OT cybersecurity for data centers: NIS2 and IEC 62443 in practice

Cybersecurity for operational technology (OT, physical systems that control infrastructure such as cooling, power, HVAC, physical access) is a topic with regulatory frameworks different from those of traditional IT. In recent years, two references have become mandatory in any conversation about operational infrastructure protection: the NIS2 directive from the European Union and the IEC 62443 family of standards. The first is regulatory and applies in Europe; the second is technical and applies globally. A data center in Mexico is not directly subject to NIS2, but it is worth understanding both frameworks if it operates for European clients or if it seeks alignment with international best practices.

This article describes what OT is, what specific threats it faces, what NIS2 says in operational terms (without legal jargon), what IEC 62443 covers, and how to apply what applies in a Mexican data center. The goal is for the reader to finish with a map of which regulation or standard applies to their case and with the minimum controls they should have.

What OT is and why it is different from IT

OT, or operational technology, groups the physical systems that control infrastructure: chillers, UPS, generators, electrical panels, access controls, fire suppression systems, environmental sensors. These systems have three critical differences from IT (information technology). The first is operational priority: in IT, a vulnerability is patched in hours or days; in OT, an incorrectly updated system can stop data center cooling and cause throttling within minutes.

The second is useful life: OT systems stay in operation between 10 and 20 years, with firmware updated only when the manufacturer releases it and the operator can apply it without risk. A typical server is replaced every 3 to 5 years; a chiller, in 15 to 20. This means that many OT systems in operation run obsolete software that cannot be updated without affecting availability.

The third is attack surface: traditionally OT systems were isolated from the corporate network (air-gapped), but the trend toward telemetry, remote dashboards, and data-based optimization has connected them to the same network as IT. This has expanded the attack surface and created new paths from an IT attack to an OT compromise. The NotPetya case of 2017 demonstrated the impact: an attack that started in accounting software spread to OT systems and stopped physical operations in multiple countries.

What NIS2 is and who it really applies to

NIS2 (Network and Information Security Directive 2) is a European Union directive that entered into force in 2024 and requires essential services operators and digital services providers to implement risk management, incident notification, operational continuity, and supply chain security. It applies to entities that operate in the EU or provide services to entities operating in the EU, which includes data centers with European clients.

NIS2 is not directly applicable to data centers in Mexico, but it operates as an international reference and as a contractual requirement from European clients. If a data center in Mexico provides services to a European entity regulated by NIS2, the contract typically requires alignment with NIS2 controls as part of the supply chain. In practice, the most relevant NIS2 requirements for a data center are five: documented risk management, incident notification within 24 hours, operational continuity plan, supplier security, and periodic effectiveness assessment.

For data centers that do not have European clients and do not aspire to have them, NIS2 is still useful as a reference: its five requirements are reasonable operational practices that apply to any data center that wants to operate at enterprise level. Ignoring NIS2 is valid; not studying it means losing access to a consolidated international framework.

What IEC 62443 covers and why it is the reference technical standard

IEC 62443 is a family of technical standards published by the International Electrotechnical Commission (IEC) that define how to protect industrial automation and control systems (IACS, Industrial Automation and Control Systems). Unlike NIS2, IEC 62443 is a technical standard, not regulatory: any data center in the world can adopt it voluntarily, and many operators with enterprise clients require it contractually.

The family is divided into four parts: general (definitions and concepts), policies and procedures (what the organization must do), system (requirements of the OT system itself), and component (requirements of each individual device). For a data center, the most relevant parts are 3-3 (system security requirements) and 2-4 (service provider requirements). These define the minimum controls that an OT system must have and the requirements that the operator can contractually demand from its chiller or UPS maintenance provider.

The security levels of IEC 62443 (Security Level 1 to 4) correspond to the depth of expected threat. SL-1 is protection against casual cause (operator with configuration error). SL-2 is against intentional cause with limited resources (opportunistic attack). SL-3 is against attacker with moderate resources (hacktivist or organized crime). SL-4 is against state-level attacker or with high resources (APT, Advanced Persistent Threat). For a data center in Mexico, SL-2 is the reasonable minimum; SL-3 is prudent for data centers with enterprise or government clients.

Minimum controls every data center must have

Five minimum controls apply to any data center that operates OT systems (chillers, UPS, generators, access controls, sensors), regardless of whether it is subject to NIS2 or IEC 62443.

• OT network segmentation: OT systems must be in a VLAN (virtual local area network) or network segment separate from the corporate one, with firewall between them. Without segmentation, an IT compromise automatically propagates to OT.
• Documented inventory and configuration: every OT device must be in an inventory with current firmware, configuration, and owner. Without this, risk cannot be assessed and incidents cannot be responded to effectively.
• OT monitoring independent from IT monitoring: OT events (setpoint changes, equipment alarms, restarts) must be recorded in logs (logging) within a system separate from the IT SIEM (Security Information and Event Management), because the attack vectors and patterns are different.
• Incident response plan specific to OT: an OT attack is not solved by restarting: it requires coordinating with the equipment manufacturer to validate that the firmware has not been compromised and that the system can return to safe operation. The plan must document these contacts and procedures before the incident.
• Physical and remote access management: remote access to OT (vendor support, external dashboards) must be authenticated with MFA (multi-factor authentication), audited, and limited to maintenance windows. Without this, an attacker with vendor credentials compromises OT without touching the IT network.

Five common mistakes when implementing OT cybersecurity

Five mistakes account for the majority of OT cybersecurity implementations that fail or leave critical gaps.

• Treating OT as IT: applying untested patches, running antivirus on systems that do not support it, restarting to resolve incidents: all of this breaks OT. OT security requires different procedures, with prior validation and coordination with the manufacturer.
• Trusting the air gap: many OT systems are documented as air-gapped but in practice have telemetry, dashboards, or remote updates that expose them to the corporate network. The nominal and the real air gap usually do not match.
• Ignoring the supply chain: a chiller provider with remote access is an attack vector. If the provider is compromised, the data center’s OT becomes exposed. NIS2 and IEC 62443 require assessing and managing this risk.
• Postponing firmware updates: obsolete firmware is the favorite attack vector for OT. Attackers know that many operators do not update for fear of breaking availability, which creates a stable attack surface.
• Assuming that NIS2 applies to a Mexican data center: NIS2 applies in the EU. A data center in Mexico is not directly subject to it, unless it provides services to European entities. Confusing the scope leads to investing in controls not required, or conversely, ignoring controls that a contractual client does require.

Sources

[1] Wikipedia — IEC 62443 (background reference) — https://en.wikipedia.org/wiki/IEC_62443

[2] Wikipedia — NIS2 (Network and Information Security Directive 2) — https://en.wikipedia.org/wiki/NIS2

[3] CISA — Industrial Control Systems (US government resource) — https://www.cisa.gov/topics/industrial-control-systems

[4] IEC — IEC 62443 standards (Industrial communication networks) — https://www.iec.ch/standards-and-components/iec-62443

[5] ISO/IEC 27001 — Information security management — https://www.iso.org/standard/27001