OT Governance Radar

For OT GRC leads, CISOs and consultants

OT/ICS security regulation, tracked weekly.

What changed, who it applies to, the deadlines, and which IEC 62443 controls are affected — across NIS2, the Cyber Resilience Act, NERC CIP, TSA directives, UK NIS and more. Every claim links to its source.

Get the weekly briefing NIS2 country tracker →

24/27EU states with NIS2 law (ECSO)
34countries tracked
10regulations & standards
30CISA ICS advisories indexed

Latest changes

RSS
  1. UK NIS / CS&R Bill

    Lords report stage complete

    Peers agreed amendments requiring a review of the NIS regime within 12 months and a register of state actors; a frontier-AI incident reporting amendment was defeated. Third reading 2 Nov 2026.

    Source: parliament.uk source-checked

  2. NIS2 PL

    Poland: Self-registration window in Wykaz KSC closed

    Poland NIS2 update — see the country obligations page.

    Source: gov.pl source-checked

  3. NIS2 AT

    Austria: NISG 2026 applies; USP registration window opens

    Austria NIS2 update — see the country obligations page.

    Source: bundesamt-cybersicherheit.gv.at source-checked

  4. CIRCIA

    CIRCIA final rule at OIRA

    Reported submission of the final rule for OMB review; no publication date yet. Verify against reginfo.gov.

    Source: insideprivacy.com needs verification

  5. CRA

    CRA reporting obligations now apply

    Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform.

    Source: enisa.europa.eu source-checked

  6. NIS2

    ECSO NIS2 tracker updated – 24 of 27 Member States transposed

    ECSO counts primary laws; France, Ireland and Spain still listed as draft law.

    Source: ecs-org.eu source-checked

  7. NIS2 NL

    Netherlands: Cyberbeveiligingswet in force; registration on MijnNCSC mandatory

    Netherlands NIS2 update — see the country obligations page.

    Source: ncsc.nl source-checked

  8. NERC CIP

    FERC approves CIP-015-2

    Extends INSM requirements; effective 1 Oct 2029 per NERC.

    Source: nerc.com source-checked

What we track

Regulations index →
EU

NIS2

In force; national transposition largely complete, 4 Member States referred to CJEU

 EU

CRA

In force; reporting obligations apply since 11 Sep 2026; main obligations from 11 Dec 2027

 International standard

IEC 62443

Published; parts revised on a rolling basis

 US / Canada (FERC-approved, NERC-enforced)

NERC CIP

Multiple standards in force; several revisions subject to future enforcement

 United Kingdom

UK NIS / CS&R Bill

NIS Regulations 2018 in force; CS&R Bill at Lords third reading (scheduled 2 Nov 2026)

 United States

TSA SDs

SD Pipeline-2021-02G and SD 1580/82-2022-01E in force 3 May 2026 – 2 May 2027; final rule TBD

 United States

CIRCIA

Final rule under OMB/OIRA review (submitted 1 Oct 2026); reporting not yet mandatory

 Australia

SOCI

In force; annual CIRMP reporting cycle

 EU

CER

Transposition deadline passed 17 Oct 2024; infringement procedures opened Nov 2024

 EU

Machinery Reg.

Adopted; applies from 20 Jan 2027 (needs verification)