Compliance

What is compliance?

Compliance is demonstrably meeting legal, normative and contractual obligations, such as cybersecurity laws, privacy rules, product regulation and agreements with customers and suppliers. In OT and ICS environments, compliance reaches beyond information security alone: it also touches process safety, product safety and quality. Compliance therefore covers both technical measures and process and organisational requirements, and above all the evidence that those measures work.

The aim of compliance is to keep risks manageable, make security demonstrable and meet regulations such as NIS2, the Dutch Cyberbeveiligingswet, the AVG and standards such as IEC 62443 and ISO 27001.

🧠 What does compliance cover?

Compliance obligations come from three sources:

• Legislation - mandatory and enforced by a regulator, such as the Dutch Cyberbeveiligingswet, the Wwke, the AVG and EU product legislation such as the Cyber Resilience Act. Outside Europe there is, for example, FISMA, which applies only to US federal government agencies.
• Standards and frameworks - voluntary, but often the route to meeting a law: ISO 27001 as an ISMS, IEC 62443 for cybersecurity of industrial systems, NIST CSF and NIST SP 800-53 as US frameworks, and COBIT for governance of IT processes.
• Contractual obligations - supplier terms (for example with an MSSP or hosting partner), SLAs with security requirements and audit rights, and requirements passed down by customers who fall under NIS2 themselves.

A comparative overview of CSIR, ISO 27001, IEC 62443 and the BIO can be found in Security Standards.

📜 Which laws are relevant for OT in the Netherlands?

Since 2024 the number of European laws affecting OT has grown sharply. Some apply to the user of installations, others to the manufacturer of products.

The fines are substantial: under the Cyberbeveiligingswet up to 10 million euros or 2% of worldwide annual turnover for essential entities, under the Cyber Resilience Act up to 15 million euros or 2.5%, and under the AVG up to 20 million euros or 4%.

📏 Which standards do you use to demonstrate compliance?

Laws often say what you must achieve but not how. Standards fill that gap and provide recognisable evidence for regulators and customers.

ISO 27001 certificates against the 2013 edition have no longer been valid since 31 October 2025, so references to old Annex A numbers such as A.9 or A.17 are outdated.

🔄 What is the difference between compliance and security?

Compliance and security overlap but are not the same. Security is about actually reducing risk; compliance is about demonstrating that you meet defined requirements. An organisation can hold a certificate and still be vulnerable, for example when the OT environment fell outside the scope of the audit.

Good compliance therefore follows from good security, not the other way round. Laws such as the Cyberbeveiligingswet reflect this: the duty of care requires appropriate measures based on risk management, not a fixed checklist.

🔐 What does compliance look like in OT environments?

In OT, compliance is often not purely IT-driven, but also part of operational and production-related responsibilities. Process safety, machine safety and cybersecurity come together in the same installation.

🛠️ How do you build a compliance programme?

A compliance programme follows the PDCA cycle. In practice this sequence works well:

1. Inventory your obligations - determine which laws, standards and contracts apply to you. Check with the NCSC whether you fall under the Cyberbeveiligingswet and, if so, register in the entity register.
2. Map the OT environment - without an asset inventory you do not know what you need to protect or demonstrate.
3. Carry out a gap analysis - compare the current situation with the requirements, for example using a maturity model or the requirements of IEC 62443-2-1.
4. Assess risks - a risk assessment and business impact analysis determine which gaps to close first. Record them in a risk register.
5. Implement controls - technical (segmentation, access, monitoring) and organisational (policy, roles, training).
6. Collect evidence - policies, configurations, logs, test results and training records. What is not recorded does not exist for an auditor.
7. Review and improve - internal and external audits, logging and reporting to the board, followed by corrective actions.

✅ What does compliance deliver, and what does non-compliance cost?

Benefits of compliance:

• Reduced legal risk and fines
• Better collaboration with suppliers and customers through demonstrable security
• Structure and repeatability in processes and policy
• Trust from customers, partners and regulators

Risks of non-compliance:

• Fines and penalty payments; under the Cyberbeveiligingswet directors can also be held personally accountable
• Loss of certification (ISO, GxP and the like) or of market access without valid CE marking
• Exclusion from tenders or contracts
• Undetected vulnerabilities due to missing policy or oversight

❓ Frequently asked questions

Who is responsible for compliance in an organisation?

Ultimate responsibility for compliance lies with the board; the Cyberbeveiligingswet even requires directors to approve cybersecurity measures and to have knowledge of them. Execution often lies with a compliance officer or CISO, together with OT engineers and the owner of the installation. In OT in particular, that responsibility must be assigned explicitly.

Is IEC 62443 mandatory?

IEC 62443 is not legally mandatory as a standard. In practice, however, IEC 62443 is the most widely used route for demonstrating that your OT meets the duty of care under the Cyberbeveiligingswet, and its product parts IEC 62443-4-1 and -4-2 align closely with the requirements of the Cyber Resilience Act. Customers and insurers also increasingly ask for it.

Are you compliant if you are ISO 27001 certified?

An ISO 27001 certificate proves that your information security management system works within the certified scope. It does not automatically cover all legal requirements, and the OT environment is often not included. Check the scope and supplement it with OT-specific requirements from IEC 62443.

What is the difference between the Cyberbeveiligingswet and the Cyber Resilience Act?

The Cyberbeveiligingswet targets organisations that provide essential or important services and must secure their networks. The Cyber Resilience Act targets manufacturers of products with digital elements, such as PLCs, routers and software. A machine builder can therefore fall under the CRA while its customer falls under the Cyberbeveiligingswet.

How often should you carry out a compliance audit?

For ISO 27001, an external surveillance audit takes place every year, with recertification every three years. Internal audits and the management review follow at least an annual cycle. Regulators under the Cyberbeveiligingswet can also request information or carry out an inspection at any time.

Does the AVG also apply to OT systems?

The AVG (GDPR) applies to OT systems as soon as they process personal data, such as camera footage, access badges, operator login logs or vehicle location data. A data breach involving such data must be reported to the Dutch Data Protection Authority within 72 hours, unless it is unlikely to pose a risk to the people concerned. OT therefore belongs in the record of processing activities as well.

📌 In summary

Compliance means demonstrably meeting laws and regulations, standards and contractual requirements for information security, privacy and safety, including in the OT environment. With the Cyberbeveiligingswet, the Wwke and the Cyber Resilience Act, compliance for OT has become a board-level matter. It is an integral part of effective Risk Management and Cybersecurity Governance, and only works when it rests on real security.