Regulations and Standards Landscape

Learning objectives

• Distinguish legal duties, regulatory guidance, standards, frameworks and project specifications.
• Explain how IEC 62443 fits alongside UK and EU law, the NCSC CAF, NIST guidance and ISO/IEC 27001.
• Build an applicability register for a project.
• Avoid treating compliance as proof that risk is acceptable.

Introduction

This module maps the principal sources that shape industrial cyber security expectations.

Main lesson

Five different types of requirement

Cyber documents do not all have the same authority.

A standard may become contractually mandatory even when it is not named directly in legislation. Conversely, writing “comply with IEC 62443” in a specification does not define a usable requirement because the series covers different roles, lifecycles and levels of abstraction.

UK context

For a UK project, establish at least:

• Whether the operator provides an essential or regulated service.
• Whether the Network and Information Systems Regulations 2018 or sector-specific duties apply.
• The relevant competent authority and current sector guidance.
• Whether an NCSC Cyber Assessment Framework profile or overlay is required.
• Relevant health, safety, environmental and data-protection duties.
• Contractual standards, client policies and assurance gates.

The Network and Information Systems Regulations 2018 remain the UK's current cross-sector cyber security regime for operators of essential services and relevant digital service providers. The Cyber Security and Resilience (Network and Information Systems) Bill would amend and extend that regime. As at 15 July 2026, the Bill has passed the House of Commons and completed its second reading in the House of Lords, but it is not yet law. Treat proposed duties as a change to monitor, not as an enacted requirement.

EU context

For systems, services or products within the EU market, also establish:

• Which Member State's law transposes Directive (EU) 2022/2555 (NIS2) and which competent authority applies. NIS2 is a directive implemented through national law, so the operative duties and procedures must be checked in the relevant jurisdiction.
• Whether the organisation is an essential or important entity and whether the affected service and supply chain are in scope.
• Whether a hardware or software product is a product with digital elements under Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA). The CRA's reporting duties apply from 11 September 2026 and its main obligations apply from 11 December 2027.
• Whether Regulation (EU) 2023/1230 on machinery applies to the delivered machine or related product from 20 January 2027, including protection against corruption of safety-relevant hardware, software and data.
• Relevant sector legislation, product-conformity duties, data protection and contractual requirements.

EU rules do not automatically become UK law, and UK rules do not establish EU conformity. A UK supplier placing a product on the EU market may need to satisfy both regimes for different reasons.

The legal position and regulatory guidance can change. Record the source, owner, jurisdiction, version or access date, and next review date. Do not freeze a training-page summary into a twenty-year design basis. This module is engineering guidance, not legal advice.

How the common references complement one another

• IEC 62443 provides role-based industrial security processes and system or component requirements.
• NCSC CAF provides outcome-focused assessment for cyber resilience, especially around essential functions.
• NIST SP 800-82 provides accessible OT security guidance, architectures, threats and safeguards.
• ISO/IEC 27001 provides an organisation-wide information security management system.
• NIST Cybersecurity Framework provides a common structure for governing and managing cyber risk.

These references overlap, but they are not interchangeable. A CAF assessment does not automatically prove IEC 62443 conformance. An ISO/IEC 27001 certificate does not demonstrate that a particular control system has suitable zones, conduits or recovery arrangements.

Build an applicability register

For every source, record:

1. Document and edition or current web source.
2. Reason it applies.
3. System, service or organisation in scope.
4. Responsible interpreter.
5. Required deliverables or evidence.
6. Conflicts, assumptions and exclusions.
7. Review date.

This small register prevents standards being cited without ownership or consequence.

Engineering example

Practical activity

Knowledge check

Key takeaways

Relevant standards and guidance

This module uses original explanatory language. Consult the applicable editions and project requirements rather than treating this lesson as normative text.

• UK Network and Information Systems Regulations 2018
• Directive (EU) 2022/2555 (NIS2)
• Regulation (EU) 2024/2847 (Cyber Resilience Act)
• NCSC Cyber Assessment Framework
• ISA/IEC 62443 series

Further reading

• UK Network and Information Systems Regulations 2018
• UK Parliament — Cyber Security and Resilience Bill: current status and stages
• NCSC Cyber Assessment Framework
• European Commission — NIS2 Directive
• European Commission — Cyber Resilience Act
• ISA/IEC 62443 series overview

Last reviewed

15 July 2026.