What is critical infrastructure?
Critical infrastructure (also called vital infrastructure) is the set of facilities, systems and processes whose failure or disruption would seriously disrupt society, such as the supply of electricity, drinking water, transport, payments, telecommunications and healthcare. Behind almost every one of these services runs OT: SCADA systems, PLCs and RTUs that control pumping stations, substations, locks and pipelines. In the European Union its protection rests on two directives, NIS2 for cyber security and the CER Directive for physical and organisational resilience. In the Netherlands both have applied since 15 August 2026 through the Cybersecurity Act and the Wwke.
A failure of critical infrastructure does not hit one company but thousands to millions of people at once, and often other vital sectors through a domino effect that also endangers public health and safety.
🧱 Which sectors count as critical infrastructure?
The European CER Directive (EU 2022/2557) lists eleven sectors in which Member States must identify critical entities. The OT looks different in each:
| Sector | Examples of essential services | Typical OT |
|---|---|---|
| Energy | Electricity, gas, oil, heat | SCADA for grid operation, RTUs in substations, control of wind and solar farms |
| Transport | Rail, aviation, shipping, roads | Railway signalling, lock and bridge control, traffic control centres |
| Drinking water | Production and distribution | Pumps, treatment stages and reservoirs controlled remotely |
| Wastewater | Collection and treatment | Sewage pumping stations and treatment plants with PLCs and telemetry |
| Health | Hospitals, medicines supply chain | Building management, medical equipment, cooling and emergency power |
| Digital infrastructure | Internet exchanges, data centres, DNS | Cooling, power supply and building management of data centres |
| Banking | Payments, lending | Mostly IT; OT in data centres and cash logistics |
| Financial market infrastructure | Stock exchanges, clearing and settlement | Mostly IT; OT in cooling and power supply of computer centres |
| Public administration | Central government services | Building management, access security and emergency power for government buildings and data centres |
| Space | Ground stations | Control of ground-based infrastructure |
| Food | Production, processing, distribution | Process automation, cold chains |
The directive makes an exception for three of these sectors: critical entities in banking, financial market infrastructure and digital infrastructure are still identified, but the CER resilience duties, incident notification and supervision do not apply to them. For those sectors, NIS2 and the EU DORA regulation for the financial sector impose comparable obligations.
On 18 October 2024 CER replaced the 2008 European Critical Infrastructure Directive (2008/114/EC), which covered only energy and transport and focused on cross-border assets. In the Netherlands the Wwke succeeds the earlier Aanpak vitaal (vital infrastructure approach), in which the NCTV and the ministries mapped the country’s vital processes; the cyber security of vital providers had already been regulated since November 2018 by the Wbni, which the Cbw has now replaced. The Netherlands goes beyond the EU list and adds national sectors such as chemicals, nuclear facilities, flood defence and water management, and meteorology. The responsible ministers are expected to designate around 500 organisations as critical entities. For comparison, the United States works with sixteen sectors, which also include dams, chemicals and nuclear reactors.
🔐 Why is critical infrastructure a target for cyber attacks?
Through OT convergence, control systems that used to be isolated are now connected to office networks, suppliers and the internet. At the same time the impact of a successful attack is large, which makes the sector attractive to criminals and state actors (APTs) alike.
Typical risks are:
- Ransomware on IT - which stops operations through dependencies, even when the control system itself is untouched
- Sabotage of PLCs or RTUs - via insecure remote access or stolen VPN accounts
- Supply chain risk - via suppliers, integrators and maintenance contractors with access to the plant
- Controllers reachable from the internet - with default passwords or no authentication at all
- Manipulation of measurement data or process values - so that operators get a false picture
A number of incidents show how this plays out in practice:
| Incident | Year | What happened? |
|---|---|---|
| Stuxnet | discovered 2010 | Worm sabotaged uranium enrichment centrifuges at Natanz (Iran) via Siemens PLCs |
| Ukraine (BlackEnergy) | 2015 | Attackers remotely opened breakers at three distribution companies; around 225,000 customers lost power |
| Industroyer | 2016 | Malware that spoke grid protocols directly in a substation near Kyiv; part of the city lost power for about an hour |
| Colonial Pipeline | 2021 | Ransomware on IT; largest fuel pipeline in the US shut down as a precaution for six days |
| Volt Typhoon | 2024 (advisory) | Chinese state actor lay hidden for years in IT networks of US critical infrastructure to be able to reach OT later |
| Poland | 2025 | Sabotage of more than thirty wind and solar farms and a combined heat and power plant |
In the Volt Typhoon case, US agencies found that the actor had kept footholds in some networks for at least five years. The aim was pre-positioning: being ready to disrupt services in the event of a conflict.
🏛️ Which laws and standards apply in the EU and the Netherlands?
The legal framework consists of two European directives, each transposed into a Dutch law, supplemented by standards for the technical implementation.
| Framework | What is it about? | Status |
|---|---|---|
| NIS2 | Cyber security of essential and important entities in 18 sectors | EU directive, transposition deadline 17 October 2024 |
| Cybersecurity Act (Cbw) | Dutch implementation of NIS2: duty of care, incident reporting, registration | In force since 15 August 2026; replaced the Wbni |
| CER Directive | Physical and organisational resilience of critical entities | EU directive 2022/2557, transposition deadline 17 October 2024; Member States identify critical entities by 17 July 2026 |
| Wwke | Dutch implementation of CER | In force since 15 August 2026 |
| Cyber Resilience Act | Security requirements for products with digital elements, including OT components | Reporting since 11 September 2026, full application from 11 December 2027 |
| IEC 62443 | Series of standards for industrial automation security | Voluntary, but the de facto standard for OT |
| ISO 27001 | Information security management system | Voluntary, often used to demonstrate the duty of care |
| BIO | Information security baseline for Dutch government bodies | Mandatory for public organisations, such as water boards running their own pumping stations |
An organisation designated as a critical entity under the Wwke is always an essential entity under the Cbw, regardless of its size. A critical entity that provides the same or similar essential services in six or more Member States can qualify as a critical entity of particular European significance, in which case the European Commission can organise an advisory mission. See does your organisation fall under the Cbw? for the full test.
In the Netherlands the NCSC is the CSIRT for most vital sectors: it warns, advises and receives incident reports. Security supervision lies with sector regulators, such as the RDI (coordinating, including energy), the ILT (drinking water, wastewater, transport), the IGJ (healthcare) and DNB/AFM (financial sector). For the water boards, CERT-WM is the CSIRT.
🔄 What is the difference between the Wwke and the Cybersecurity Act?
Both laws took effect on the same day and complement each other. The Cbw covers network and information systems, including OT. The Wwke covers all hazards: natural disasters, sabotage, terrorism, supplier failure and insider risks.
| Aspect | Wwke (CER) | Cybersecurity Act (NIS2) |
|---|---|---|
| Focus | Physical and organisational resilience | Digital resilience |
| Who is covered? | Around 500 critical entities designated by the responsible minister | More than 8,000 organisations, based on sector and size |
| Designation | By a designation letter from the ministry, after entry into force | No designation; self-registration via MijnNCSC |
| Time to comply | Risk assessment within 9 months, measures within 10 months of designation | Immediately from 15 August 2026 |
| Reporting | Initial notification within 24 hours, detailed report within one month where relevant | Significant incidents: 24 hours, 72 hours, one month |
| Supervision | Competent authority: the ministry together with the supervisor | Sector regulators, coordinated by the RDI |
An attack on the SCADA system of a drinking water company can therefore be reportable under both laws. Under the Cbw, an incident in the drinking water sector is significant if, for example, 10,000 or more connections are without water for six hours or longer; the details are in incident reporting under the Cbw.
🧰 Which security measures matter most?
| Measure | Application in critical OT |
|---|---|
| Network segmentation | Separating IT and OT into zones and conduits according to IEC 62443 and the Purdue Model |
| Defense in Depth | Layered security: physical, network, system, application and organisation |
| Patch management | Addressing vulnerabilities based on risk, even where patching must wait for a shutdown |
| Security Monitoring | Passive network detection of anomalous OT traffic, often through an OT SOC |
| Access Control / RBAC | Least privilege, MFA for remote access, no shared accounts |
| Incident Response Plan | Playbooks that allow for manual operation and the reporting deadlines |
| Backup & Disaster Recovery | Offline backups of PLC programs, configurations and historian data |
| Supply Chain Management | Security requirements in contracts with suppliers and integrators |
🏭 How do you secure critical OT in practice?
For a grid operator, water utility or chemical site, a step-by-step approach is common:
- Determine your status - establish whether you fall under the Cbw and whether you have been designated as a critical entity under the Wwke, and register.
- Build an inventory - map all OT assets, connections and external access paths; without an up-to-date inventory, no risk analysis is possible.
- Determine impact - use a Business Impact Analysis to record which processes may be down for how long.
- Assess risks - carry out a risk assessment, for OT preferably following IEC 62443-3-2 with zones, conduits and target security levels.
- Basics first - segmentation, secure remote access, password management and taking controllers off the internet deliver the most risk reduction per euro.
- Detection and response - set up monitoring and rehearse incidents, including falling back to manual operation and reporting within 24 hours.
- Ensure continuity - embed the whole in continuity management and repeat the cycle every year or after major changes.
For the water sector, a worked-out version is in Water Sector OT Security; the US NIST SP 800-82 is a good complementary OT guide.
🔎 What distinguishes critical from non-critical infrastructure?
| Aspect | Critical infrastructure | Non-critical |
|---|---|---|
| Impact of failure | Major societal consequences, often across sectors | Limited or local |
| Legal requirements | Cbw as an essential entity, often the Wwke as well | At most the Cbw as an important entity, or nothing |
| Availability requirements | Very high (24/7, redundancy, emergency power) | Depending on business requirements |
| Threat profile | Also state actors and APTs | Mainly criminal and general threats |
| Supervision | Active, both proactive and reactive | Only reactive, after signals |
❓ Frequently asked questions
What is the difference between critical and vital infrastructure?
In the Netherlands, the terms vital infrastructure and critical infrastructure were long used interchangeably. Under the Wwke the legal term has become critical entity: an organisation that provides an essential service and has been designated by a minister. In substance, both terms refer to the same vital services.
Who decides whether an organisation is part of critical infrastructure?
Under the Wwke, the responsible minister designates critical entities, based on a risk assessment per sector. Under the Dutch Cybersecurity Act, sector and size determine whether an organisation is covered, and the organisation must register itself. A designated critical entity is automatically an essential entity under the Cbw.
Can a small company fall under the rules for critical infrastructure?
Yes, it can. For critical entities under the Wwke, the Dutch Cybersecurity Act applies no size threshold, so a small but indispensable organisation can still be essential. Suppliers to vital organisations also feel the requirements through contracts and supply chain agreements.
Is the NCSC the regulator for critical infrastructure in the Netherlands?
No, the NCSC is the national CSIRT: it receives incident reports, issues warnings and gives advice, but it does not supervise. Supervision of the Cybersecurity Act lies per sector with regulators such as the RDI, the ILT, the IGJ and DNB/AFM, and under the Wwke the competent authority, the responsible ministry together with a supervisor, oversees compliance.
Why is OT in critical infrastructure particularly vulnerable?
OT in critical infrastructure often runs for decades, uses protocols without authentication and cannot simply be patched or restarted. At the same time, control systems are increasingly connected to IT and suppliers. As a result, an attack has direct physical consequences, such as loss of power or drinking water.
How quickly must an incident in critical infrastructure be reported?
Under the Dutch Cybersecurity Act, an essential entity reports a significant incident with an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Under the Wwke, critical entities must also report an incident that significantly disrupts, or could disrupt, their essential service within 24 hours, followed where relevant by a detailed report within one month.
📌 In summary
Critical infrastructure is the set of services whose failure disrupts society, and because it runs on OT, its protection in the Netherlands has been governed since 15 August 2026 by the Cybersecurity Act and the Wwke.
The threat is real, from ransomware to state sabotage, and the consequences are physical. Anyone operating vital processes combines cyber security, availability and compliance: know what you have, separate IT and OT, restrict access, detect anomalies and rehearse recovery.