Platform Update: NIS 2 for Industrial and OT | Arté

NIS 2 Readiness for Industrial and OT Operators Arté's Free plan already includes a NIS 2 readiness self-check. Today we're adding a second one, written for organizations that run industrial control systems — manufacturing, energy, water, transport, and waste. It sits alongside the original on the Free plan, at no cost and with no time limit. Why a Separate Self-Check NIS 2 applies the same ten risk-management measures to every entity in scope. But the way you satisfy them on a plant floor is not the way you satisfy them in an office. An IT questionnaire asks whether you patch promptly. In an operational environment the honest answer is often that you cannot — the vendor has not validated the patch, and applying it anyway would void support or halt production. The real control isn't the patch at all. It's whether you have documented what compensates for it, on that specific asset. Ask the IT question in a plant and you get a wrong answer to a question that was never quite right. What It Covers Forty-seven questions across eleven areas, structured on the ten risk-management measures of NIS 2 Article 21(2) and written from asset-owner practice in the ISA/IEC 62443 series: Scope and asset inventory — whether you can produce a current list of PLCs, RTUs, DCS controllers, HMIs, and engineering workstations, with firmware versions and end-of-life status. Network segmentation and zones — whether OT is separated from corporate IT, whether a DMZ mediates between them, and whether the environment is divided into zones and conduits with documented target security levels. Remote access and identity — whether OEM, integrator, and maintenance access is brokered through a controlled gateway rather than a standing vendor VPN, and whether actions on control devices are attributable to an individual. Vulnerability and patch management — including what compensates where a vendor has not validated an update. Cryptography and protocol protection — and, more usefully, where encryption is not possible on legacy equipment and what is recorded in its place. Incident handling and reporting — who has the authority to stop the process, whether the response team can still communicate if corporate IT is compromised, and whether you can meet the 24-hour early warning. Continuity and recovery — whether you have actually restored controller logic from backup, not merely taken one. Supply chain, monitoring, and training — for the people who run the plant, not just the office. Scored the Same Way Like every self-assessment in Arté, you receive an automated score, a breakdown by area, a prioritized list of gaps, and a downloadable summary report you can put in front of management. The answer scales are chosen per question. Some controls either exist or they don't — there is no partial demilitarized zone. Others genuinely vary across a plant, such as how completely your asset inventory covers your devices. The questionnaire distinguishes between the two rather than forcing everything onto a single scale, because a partial control and a partial rollout are not the same thing. A Note on Standards This is a NIS 2 readiness self-check informed by ISA/IEC 62443 asset-owner practice. It is not a 62443 assessment, and completing it does not constitute certification against any standard. The distinction matters in practice as well as in wording. NIS 2 is the legal obligation, with deadlines, reporting duties, and management accountability. ISA/IEC 62443 is where the practical substance of the answers comes from. Treating the first as the driver and the second as the method is how most industrial operators actually approach this. How to Get Started Go to the registration page and choose the Free plan. Create your admin account and tell us a little about your organization. Once your account is approved, both NIS 2 self-checks are available immediately. No credit card. No trial countdown. Get Started If you operate industrial control systems and NIS 2 applies to you, create your free account and find out where you actually stand. Related reading Who must comply with NIS2, including companies outside the EU What the 2026 EU amendments changed The Free plan and the general NIS 2 self-check