
Embedding security in system design and procurement processes
Ensuring leadership buy-in at the executive and board levels

Cybersecurity is no longer just an IT problem—it is a business risk, a safety issue, and a national concern. Every layer of an organization, from frontline staff to senior management, must be engaged in the effort.

The road ahead for regulators and industry

Going forward, regulators will likely adopt a more active stance in enforcing and refining the directive. This may include clearer guidance, sector-specific benchmarks, and stronger oversight. At the same time, they must remain flexible enough to accommodate technological changes and sector-specific nuances.

Industry leaders, meanwhile, have a responsibility to move beyond compliance. They must treat the directive not as a box to tick but as a foundation to build a comprehensive cybersecurity strategy. This includes embracing best practices, adopting new technologies, and fostering a culture that values security as much as performance.

Cross-sector collaboration will be essential. The threats facing one sector today could easily migrate to another tomorrow. Sharing insights, experiences, and solutions across industries can accelerate progress and strengthen collective defenses.

A milestone, not a destination

The implementation of the NIS Directive marked a significant milestone in the evolution of cybersecurity policy. It was a clear signal that governments are taking the protection of essential services seriously and that cybersecurity is now a legal obligation—not just a technical recommendation.

But legislation alone cannot protect critical infrastructure. The NIS Directive has helped raise the bar, but it is up to individual organizations to take the next steps. By embracing the principles of risk management, continuous improvement, and shared responsibility, the industry can build a more secure, resilient future.

Cyber threats are not going away. In fact, they are accelerating. The question now is not whether NIS was enough, but whether we are willing to go further—faster—and with greater determination. The resilience of our critical infrastructure depends on it.

Strengthening Security Beyond Compliance

One year after the NIS Directive became law in the UK, many organizations have made strides toward compliance. Yet the real question remains: has this regulatory framework fundamentally changed how essential services approach cybersecurity—or has it simply introduced another checkbox exercise?

Compliance is a starting point, not the finish line. While the directive lays a foundation, the dynamic nature of cyber threats demands continuous improvement. Attackers do not pause or follow rules, and threat vectors evolve faster than regulations. That’s why true security lies beyond legal requirements—in proactive risk management, visibility, and an ingrained security culture.

The NIS Directive forced a reckoning. Organizations now face the challenge of maturing their cybersecurity posture not just to avoid fines, but to genuinely reduce risk.

From Awareness to Action: Cultural Change in Critical Sectors

Perhaps the greatest achievement of the NIS Directive so far has been the heightened awareness of cybersecurity within essential sectors. Leadership teams in energy, health, water, and transport have begun to see cyber threats not only as IT issues but as business-critical risks.

Before the directive, cybersecurity decisions often rested solely with IT teams. Now, risk committees, boards of directors, and chief executives are engaging in discussions about digital exposure, incident response, and supply chain security. This cultural shift has made cybersecurity a boardroom priority.

However, turning awareness into effective action is still a challenge. Many organizations acknowledge the risks but remain paralyzed by complexity, budget limitations, or a lack of skilled personnel. Others have begun initiatives but struggle to maintain momentum. Changing a culture is not an overnight process—it requires sustained leadership, clear communication, and a shared understanding of goals.

Cyber Hygiene: A Persistent Weakness

Despite advances, basic cybersecurity practices—or cyber hygiene—remain inconsistent across critical infrastructure sectors. Poor password management, unpatched systems, lack of asset inventories, and weak authentication mechanisms still plague OT environments.

Many of these environments are running legacy systems that can’t be updated without significant disruption. As a result, vulnerabilities linger. Some OT systems lack even the most fundamental protections, like secure remote access, encryption, or proper segmentation from IT networks.

This isn’t just a technical issue. Often, it’s the result of organizational inertia, where security recommendations are sidelined in favor of operational continuity. For example, an IT team might identify a vulnerability in a SCADA system, but the OT team may delay patching because it requires downtime—and downtime risks service disruption.

What’s needed is a balanced approach. Organizations must prioritize security without compromising the reliability of essential services. That balance requires collaboration between IT and OT teams, as well as executive support for long-term investments in resilience.

The IT-OT Convergence Dilemma

One of the most pressing consequences of digital transformation is the growing convergence of IT and OT systems. This convergence increases efficiency, improves data insights, and enables remote monitoring. But it also brings traditional cyber threats into physical environments.

Previously isolated industrial control systems (ICS) are now accessible from enterprise networks—or worse, the internet. That accessibility makes them targets. Malware designed for office systems can now traverse networks and infect devices that control turbines, pumps, and medical equipment.

The SolarWinds supply chain breach showed how attackers can infiltrate trusted software to compromise multiple organizations. If similar tactics are used to infiltrate OT environments, the consequences could be devastating—from blackouts and contaminated water supplies to halted public transit.

This convergence means organizations can no longer treat IT and OT as separate silos. They need unified cybersecurity strategies, shared risk models, and integrated threat monitoring. It also requires security solutions tailored to the unique constraints of industrial systems—lightweight, non-intrusive, and designed for 24/7 uptime.

Gaining Full Visibility: The First Step Toward Control

To protect what matters most, organizations must first know what they have. Yet many lack complete visibility into their assets. In OT environments especially, asset inventories are often out of date or incomplete. Without clear knowledge of devices, software versions, and configurations, security teams cannot assess risk accurately.

Modern cybersecurity requires continuous monitoring. Real-time visibility into asset status, network traffic, and behavioral anomalies helps identify threats early—before they escalate into full-blown incidents.

This visibility also enables organizations to prioritize risk. Not all vulnerabilities are equal. A flaw in a critical system exposed to the internet is far more urgent than one buried deep in an isolated segment. Contextual risk analysis allows for smarter decision-making and more efficient resource allocation.

Tools such as vulnerability scanners, passive network sensors, and behavioral analytics can aid in this effort. But technology alone isn’t enough. Organizations need well-defined processes, skilled analysts, and governance frameworks to act on the data they collect.

Supply Chain Security: The Weakest Link

As organizations improve their own cybersecurity posture, attention is turning toward third-party risk. Critical infrastructure relies on complex supply chains involving vendors, contractors, and technology partners. Each of these relationships introduces potential vulnerabilities.

The NIS Directive requires organizations to ensure their suppliers adopt appropriate security measures. But enforcing this requirement is difficult. Smaller vendors may lack the resources for robust security programs. Others may be unwilling to disclose details of their systems due to intellectual property concerns.

Despite these challenges, supply chain security cannot be ignored. Compromising a trusted partner is one of the most effective ways for attackers to infiltrate high-value targets. To reduce this risk, organizations must adopt supply chain assurance programs—vetting vendors, requiring security certifications, and conducting audits where feasible.

Zero trust principles—where no user or system is automatically trusted—can also help. By enforcing strict access controls, network segmentation, and continuous authentication, organizations can limit the blast radius of a supply chain breach.

The Cost of Inaction

Failing to implement strong cybersecurity controls is no longer just a regulatory concern—it’s a financial and reputational threat. The costs of cyber incidents are rising. In critical infrastructure sectors, a single breach can disrupt essential services, impact millions of people, and lead to significant fines and litigation.

Beyond direct financial losses, organizations face long-term consequences. Loss of public trust, regulatory scrutiny, and damage to brand reputation can be difficult to recover from. In the healthcare sector, for instance, a ransomware attack that delays patient care can erode confidence in the entire system.

These costs highlight the importance of not just meeting compliance standards, but exceeding them. Cybersecurity investments should be seen not as overhead, but as risk mitigation—essential for business continuity and public safety.

Building a Resilient Cybersecurity Framework

To move beyond reactive security, organizations must adopt a holistic cybersecurity framework. This framework should encompass people, processes, and technology—and be tailored to the unique needs of each sector.

Key components include:

Risk-based assessment: Prioritize security controls based on the value and exposure of assets.
Incident response planning: Develop and test plans for detecting, containing, and recovering from cyber events.
Security training: Equip employees with the knowledge to recognize and respond to threats.
Governance and accountability: Establish clear roles, responsibilities, and oversight mechanisms.
Continuous improvement: Regularly review and adapt security policies in light of evolving threats.

Frameworks such as the NIST Cybersecurity Framework or ISO/IEC 27001 can provide guidance. However, implementation must be practical, flexible, and integrated with operational objectives.

Government’s Role in Enhancing Cybersecurity

While organizations bear the responsibility of implementing cybersecurity, governments also play a crucial role. Beyond legislation, public agencies must provide support, intelligence, and coordination.

The National Cyber Security Centre (NCSC), for example, offers threat intelligence, best practices, and incident response guidance. Collaboration between public and private sectors helps ensure a more unified and informed approach to defense.

Regulators can also drive improvement by offering clear expectations, sector-specific guidance, and measured enforcement. Instead of punitive action alone, a supportive regulatory environment encourages organizations to report issues, learn from failures, and continuously improve.

Public investment in research, workforce development, and cybersecurity innovation can also raise the national baseline of resilience.

Evolving the NIS Directive

As cyber threats grow more sophisticated, the NIS Directive will need to evolve. In fact, discussions about NIS 2.0 are already underway at the European level, aiming to address the gaps identified during the first year of implementation.

Proposed updates include:

Expanding the scope to include more sectors and digital service providers
Imposing stricter supervision and enforcement requirements
Enhancing cooperation between member states
Introducing more detailed incident reporting timelines

These enhancements recognize that cybersecurity is not static. As technology evolves, so too must the legal and operational frameworks that govern its protection.

One year into its implementation, the NIS Directive has sparked a necessary and overdue conversation about the security of our most essential services. It has driven organizations to reevaluate their vulnerabilities, strengthen their controls, and take cybersecurity more seriously.

But the journey is far from over. Compliance is just the beginning. To truly protect critical infrastructure, organizations must adopt a proactive, integrated, and resilient approach to security—one that extends beyond legal obligations to reflect the realities of today’s threat landscape.

The NIS Directive was a wake-up call. What comes next will determine whether that call leads to lasting change—or merely a momentary reaction. In the next phase, building trust, improving transparency, and fostering collaboration will be vital to creating a secure digital society for all.

Toward a Resilient Future: Expanding the Impact of the NIS Directive

As the dust settles on the first full year of the NIS Directive’s implementation in the UK, organizations and regulators alike are reflecting on its effectiveness. While the directive has laid foundational groundwork in raising cybersecurity standards across essential services, the real test lies ahead—scaling maturity, closing gaps, and ensuring resilience in an ever-changing threat landscape.

The challenges facing critical infrastructure remain complex. Cybercriminals are becoming more strategic, state-sponsored threats are rising, and vulnerabilities are emerging faster than organizations can address them. To keep pace, both the NIS Directive and the sectors it governs must evolve.

This final part of the series explores the path forward—how organizations can build resilience beyond compliance, what updates are expected in the NIS framework, and how collaborative efforts can enhance security across the board.

Evaluating Maturity Across Sectors

Critical infrastructure sectors have approached NIS compliance at varying speeds and with differing levels of success. Energy and finance organizations, which traditionally operate under strict regulatory oversight, have made the most progress. Their cybersecurity strategies are more mature, and they often have dedicated security teams and resources.

In contrast, smaller operators in water, transportation, and healthcare face more significant challenges. Many lack dedicated security teams, operate on tight budgets, and depend on legacy systems that are difficult to secure. In some cases, organizations are still struggling with foundational tasks—asset inventory, network segmentation, and patch management.

This disparity in maturity has led to inconsistent protection across the infrastructure landscape. While some organizations have implemented advanced threat detection and response systems, others remain vulnerable to even basic cyberattacks. A more unified and scalable approach is needed to bring lagging sectors up to speed.

NIS 2: The Next Phase of Cyber Regulation

To address these challenges, the European Union has introduced the NIS 2 Directive, a more comprehensive update aimed at strengthening cybersecurity across all member states. NIS 2 builds on the lessons learned from the original directive and seeks to harmonize and elevate cybersecurity practices.

Some of the major proposed changes include:

Broader scope: NIS 2 will expand its reach to include medium and large organizations in more sectors, such as postal services, waste management, and food supply.
Tougher enforcement: The new directive introduces stricter supervision measures, including mandatory audits and on-site inspections.
Clearer accountability: NIS 2 emphasizes board-level responsibility for cybersecurity, holding leadership accountable for implementation and oversight.
Stronger incident reporting: New deadlines require organizations to notify authorities of major incidents within 24 hours and provide updates as more information becomes available.

These changes aim to create a level playing field across the EU and ensure that all critical entities meet minimum security standards. In the UK, while Brexit has altered regulatory alignment, similar updates are expected to mirror or respond to NIS 2’s recommendations.

Resilience Is More Than Technology

It’s tempting to think of cybersecurity as purely a technological problem—deploy firewalls, install endpoint detection, patch vulnerabilities. While these tools are critical, true resilience involves much more than a stack of security software.

Resilience means preparing for the inevitable. Even the most secure organizations can be breached. What matters is how quickly they detect, contain, and recover from incidents.

This requires:

Crisis communication plans: Ensuring employees and stakeholders know how to respond in the event of an attack.
Incident response teams: Assembling skilled professionals ready to act immediately when a threat is detected.
Backup and recovery: Regularly testing backups to ensure that critical systems and data can be restored quickly.
Cyber insurance: Evaluating insurance policies to cover the financial impact of breaches or disruptions.

Resilience is a mindset. It means accepting that perfection is unattainable, but preparation is essential. Organizations that build muscle memory through tabletop exercises, red teaming, and simulated attacks are far better positioned to withstand real-world threats.

The Role of Cybersecurity Education

A major barrier to cybersecurity advancement in many sectors is the lack of skilled professionals. The cybersecurity workforce shortage is well documented, and critical infrastructure sectors often struggle to attract and retain talent.

Addressing this requires a multi-pronged strategy:

Workforce development: Governments and private organizations should invest in training programs, apprenticeships, and certifications focused on OT security.
Cross-training: IT professionals should be given opportunities to learn about OT systems, and vice versa. This helps bridge the knowledge gap between the two disciplines.
Awareness campaigns: Every employee—from front-line operators to senior executives—should understand their role in protecting the organization from cyber threats.

Security is everyone’s responsibility. A well-informed workforce is one of the most effective defenses against phishing, insider threats, and misconfigurations.

Enhancing Public-Private Partnerships

No single organization can tackle cybersecurity alone. The complexity and interconnectedness of modern infrastructure require collaboration across sectors, industries, and borders.

Governments have a vital role to play in this collaboration:

Threat intelligence sharing: Agencies like the National Cyber Security Centre (NCSC) can help critical infrastructure providers stay ahead of emerging threats by sharing real-time intelligence and guidance.
Joint response frameworks: Coordinated response plans between public and private entities can ensure rapid, cohesive action in the event of widespread incidents.
Standard-setting: Regulators can develop frameworks that balance flexibility with accountability, allowing innovation while ensuring minimum standards.

At the same time, the private sector must be willing to engage openly. This means sharing lessons learned from incidents, disclosing vulnerabilities responsibly, and contributing to collective efforts to secure the digital ecosystem.

Emerging Technologies: Risk and Opportunity

As organizations modernize their operations, they are increasingly adopting emerging technologies like artificial intelligence (AI), cloud computing, and the Internet of Things (IoT). While these innovations offer substantial benefits, they also introduce new cybersecurity challenges.

AI and automation: These tools can enhance threat detection and incident response, but they must be deployed securely and with safeguards to prevent misuse.
Cloud infrastructure: Moving critical services to the cloud increases scalability and availability but requires robust access control, encryption, and configuration management.
IoT and smart devices: Many OT environments are integrating sensors and smart devices that lack sufficient security features, creating new attack surfaces.

Organizations must adopt a secure-by-design approach. This means embedding security into every stage of the technology lifecycle—from procurement and development to deployment and maintenance.

The Economic Impact of Strong Cybersecurity

Investing in cybersecurity often requires significant resources. However, the cost of inaction is far greater. A single cyber incident can result in millions in lost revenue, regulatory penalties, legal fees, and reputational damage.

Beyond cost avoidance, strong cybersecurity can become a competitive advantage. Organizations that demonstrate robust security practices are more likely to attract customers, win contracts, and secure partnerships—especially in sectors where trust is paramount.

Cybersecurity also contributes to economic stability. Secure infrastructure enables uninterrupted services, protects jobs, and fosters innovation. In a digital economy, security is not a barrier—it is a catalyst for growth.

Recommendations for the Road Ahead

For organizations seeking to build on the foundation laid by the NIS Directive, the following actions are recommended:

Conduct a full cyber risk assessment: Identify critical assets, evaluate threats, and understand business impacts.
Update and test incident response plans: Ensure readiness for various scenarios, including ransomware, insider threats, and third-party breaches.
Improve asset visibility: Deploy tools to monitor and map the full digital landscape, including shadow IT and legacy systems.
Invest in training and awareness: Build a security-first culture through continuous education.
Engage with industry peers: Join sector-specific forums and partnerships to stay informed and aligned with best practices.
Track evolving regulations: Monitor updates to the NIS Directive and related national policies to stay compliant and future-ready.

Final Reflection:

The NIS Directive represents a pivotal step in redefining how essential services approach cybersecurity. It has brought structure to what was once a fragmented and inconsistent landscape, compelling organizations to think more strategically about their digital defenses.

But cybersecurity is not static. New threats will emerge, technologies will evolve, and attackers will adapt. The directive alone is not a solution—it is a framework. It provides a foundation upon which resilient, adaptive, and intelligent cybersecurity strategies can be built.

The work is far from done. But with continued collaboration, investment, and leadership, the promise of a secure digital future can become reality—not just for critical infrastructure, but for society as a whole.