OT Governance Radar

This is a draft sample issue generated by the newsletter script. It has not been sent.

OT Governance Radar — Issue #1

28 Oct 2026 · Regulatory changes 27 Sep 2026–28 Oct 2026

In this issue: 4 regulatory changes · 5 deadlines in the next 90 days · 20 new ICS advisories.

SPONSOR SLOT (primary) — [Sponsor logo] [Sponsor name]: 50–80 words + one link. Placeholder: no sponsor booked. Sponsor this newsletter

1. What changed

UK NIS / CS&R Bill: Lords report stage complete

Peers agreed amendments requiring a review of the NIS regime within 12 months and a register of state actors; a frontier-AI incident reporting amendment was defeated. Third reading 2 Nov 2026.

  • Who it applies to: Operators of essential services (energy, transport, drinking water, health, digital infrastructure) and relevant digital service providers
  • Controls affected (indicative IEC 62443): IEC 62443-2-1 (programme), 62443-3-3 (protect/detect SRs)
  • Next date: 2 Nov 2026 — Lords third reading scheduled
  • Source: parliament.uk · Full tracker page

NIS2: Poland: Self-registration window in Wykaz KSC closed

Poland NIS2 update — see the country obligations page.

  • Next Poland date: 3 Apr 2027 — Poland: end of adjustment period – implement KSC obligations and start using System S46
  • Source: gov.pl · Poland NIS2 obligations

NIS2: Austria: NISG 2026 applies; USP registration window opens

Austria NIS2 update — see the country obligations page.

CIRCIA: CIRCIA final rule at OIRA

Reported submission of the final rule for OMB review; no publication date yet. Verify against reginfo.gov. ⚠️ needs verification

  • Who it applies to: Covered entities across the 16 US critical infrastructure sectors (definition set by final rule)
  • Controls affected (indicative IEC 62443): IEC 62443-2-1 incident handling; 62443-3-3 SR 6
  • Source: insideprivacy.com · Full tracker page

2. Deadlines — next 90 days

Date Regulation Milestone
31 Oct 2026 NIS2 IT Italy: basic security measures deadline for 2025-listed NIS entities (reported; verify per listing date) ⚠️ needs verification (source)
2 Nov 2026 UK NIS / CS&R Bill Lords third reading scheduled (source)
31 Dec 2026 NIS2 AT Austria: registration deadline (USP) for entities in scope from 1 Oct 2026 (source)
1 Jan 2027 NIS2 IT Italy: incident notification obligation starts for entities first listed in 2026 (source)
20 Jan 2027 Machinery Reg. Regulation applies (general date of application) ⚠️ needs verification (source)

Full calendar and .ics feed: https://otgovernanceradar.com/deadlines/

3. ICS advisory digest

20 new advisories from CISA (Siemens 17, Kiloview 1, The EPICS Community 1, Mitsubishi Electric 1). Highest severity first:

  • ICSA-26-295-01 — Kiloview E3 NDI Encoder · CVSS 9.9 · Communications, Information Technology
  • ICSA-26-300-01 — EPICS Base · CVSS 9.8 · Critical Manufacturing
  • ICSA-26-295-15 — Siemens RUGGEDCOM CROSSBOW Station Access Controller · CVSS 9.8 · Critical Manufacturing, Transportation Systems, Energy
  • ICSA-26-295-14 — Siemens SIMATIC S7 PLCs Web Server · CVSS 9.6 · Critical Manufacturing, Transportation Systems, Energy
  • ICSA-26-300-02 — Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz · CVSS 9.1 · Critical Manufacturing
  • ICSA-26-295-09 — Siemens Industrial Edge Device Kit · CVSS 9.1 · Critical Manufacturing, Transportation Systems, Energy
  • ICSA-26-295-17 — Siemens Industrial Edge Devices · CVSS 9.1 · Critical Manufacturing, Transportation Systems, Energy
  • ICSA-26-295-12 — Siemens RUGGEDCOM CROSSBOW · CVSS 8.8 · Critical Manufacturing, Transportation Systems, Energy
  • …and 12 more: https://otgovernanceradar.com/advisories/

4. One governance takeaway

Incident-reporting clocks are converging. NIS2 national laws use a 24-hour early warning and 72-hour notification (Directive (EU) 2022/2555, Art. 23); CRA manufacturer reporting (24h/72h) has applied since 11 Sep 2026 (Commission); CIRCIA would add a 72-hour clock in the US once final. If your OT incident response plan (IEC 62443-2-1) doesn't define when an OT anomaly becomes a reportable incident — and who starts the clock — that's the gap to close before the next audit.

Every item links to its source. ⚠️ marks items we have not yet confirmed against a primary source. Not legal advice. Browse the tracker · NIS2 country tracker · Sponsor