Since NIS2 came into force, and even more since Israel's cyber bill passed its first reading this summer, the question we are asked most by building owners and facility managers is a simple one: "Is my building covered?" We understand why people ask it that way. But it is the wrong question, and answering it honestly usually changes the conversation.
Below are the questions we hear most often, and how we answer them.
"Is my building covered by NIS2?"
No building is. NIS2 (Directive (EU) 2022/2555), which has applied since 18 October 2024, regulates organizations by sector and by size. It lists sectors in two annexes. Annex I covers the "high criticality" ones, among them energy, transport, banking, health, drinking water, digital infrastructure and public administration. Annex II adds manufacturing, food, chemicals, postal services and a few others. Real estate and facility management are in neither.
Then comes a size test. Broadly, an organization in a listed sector is in scope once it has 50 or more employees, or annual turnover and balance sheet both above €10 million. Large entities in Annex I sectors are "essential", most others "important". The obligations are nearly identical. What differs is supervision: essential entities can be audited proactively, important ones mostly after something goes wrong.
So when a client asks us about their building, we turn the question around. Who owns it, who runs it, and why does that organization exist? That decides everything. A twelve-storey office tower can sit entirely outside NIS2 while the hospital next door, running the same BMS from the same integrator, carries board-level liability for it.
"We run a hospital, a data centre, a campus. Are we in?"
Very possibly. These are the situations where we most often find building systems ending up inside an NIS2 risk register:
- When the building is the service. Hospitals, data centres, airports, rail stations, water plants. The HVAC, power distribution and access control here are not support systems. A cooling failure in a data hall or an operating theatre is the incident.
- When the campus sells heat or cooling. District heating and district cooling operators are named in Annex I under energy. A university, hospital group or mixed-use development that runs a central plant and supplies other buildings should check whether that activity alone brings it in. Clients are usually surprised by this one.
- When the owner is a public body. Central government is in scope, and member states can extend this to regional and local authorities. Ministries and municipalities own a lot of buildings.
"We are a BMS integrator. Surely this is our clients' problem?"
Not necessarily, and this is the conversation integrators find most uncomfortable. NIS2 includes managed service providers in Annex I. The definition covers anyone who installs, manages, operates or maintains customers' network and information systems, on site or remotely. An integrator or facility management firm with a remote operations centre looking after dozens of client sites should get a careful legal read of that definition. We do not think the answer is obvious either way, which is exactly why it is worth asking before a client's auditor does.
"We are only the landlord. Why are our tenants sending us security questionnaires?"
This is how most commercial landlords actually meet NIS2. Article 21 requires in-scope organizations to manage supply chain security. If your tenants include a bank, an insurer, a cloud provider or a clinic, their compliance team will eventually ask how the building's systems are protected. The BMS, access control and CCTV run on infrastructure they cannot see, and some of it shares cabling or risers with theirs.
It arrives as lease annexes, questionnaires and audit rights. When we are asked to help with these, the deciding factor is almost always the same. Operators who can already describe their OT asset inventory, how vendors connect remotely, and who to call in an incident answer in a week. Those who cannot end up signing clauses they have no way to meet.
"What will an auditor actually ask about our building systems?"
Article 21 lists ten areas of risk management measures. When building systems are in scope, these are the ones where we see operators struggle:
- Asset management and access control. You cannot show proportionate measures for systems you have not inventoried. Many BMS environments have no current list of controllers, firmware versions or accounts. We wrote about why that is harder than it sounds in building an OT asset inventory.
- Supply chain security. Integrators, maintenance contractors, SaaS platforms. What they can reach, how, and what the contract says about telling you when something goes wrong on their side.
- Vulnerability handling. BMS servers on old Windows builds and controllers with published advisories are normal. NIS2 does not demand that everything is patched. It demands that you know and decide. See OT patch management when you cannot patch.
- Multi-factor authentication. Explicitly named in the directive. Shared vendor accounts on a VPN into the BMS will not survive an audit. Our piece on securing remote and vendor access covers what replaces them.
- Business continuity. Can the building run safely with the BMS head-end offline? For how long, and who decides?
Then there is the reporting clock in Article 23: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours and a final report within a month. When clients ask us whether they can meet the 24 hours, we ask back whether they would even notice. For an operator with no monitoring on the OT network, that is the real gap.
Article 20 puts all of this on the management body. Directors must approve the measures, oversee them and take training, and they can be held personally liable. Fines reach at least €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important ones.
"Hasn't every EU country implemented it by now?"
No. NIS2 is a directive, so what binds you is the national law where you operate. Member states were due to transpose it by 17 October 2024 and many missed it. In July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition. The national laws that do exist differ on sector definitions, registration deadlines and how far they reach into local government.
The text itself is also moving. In January 2026 the Commission proposed targeted amendments, including a "small mid-cap" category (under 750 employees and €150 million turnover) that would generally be supervised as important rather than essential. It is still going through the legislative process. If you operate in several EU countries, our advice is always to read each national law, not the directive.
"We are in Israel. Does any of this apply to us?"
NIS2 itself does not, but the direction of travel is the same. Until now, binding cyber obligations in Israel have come from a few places:
- A short list of organizations with designated critical computer systems is guided directly by the Israel National Cyber Directorate (INCD) under the Regulation of Security in Public Bodies Law of 1998.
- Sector regulators issue their own directives. Banks, insurers, energy and health providers each answer to a different regulator with its own expectations.
- The Privacy Protection (Data Security) Regulations of 2017, strengthened by Amendment 13 to the Privacy Protection Law in August 2025. Access control logs and CCTV footage are personal data. For many commercial buildings this is the regulation that applies today, and it is often overlooked because nobody files it under "cyber".
- The INCD's Cyber Defense Methodology for organizations. Voluntary for most, but it is what auditors and large customers tend to measure against.
That is now changing. On 8 June 2026 the Knesset passed the first reading of the National Cyber Defense Bill (5786-2026), with no votes against. It sits with the Foreign Affairs and Defense Committee ahead of the second and third readings and can still change. As published, it:
- Defines "essential organizations", including government bodies and organizations in sectors such as communications, energy, health and transport, and brings certain digital and hosting service providers under parts of the regime.
- Sets a baseline of cyber defense for them covering risk management, asset mapping, incident readiness, continuity, supply chain risk and governance. The overlap with NIS2 Article 21 is close.
- Requires significant cyberattacks to be reported to the INCD and to the sector regulator.
- Lets the INCD order urgent measures, and during a severe attack direct organizations, including some digital and hosting providers that are not themselves essential.
- Sets financial sanctions of NIS 640,000 for most violations, doubled for repeat violations, with personal liability for officers who fail to supervise compliance. Officers are presumed to have failed unless they show they took reasonable steps.
When Israeli clients ask us what this means for their buildings, our answer mirrors the NIS2 one. If you run a hospital, a data centre, a transport hub or an energy asset, your building systems will fall inside the baseline. If you are a landlord or integrator serving those organizations, the supply chain requirement is how it will reach you.
"We sell BMS products into Europe. What do we owe?"
Many Israeli BMS, security and IoT companies sell into the EU, and two things apply to them now. First, their customers' NIS2 supply chain obligations, which arrive as contract terms and questionnaires. Second, the EU Cyber Resilience Act (Regulation (EU) 2024/2847) for products with digital elements placed on the EU market. Its vulnerability and incident reporting obligations have applied since 11 September 2026, and the full product requirements apply from 11 December 2027. A controller, gateway or BMS software sold into the EU is in scope for the CRA regardless of who buys it.
"So where do we stand?"
When we are asked for the short version, this is roughly what we say:
| Your situation | What most likely applies |
|---|---|
| Hospital, data centre, airport or utility in the EU | NIS2 directly, through national law. Building OT is in scope. |
| Same type of organization in Israel | Sector regulator directives today; the National Cyber Defense Bill if enacted. |
| Commercial landlord with regulated tenants | Supply chain requirements through leases and questionnaires, plus privacy regulations. |
| Campus selling heating or cooling to other buildings (EU) | Check the district heating and cooling entry in Annex I. |
| BMS integrator with remote management of client sites | Possibly NIS2 as a managed service provider. Supply chain requirements from clients in any case. |
| BMS or IoT product vendor selling into the EU | Cyber Resilience Act, and customers' NIS2 supply chain terms. |
Where we see operators go wrong
The pattern repeats. The compliance project goes to IT, IT scopes it to the corporate network, and the BMS is left out because it belongs to facilities. Then an auditor or a tenant asks about the chiller plant, and nobody can say what is connected to it.
The second mistake is treating integrator contracts as purchasing paperwork. They are where your supply chain controls live: who may connect, from where, with which accounts, and how fast they must tell you about a breach on their side. Most BMS service contracts we are asked to review say nothing about any of it. Our guide to cybersecurity requirements in BMS tenders covers what belongs in new ones.
The third is buying a framework before understanding the site. Regulation sets the question. The answer depends on how your building is wired, who maintains it and what happens when it stops. That is what a proper OT risk assessment answers, and it is the first document both NIS2 auditors and the INCD will want to see.