- TOMORIS
- Industries
- Energy & utilities
FOR POWER, HEAT & WATER
Supply that everyone relies on.
Control systems, telecontrol and administration have to be separated and still manageable. We support utilities with NIS2, OT security and operations.
ENERGY & UTILITIES / STARTING POINT
What shapes
your everyday work.
- 01
High criticality by law
Electricity, district heating, gas, drinking water and wastewater are among the sectors of high criticality under the Austrian NIS Act (NISG 2026).
- 02
Control centers and field sites
Substations, pumping stations and elevated water tanks are connected via telecontrol technology. Every connection has to be controlled.
- 03
Critical facilities, few hands
Whether municipal utility or water association: anyone who operates critical facilities needs support that takes the load off their own team.
HOW WE IMPLEMENT IT
Concrete
solutions.
- OWN SOFTWARE
Implement NIS2 obligations in a structured way
Applicability, scope, risk management, supply chain and technical status in a versioned evidence file.
View NIS2 Cockpit - TOMORIS EXPERTS
Isolate process networks
Plan and implement zones and transitions between administration, control systems and field sites based on the IEC 62443 model.
View Network & connectivity - TOMORIS EXPERTS
Control remote access
Provide access for manufacturers and service providers centrally, personalized and logged via firewall and VPN.
View Fortinet Firewall & VPN - OWN SOFTWARE
Detect exposed credentials
Check approved domains against known data breaches and feed matches into a documented response process.
View DarkWatch - TOMORIS UNIVERSITY
Train management and on-call staff
Cybersecurity training for management bodies and exercises based on typical situations, in line with § 31 NISG 2026.
View Cyber security
ENERGY & UTILITIES / YOUR BENEFIT
What you
gain.
- 01
Isolate control systems
Separate administrative IT and process networks with controlled transitions.
- 02
Meet obligations
Build risk management, reporting channels and evidence under NISG 2026.
- 03
Operate crisis-proof
Clarify recovery, emergency communication and responsibilities in advance.
SERVICES & SCOPE
Responsibility starts with clarity.
We clarify in advance which services make sense, who is responsible for what and how you can tell that progress is being made.
- IT/OT segmentation by zones
- NIS2 readiness and evidence file
- Controlled remote access for service providers
- Backup and contingency planning
- Training for management and on-call staff
FRAMEWORK & OBLIGATIONS
What laws and
standards require.
- NISG 2026 (NIS2)
NIS2 in your sector
Electricity, district heating and cooling, oil, natural gas, hydrogen, drinking water and wastewater are listed in Annex 1 NISG 2026. Large entities in these sectors are essential, medium-sized ones important (§ 24(1) no. 3 and (2) no. 1). The act has applied since October 1, 2026; registration takes place within three months (§ 29(3)).
- NISG 2026 (NIS2)
Critical entities under CER
Anyone identified as a critical entity under Directive (EU) 2022/2557 is considered an essential entity regardless of size (§ 24(1) no. 1(f) NISG 2026).
- NISG 2026 (NIS2)
Risk management with minimum content
§ 32(4) NISG 2026 lists, among other things, risk analysis, incident handling, backup and crisis management, supply chain security, vulnerability management, cryptography and multi-factor authentication.
- LAW
Network code on cybersecurity for electricity
For cybersecurity aspects of cross-border electricity flows, the network code in Delegated Regulation (EU) 2024/1366 also applies, in particular to electricity undertakings classified as high-impact or critical-impact entities (Art. 2).
START FOR FREE
Check it
today.
- FREE CHECK
NIS2 applicability check
Am I affected? In 3 minutes
Open (German) - DOWNLOAD
NIS2 Reporting Obligations
Early warning within 24 hours, notification within 72 hours, final report after one month: deadlines, content, and recipients with references to the NISG 2026, plus a checklist.
View and Download - FREE CHECK
DNS security check
DNSSEC, CAA and name servers
Open (German)
WHAT SETS US APART
One partner.
Not four.
- 01FROM A SINGLE SOURCE
Projects, operations, knowledge, software
EXPERTS implements, GRID operates, UNIVERSITY enables your team, NEXT develops further – without handover gaps between different service providers.
- 02OWN PLATFORM
Operations with GRID
Monitoring, backup, security and updates work together in one operating model with clear responsibility.
- 03TRANSPARENCY
Everything in view with INSIGHT
Tickets, reports and roadmap in one role-based customer portal instead of scattered across emails.
- 04PROXIMITY
Personal in DACH
Locations in Marchtrenk, Frankfurt am Main and Zurich – with personal points of contact.
FREQUENTLY ASKED QUESTIONS
Answered
briefly.
Is our municipal utility an essential or important entity?
That depends on sector, activity and size: large entities in Annex 1 are essential, medium-sized ones important. If your company has been identified as a critical entity under the CER Directive, it is considered essential regardless of size. The NIS2 applicability check classifies your information and cites the section.
Does TOMORIS intervene in control systems?
Only within the agreed scope and together with your control system vendors. Our focus is on networks, transitions, access and the IT surrounding the processes; we agree on any interventions in controllers in advance.
By when do we have to register?
Covered entities register within three months of the Austrian NIS Act (NISG 2026) entering into force on October 1, 2026 (§ 29(3)). You assess the exact deadline and your obligations with your legal advisors.
THINKING AHEAD
What goes with it.
- FOR ADMINISTRATION & INFRASTRUCTURE
Public sector
Public administrations carry special responsibility. We support traceable IT operations, clear responsibilities and the protection of sensitive information.
Learn more - FOR YOUR MUNICIPALITY
Municipalities
Municipal office, maintenance depot, school and kindergarten have different requirements. We look at the sites together and plan operations and renewal.
Learn more - FOR HIGH REQUIREMENTS
Military & security agencies
Organizations with elevated protection needs require careful coordination. We clarify requirements, responsibilities and suitable measures before any implementation.
Learn more
- Industry & manufacturing
- Businesses & service providers
- Retail & e-commerce
- Logistics & transport
- Construction, architecture & real estate
- Skilled trades
- Tourism & hospitality
- Education & schools
- Kindergartens & early childhood education
- Healthcare & medical practices
- Care & social services
- Non-profits & associations
- Notaries & law firms
- Tax advisory
- Financial services & insurance
YOUR NEXT STEP
Let’s take the
next step.
Discuss utility IT. Personal and without obligation.