The classic trap
Nuclear power plant operators and their value chain (fuel, specialised maintenance, transport, waste) often assume they are excluded from NIS 2 because their activities touch national security. That is wrong: recital 10 confirms the Directive applies to nuclear electricity producers. Only specific activities can be carved out by the Member State on national security grounds, and it is up to ILR and the competent national authorities to draw that line, not the operator itself.
Mapping in practice: separating NIS 2 scope from national security scope
The recital creates a dangerous grey zone. The operator must document, activity by activity, the applicable regime, or face dual sanctions: NIS 2 non-compliance on one side, breach of national security obligations on the other.
- Standard electricity production, corporate IT, non-classified industrial supervision: full NIS 2 regime.
- Activities linked to fuel, safety, sensitive materials: potentially excluded if the Member State expressly invokes it.
- Nuclear value chain (maintenance subcontractors, transport, engineering): NIS 2 presumption, unless a reasoned decision states otherwise.
- Mixed systems (a SCADA driving both standard and sensitive operations): segmentation is mandatory to avoid legal contagion.
How Luxgap automates this risk
Our Luxgap Nuclear Scope Mapper draws the boundary between NIS 2 activities and national security activities for you, and makes it enforceable. The tool ingests your asset inventory from your CMDB (ServiceNow, GLPI), your OT repositories (Claroty, Nozomi, Microsoft Defender for IoT) and your supplier contracts in Odoo or SAP, then classifies each system, process and subcontractor against a matrix combining NIS 2 Annex I criteria and national security categories.
- Automatically classifies every asset and process using a NIS 2 / national security matrix validated with ILR and the High Commission for National Protection.
- Detects grey zones where a single system serves both NIS 2 activities and sensitive activities, and proposes the corresponding network segmentation plan.
- Tracks the full nuclear value chain (subcontractors, sub-subcontractors for maintenance and transport) and flags ruptures in legal regime.
- Generates a time-stamped, enforceable entity qualification dossier demonstrating for each activity the applicable regime and the NIS 2 measures deployed.
- Alerts in real time via Teams or Slack when a new activity, a new supplier or a SCADA change shifts an asset from one regime to the other.
Available as part of a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a demonstration on your real perimeter and our teams will deliver a free 48-hour white audit to map the risk zones before any engagement.
