NIS2 Regulation: New Cybersecurity Obligations Now Also Affect Wind Farm Operators

The implementation of the European NIS2 Directive into national law marks a turning point for cybersecurity in the energy industry – especially for companies in the wind industry. The ordinance merges existing regulations, significantly expands them and brings with it new responsibilities that go far beyond previous KRITIS requirements.

• operators of wind farms whose turbines reach a certain size or importance for energy supply,
  
• Operators and companies that operate or control central IT infrastructures in the energy sector,
  
• as well as companies that were not previously classified as KRITIS participants but are now considered "important institutions" due to their size or systemic relevance.
  

Wind farm operators and operators are obliged to implement extensive measures to increase IT and information security . These include:

• Establishment of an information security management system (ISMS),
  
• Implementation of technical protection measures such as patch and access management, backup strategies and incident response processes,
  
• Documentation and regular training of employees,
  
• Introduction of emergency and restart plans,
  
• Monitoring and evaluating service providers and suppliers for their cybersecurity standards.