Energy companies and utilities operate critical national infrastructure. NIS2 classifies them as essential entities with the strictest obligations. CER adds physical resilience requirements alongside cyber.
NIS2 essential entities face board-level accountability, 24h incident reporting, mandatory security audits every 3 years and significant fines. CER requires integrated risk assessment covering cyber AND physical threats — a new paradigm for most operators.