Incident Reporting in OT: Playbooks That Meet NIS2 Deadlines

Under the NIS2 Directive, incidents must be reported to national authorities within 24 hours of detection. For IT teams, this is challenging — for OT environments, it’s even harder. Systems can’t be taken offline for forensics, and visibility is often limited.

The Three-Step Reporting Model

1. Initial Notification (24h): Summary of what’s known — affected systems, estimated impact, containment actions.
2. Intermediate Report (72h): Updates on root cause, mitigation progress, and recovery status.
3. Final Report (30 days): Full technical analysis and lessons learned.

OT Challenges

• Legacy PLCs lack logging or encryption.
• Limited intrusion detection on Layer 2 protocols (Modbus, Profinet).
• Difficulty distinguishing between malfunction and attack.

Building the OT Playbook

Effective playbooks define who, what, and when. Each factory should have:

• A named OT incident coordinator.
• Predefined contact lists for national CSIRTs.
• Automated alert forwarding from OT monitoring tools.
• Templates for 24h and 72h reports.

Example: Food Processing Plant

After a ransomware attack on a packaging line HMI, a food manufacturer met NIS2 deadlines by using a hybrid IT/OT SOC. Incident logs were correlated from firewalls and historian systems within hours.

Related Articles

• NIS2 for Plant Managers: What You Must Do Before Your Next Audit
• From Policy to PLC: Mapping NIS2 Controls to the Factory
• Supplier Risk in the OT World: Contracts, SBOMs, and Patching

Conclusion

NIS2 compliance isn’t only about technology — it’s about readiness. An OT incident playbook ensures your factory can respond fast, contain impact, and communicate clearly under pressure.