🔥NIS2 for Natural Gas — deadlines, obligations, fines

A documented framework, all-hazards approach, covering risk policies on IT and OT, security of SCADA systems and compressor stations, business continuity with RTO/RPO on transmission and distribution, cryptography, MFA on remote access to control systems, training and access control. NIS2 Art. 21(2) imposes the ten minimum measures (a-j), aligned with European and international standards, with explicit reference to ISO/IEC 27001, ISO/IEC 27002 and ETSI EN 319 401 [C3]. For a gas operator, IEC 62443 is the technical reference for the OT segment: zone-and-conduit architecture (Purdue), authentication control (FR1), system integrity (FR3), restriction of data flows (FR5), response to events (FR6) and availability (FR7) [C10]. The management body approves and oversees implementation (NIS2 Art. 20), with personal liability [C14].

For a Romanian gas operator, a significant cyber incident touching SCADA or metering telemetry triggers two communication tracks. NIS2 Art. 23 to CSIRT/DNSC: early warning within 24 hours of awareness, incident notification within 72 hours, final report within one month [C4]. In parallel, the security-of-supply framework (Reg. 2017/1938) requires communication to the competent national energy authority when transmission capacity is affected or when the cross-border solidarity mechanism is activated [C7]. In practice, the CISO and the head of operations share a single runbook that feeds the DNSC form and the ANRE/Commission flow simultaneously, with no duplication and no delay. For the cross-border flows to Ukraine, the Republic of Moldova, Bulgaria and Hungary, Reg. 2024/1789 will bring a sectoral cybersecurity delegated act, analogous to the electricity network code (Reg. 2024/1366) [C8].

For a transmission operator, SCADA systems control valves, compressor stations, regulation-and-metering stations, and telemetry on trunk lines. NIS2 Art. 21(2)(e) and Art. 21(2)(h) require timely vulnerability handling and cryptography policies [C3]. Applied to OT, that means: segmentation on IEC 62443 zones (level 0 sensors, level 1 controllers, level 2 SCADA, level 3 industrial DMZ), patch management with a planned maintenance window (many IACS components are non-patchable in production — compensated through compensating controls), behavioural monitoring on industrial protocols (Modbus, DNP3, IEC 60870-5-104), MFA on any remote access to SCADA, encryption of radio and fibre links to isolated stations. The Colonial Pipeline concentration of risk (May 2021) — 5,550 miles of pipeline shut down for about six days after a single compromised VPN password — illustrates what lack of segmentation between IT and OT means [I1]. ENTSOG and ENISA have issued a crisis-management communication guide on cyber for the gas community [C11].

For a gas TSO, continuity means the interconnectors with Ukraine, Moldova, Bulgaria and Hungary do not stop. NIS2 Art. 21(2)(c) requires business continuity and crisis management as minimum measures [C3]. Reg. (EU) 2017/1938 requires TSOs to have bidirectional capacity on all interconnectors between Member States (with exceptions) and preventive-action plans + emergency plans on regional groupings, tested through exercises every two years between updates [C7]. The solidarity mechanism (Art. 12 Reg. 2017/1938) is triggered when protected customers are at risk [C7]. In practice, plans also need to address the scenario "primary SCADA encrypted by ransomware, secondary SCADA OK" — that is, offline procedures for operating manual valves, backup radio communications, dispatch decisions without an HMI. The lesson of Norsk Hydro 2019: switching to manual operations saved production but cost between USD 81 million and over USD 100 million in downtime and recovery [I3].

NIS2 Art. 21(2)(d) requires supply-chain risk management for all essential entities [C3]. For a Romanian gas operator, that means audit on three levels: (1) suppliers of SCADA and IACS equipment (PLCs, RTUs, HMIs, telemetry systems) — technical inventory, SBOM, contractual patching policy; (2) managed-ICT service providers (data centre, cloud, billing systems for distribution); (3) legacy components of Russian or non-EU origin — REPowerEU and the decoupling policy highlighted the risk of components originating from states with elevated geopolitical risk [C8]. The Cyber Resilience Act (Reg. 2024/2847), in force since 10 December 2024, will impose from 11 December 2027 mandatory sectoral conformity for products with digital elements placed on the EU market, and reporting of actively exploited vulnerabilities becomes mandatory from 11 September 2026 [C9]. The 2022 attack on the Iranian steelworks (Predatory Sparrow) demonstrated that an actor with PLC access can force an industrial process into an unsafe state — relevant for gas compressor stations [I4].

Type: DarkSide ransomware; compromise vector via a VPN password leaked on the dark web, without MFA

Impact: Shutdown of 5,550 miles of pipeline (petrol, diesel, kerosene) for about six days; panic and queues at fuel stations on the US East Coast; the company paid about 75 BTC (~USD 5 million) in ransom; the DOJ later recovered 63.7 BTC (~USD 2.3 million). The pipeline carries roughly 45% of fuels consumed on the US East Coast.

Lesson: Hydrocarbon pipelines (oil or gas) are vulnerable to IT attacks that propagate to OT when there is no rigorous segmentation. Compromise happened via a leaked VPN password, without MFA. NIS2 Art. 21(2)(h) requires cryptography and authentication controls, and IEC 62443 requires strictly separated zones and conduits between corporate IT and pipeline OT.

Type: Cyberattack on the central IT payment and subsidy system for fuel stations

Impact: About 70% of Iran's fuel stations inactive for days; Iran's oil minister (Javad Owji) confirmed the attack; long queues and blocked traffic in Tehran and other cities; Predatory Sparrow claimed the attack with a political message. Check Point researchers assessed that the sophistication suggested state sponsorship.

Lesson: Retail fuel distribution can be paralysed nationwide via an attack on the central payment system, without physically touching the pipeline. For DSOs and gas suppliers operating centralised billing/telemetry systems, the lesson is the same: NIS2 Art. 21(2)(d) requires ICT supply-chain security and Art. 21(2)(f) requires policies on the effectiveness of risk measures.

Type: Cyberattack on SCADA that forced the industrial process into an unsafe state (July 2022)

Impact: Serious fire in the steelworks' furnace; the group later claimed the attack and published it. A publicly documented case of cyber-physical impact caused by an attacker with access to industrial control systems in a large facility.

Lesson: An attacker with access to PLCs and SCADA can force the industrial process into an unsafe state with real physical impact. For gas operators with compressor stations, the same vector could force dangerous pressures. NIS2 Art. 21(2)(e) and IEC 62443-3-3 (system security requirements) require behavioural monitoring on industrial protocols and safety procedures independent of the network (physical interlocks, mechanical safety valves).

Type: LockerGoga ransomware; encryption of corporate endpoints that spread to energy-intensive systems and SCADA on terminals

Impact: Tens of thousands of PCs locked at 170 sites in 40 countries; damage reported between USD 81 million and over USD 100 million (downtime and recovery); switch to manual operations on most flows; primary aluminium production resumed after a week, but smelters remained operational. Volodymyr Tymoshchuk was later identified as the mastermind behind LockerGoga (alongside MegaCortex and Nefilim).

Lesson: Transparent communication during the incident (Hydro refused to pay, went public, held daily press conferences) saved the reputation, but the operational cost remained high. For gas operators: continuity plans must include offline operating procedures and public communication prepared in advance, not improvised under pressure. NIS2 Art. 21(2)(c) requires tested business continuity and crisis management.

Regulamentul (UE) 2017/1938 - securitatea aprovizionarii cu gaze · Directly applicable from 1 November 2017; does not require national transposition [C7]

The backbone of security of supply. Requires TSOs to have bidirectional capacity on interconnectors, cooperation through the ReCo System for Gas during emergencies, and preventive-action and emergency plans developed regionally. The solidarity mechanism (Art. 12) is the last-resort tool for protected customers [C7]. In a cyber context: a cyber incident that reduces transmission capacity can trigger the emergency plans — so the NIS2 runbook must be coupled with the Reg. 2017/1938 runbook.

Directiva 2009/73/CE - piata interna in gaze naturale · Transposed in Romania by the Romanian Electricity and Natural Gas Law 123/2012 [C15]

Sets the sector's architecture: transmission, distribution, supply, storage, LNG, unbundling of transmission operators. Identifies the entities falling into Annex I of NIS2 in the gas sub-sector. Also applies to biogas and gas from biomass injected into the system [C15].

Regulamentul (UE) 2024/1789 - pachetul gaz si hidrogen · Adopted 13 June 2024, published 15 July 2024 in the OJEU, in force 5 August 2024; directly applicable [C8]

Extends the security-of-supply regime to renewable gases and hydrogen. Most importantly: empowers the Commission to adopt a sectoral cybersecurity delegated act for cross-border gas flows, with rules on common minimum requirements, planning, monitoring, reporting and crisis management [C8]. The model is the electricity network code (Reg. 2024/1366), already in force since 13 June 2024.

Cyber Resilience Act - Regulamentul (UE) 2024/2847 · In force since 10 December 2024; main obligations applicable from 11 December 2027, active-vulnerability reporting from 11 September 2026 [C9]

For gas operators, the CRA means that products with digital elements purchased (PLCs, RTUs, OT gateways, telemetry systems, smart-meter gateways, HMI systems) must be CRA-compliant before being placed on the EU market. Manufacturers bear the responsibility, but the buying operator demands proof [C9]. In practice: contractual clauses with the vendor on SBOM, vulnerability disclosure and lifecycle patch management.

IEC 62443 - cybersecurity pentru IACS (industrial automation and control systems) · International IEC standard; adopted as a reference by ENISA, CISA and national energy regulators [C10]

The technical reference framework for OT security in pipelines and compressor stations. The seven fundamental requirements (FR1-FR7) cover authentication, use control, system integrity, data confidentiality, restricted data flow, response to events, and availability [C10]. The Purdue model of zones and conduits separates levels 0-5, which makes practical implementation of the NIS2 network-segregation requirement possible.