NIS2

In practice

In practice, NIS2 sets a new baseline for cybersecurity in the Norwegian energy sector that is higher than many companies have previously maintained. Specific requirements include: risk analyses and incident management plans, supply chain security (your suppliers), and mandatory reporting of security incidents within 24 hours (serious incidents) and 72 hours (notification). For IT systems, this means: access control based on the principle of least privilege, multi-factor authentication on all critical systems, separation of IT and OT, and regular penetration testing. NIS2 compliance is not primarily an IT problem - it is a management responsibility.

TvimenningOld Norse meaning 'two bound together' - one who solves a task shoulder to shoulder with another. is ISO 27001International standard for information security management systems - provides framework for protecting sensitive information. certified, the standard NIS2 itself builds its governance requirements on. For renewable energyEnergy from sources that renew naturally - wind, solar, hydropower and bioenergy - as opposed to fossil fuels. companies the other half of NIS2 is just as concrete: knowing what is actually out in the field. RUNATvimenning's component register for electrical installations - providing structure and traceability for the components installations are built from. keeps track of the physical assets, FRAMSYNTvimenning’s tool for condition-based maintenance: raises work orders from how the component is actually doing, not from how old it is. flags maintenance needs before something fails, and LEIDANGTvimenning’s closed, non-commercial marketplace where energy companies share preparedness resources between themselves - components such as transformers, cables and smart meters, and contact points for response crews. covers preparedness - lending and sharing components when an incident happens anyway. Together that is the data foundation a risk assessment and an incident report need to rest on.