Water Utility: The Complete NIS2 Guide

Water utilities and wastewater operators are classified as Essential Entities under NIS2 Annex I No. 8 (Drinking Water) and Annex I No. 9 (Wastewater) - without a revenue threshold. Even a municipal water utility serving more than 50,000 people is KRITIS and thus subject to the highest NIS2 obligation class. This guide is written for technical directors, managing directors, and IT managers at water utilities.

Who is affected?

Drinking water suppliers fall under NIS2 Annex I No. 8, wastewater operators under NIS2 Annex I No. 9. The threshold: utilities serving more than 50,000 people are KRITIS (BSI-KritisV § 2 No. 24). These entities are Essential Entities under § 28 Para. 1 BSIG-new.

Smaller utilities serving between 50 and 50,000 people fall under NIS2 Annex II - provided they have at least 50 employees or EUR 10 million in revenue. They are then Important Entities.

A municipal water utility serving 80,000 residents is an Essential Entity under NIS2 Annex I, subject to the strictest obligations and highest fines.

Obligations under § 30 BSIG-new

§ 30 BSIG-new lists seven obligation categories that are particularly relevant for water utilities because of 24/7 operations and direct impact on public health:

1. Risk analysis and management: Process control systems (SCADA/DCS), pump controls, chlorination systems, remote control technology, and laboratory information systems must all be assessed.
2. Incident handling: A cyberattack on chlorination controls is an immediate public health incident. The incident response process must include regulatory escalation (BSI, public health authority, regulators).
3. Business continuity: 24/7 water supply must be guaranteed even during IT failure. Manual control procedures and redundant communication paths must be documented.
4. Supply chain security: System integrators, remote control technology providers, and laboratory software vendors must be reviewed for security standards. Contractual clauses under § 30 Para. 2 No. 4 BSIG-new are mandatory.
5. Access control and MFA: Access to process control systems and remote control technology must be secured by MFA. Specifically: no unsecured remote access to pump controls.
6. Encryption: Control data, operational logs, and customer data must be encrypted in transit and at rest.
7. Training and awareness: Operations technicians, dispatchers, and administrative staff must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months. For security incidents under § 32 BSIG-new: initial report within 24 hours, full report within 72 hours, final report within 30 days.

For Essential Entities in drinking water supply: any cyberattack on chlorination or treatment controls is a critical incident reportable within 24 hours. The responsible public health authority must also be notified in parallel.

Fines and personal liability

Essential Entity (Annex I): up to EUR 10 million or 2% of global annual turnover. For municipal utilities without international revenue: 2% of total revenue.

§ 38 BSIG-new: personal liability for management for negligently missed NIS2 obligations. Combined with water law liability (WHG, TrinkwV) and liability to the public for supply interruptions, the personal risk is significant.

DVGW W1060 and NIS2: understanding the overlap

The DVGW Technical Note W1060 "Information Security for the Water and Wastewater Sector" has been the industry standard for IT security in water supply since 2021. It describes requirements for information security management systems (ISMS) specifically for water utilities.

The overlap with NIS2 is substantial: both frameworks require risk analysis, emergency planning, supply chain assessment, and incident handling. A utility that is W1060-compliant already fulfills significant parts of the NIS2 requirements under § 30 BSIG-new.

Key differences: NIS2 adds reporting obligations to the BSI that are not specified in W1060. Additionally, NIS2 introduces personal management liability (§ 38 BSIG-new), which W1060 does not address. For water utilities that have already implemented W1060, a gap analysis between W1060 compliance and NIS2 requirements is recommended.

First steps

1. Determine your classification: Essential Entity (Annex I, >50,000 supply units) or Important Entity (Annex II, SME thresholds)?
2. Map all networked control systems: SCADA, remote control technology, chlorination controls, pump station remote access points.
3. Conduct a W1060/NIS2 gap analysis if W1060 implementation has already begun.
4. Review all remote access points to network control systems.
5. Create an incident response plan that includes BSI reporting, public health authority escalation, and media communication.
6. Review supplier contracts for security requirements.
7. Register with the BSI.

Common pitfalls

OT systems treated as non-IT: Pump controls and SCADA systems are IT in the NIS2 sense. Excluding them from the risk analysis creates a dangerous gap.

Remote control technology without VPN and MFA: Many older remote control systems use proprietary protocols without strong authentication. This is no longer acceptable under NIS2.

W1060 treated as sufficient: W1060 compliance fulfills many, but not all, NIS2 requirements. Reporting obligations and management liability are additional.

BSI registration underestimated as a formality: Registration triggers the obligation cycle. Late registration exposes you to the accusation of deliberately delaying compliance.

Use the industry-specific NIS2 calculator for water utilities to verify your classification.