Energy

In energy, security of supply is not an internal target but a matter of public interest. An outage is therefore not handled as one company's operational incident — the regulator and the public follow it, and the question "what happened and who approved it" comes before operations are back to normal.

Which regimes usually concern you

• Cybersecurity (NIS2). Directive (EU) 2022/2555 lists the sectors of high criticality in its Annex I: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space. Where it applies, it does so through the national law of each Member State. Whether it covers you, and in which regime, depends on the service you provide, on your size and on the national rules — it cannot be inferred from the industry alone.

• ISO/IEC 27001. An information security management system covers a substantial part of the measures that cybersecurity rules ask for. A certificate is not the same thing as a working system; if you need one for a tender, it is issued by an accredited certification body, not by an adviser.

• GDPR. The focus is usually customer data and consumption metering — data that reveals more about a household than it seems at first sight.

• Cyber Resilience Act. Regulation (EU) 2024/2847 places requirements mainly on manufacturers of products with digital elements. For an energy company it matters above all when buying components for control systems and other connected equipment.

Operational technology is an open question

Audit scopes now often cover operational technology as well as information systems — substations, dispatch control and the systems that keep operations running. Such systems cannot be assessed with the same methods as office IT: active scanning can bring down a control element, and a shutdown for the sake of an audit costs more than the audit itself.

We mention this as a risk on your side, not a promise on ours. Whether and to what extent we assess operational technology ourselves is agreed case by case when the scope is set — for part of the environment we bring in a specialist in industrial control systems. Claiming more for these systems than we can evidence would serve neither us nor you.

We do not carry out penetration tests, threat-led or otherwise.

What we do for energy

We assess whether and how the rules apply to you, carry out a risk analysis with asset owners and linked measures, prepare the documentation and accompany you through the audit. When the scope is set, we say openly where our competence ends and where we would bring in a specialist — in this kind of environment that matters more than in office IT.