Meet us at the Startup area, and at our workshop on Wednesday 7 October, 4:30 pm. Grimaldi Forum, a ten-minute pitch.
Book the workshopOur Assises workshopBY INDUSTRY · ENERGY & UTILITIES
Substations and telecontrol run on protocols older than your security team, patched during rare outage windows and maintained by contractors whose laptops reach the grid. Mindlapse grades those contractors like the systems they touch and governs the exceptions, without pretending to monitor the grid.
NIS2 essential entity · LPM and OIV · Network code on cybersecurity · Contractors graded
SecurityScorecard · Bitsight · Scovery
A contractor with remote access to a substation is rated like the system it touches.
THE SITUATION
Remote access to a substation, assessed at contract signature and never since.
NIS2, OIV, the network code and CER, each with its own portal and its own authority.
RTUs, protection relays and SCADA on remote sites, where a change is a safety decision before it is a security one.
Renewable producers, aggregators and charging operators entering scope with one part-time security lead.
WHO IS IN SCOPE
Electricity, gas, oil, hydrogen, district heating, drinking water and waste water are NIS2 Annex I sectors: most operators in France will be essential entities once the French law applies, with the CRE and the sector ministries as the reader’s authorities. Electricity entities with a high or critical impact on cross-border flows also fall under the network code on cybersecurity as they are identified. The largest French operators are operators of vital importance under the Code de la défense, a regime whose protected information stays in their own systems. The NIS2 page carries the entity test.
Written for
WHAT MINDLAPSE CHANGES
Surface: Organization Map
Generation, grid, water and retail are entities with their own register, scales and owners; the group reads one consolidated posture and drills down to the entity’s records. A substation is not an object in the register.
Learn more
Surface: Mindlapse Trust Grade
The O&M contractor with remote access to a substation carries a Trust Grade from its assessment, the business impact of the essential service it reaches and external ratings, with the weights in the open.
Learn more
Surface: Risk Posture
Key risk indicators with green, amber and red thresholds, fed by the platform’s built-in feeds and read against the appetite the board approved, with the daily snapshot behind every figure.
Learn more
Surface: Value Chain Map
Each business is a chain of functions and activities with an owner and a criticality; telecontrol, metering and the customer platform sit where they would stop the service, and a contractor under several activities is flagged on the chain.
Learn more
Surface: Derogation lane
The relay firmware that cannot move before the next outage gets a derogation with compensating measures, an approver and an expiry set on the window, so the decision reopens on its own instead of outliving the engineer who signed it.
Learn more
THE OBLIGATIONS MAP
EU rows first, the French specific tagged; every "verifies" cell is a product claim at ledger level, no cell carries a date, and the sentence under the table is the site’s one dated source.
| Regulation | Obligation | What Mindlapse verifies | Surface |
|---|---|---|---|
| NIS2 | Art. 21 · all-hazards risk-management measures | One control set, pre-mapped across frameworks, each control carrying a dated verdict with its source | Control Atlas |
| NIS2 | Art. 23 · incident reporting (the clocks are on the NIS2 page) | Incident scenarios, owners and escalation paths kept current; when the clock starts, the record already carries the entity, the service and the contractors | Cyber Incidents |
| NIS2 | Art. 21(2)(d) · supply-chain security, suppliers and contractors | Contractors with remote access assessed in the context of the system they reach and graded; re-assessment fires on events, not on a calendar | Supplier Hub |
| Network code | Network code on cybersecurity · cross-border risk assessments and minimum controls for the entities it identifies as high-impact or critical-impact | Risk analysis on the method you practice, per entity; the controls in the same atlas as NIS2; no network-code framework claimed in the catalog | Risk Analysis |
| AI Act | Annex III · safety components in the supply of electricity, gas, heating or water, high-risk (dates on the AI Act page) | AI systems located on the value chain, their risks in the same register as every other risk | Value Chain Map |
| LPM / OIV FR | Code de la défense, art. L.1332-1 ff. · the operator-of-vital-importance regime, as the reader’s landscape | Protected OIV information stays in the operator’s own systems; Mindlapse carries the non-classified governance layer: essential-entity controls, contractors, derogations with an outage-window expiry | Derogation lane |
NIS2 was due for transposition across the EU by 17 October 2024. As of September 2026 the French transposition law (the projet de loi résilience, which also recasts the OIV regime) is still before Parliament, and the European Commission referred France to the Court of Justice in July 2026.
A QUARTER, THEN THE DAY THE AUTHORITY ASKS
Four moments of an ordinary quarter in an essential entity, and what the platform had already done; then the day the competent authority asks, in three steps.
A normal quarter
WEEK 1
The RTU derogation comes up for approval.
Approved with two of the three compensating measures in place, an approver at the right level and an expiry set on the outage window.
Surface: Derogation lane
alert: WEEK 6
A BSI advisory names your protection-relay vendor.
The advisory had been matched to the systems you declared, moved the risk and raised a finding; the contractor’s re-assessment fired on its own.
Surface: Risk Register
WEEK 9
The water subsidiary’s two-person team closes its quarter.
On one module and a defined scope, from one action queue sized to the two of them; nothing had to be re-implemented for the group to read it.
Surface: Action queue
verified: WEEK 12
Gap analysis before the pack.
By entity, across NIS2 and the network code, from the same control set: covered, partial and open, with what closing each gap requires.
Surface: Control Atlas
The day the supervisor asks
THE REQUEST
The competent authority asks an essential entity for its Article 21 evidence and the list of exceptions still open.
Both were read from the same register: the controls with their dated verdicts, the derogations with their expiry.
Surface: Control Atlas
WHAT OPENS
The controls with dated verdicts, the derogations with their compensating measures, the contractors on the affected activities.
Each derogation with its approver and its outage-window expiry; each contractor with its grade and the activity it reaches.
Surface: Derogation lane
WHAT IS EXPORTED
The gap analysis by entity and the controls’ evidence.
From Audit mode, scoped to the entity and the framework the authority asked about.
Surface: Audit mode
Illustrative quarter: the moments are fictional, the surfaces are the product’s.
FROM THE FIELD
CYBER COLLECTIVE LAB · Edition 6
The crisis-cell exercise read from the OT side of the table: what the room learned about the contractors who hold remote access when an agent slips out of your hands.
Measured with our design-partner CISOs, figures under continuous validation.
UNDER THE HOOD
FAQ
Yes. Most customers start with a single module on a defined scope, the subscription is set by the headcount band of the organization in scope rather than by users, and the action queue is one list the two of them work through; activating a second module later is an amendment, not a new project.
No. OIV-protected and classified material is out of scope of the shared SaaS and stays in your own systems; Mindlapse carries the non-classified governance layer, the essential-entity controls, the contractors, the derogations. For the most demanding postures it is deployed as a dedicated instance, in your private cloud or on-premise; no SecNumCloud qualification is claimed.
No; it adds cross-border risk assessments and minimum controls for the electricity entities it identifies as high-impact or critical-impact. In Mindlapse both relate to one control set, and what your supervisor asks for, the gap analysis by entity and the controls’ evidence, is exported from the module rather than assembled for the occasion.
Yes. The external rating feeds the EASM signal of the Trust Grade, so a drop moves the signal and fires the re-assessment trigger; the grade is recomputed with the weights in the open, and a signal gone stale counts for less rather than passing for current.
Yes. Each is an entity with scoped roles, its own register and scales inherited from the group where you decide; the group reads the consolidated posture and drills down to the entity’s records. Substations and plants are not objects in the register: the entity is the unit, not the site.
Read it next
The cyber slot as a pack of decisions: accept, fund, defer or transfer, each one click from its evidence.
Learn more
Cyber scored like the other lines: method, appetite, owners, reviews.
Learn more
Your Monday posture: risks, exceptions, suppliers and the pack, from one register.
Learn more
Also by outcome
ESSENTIAL, VERIFIED
A live session on your scope: entities, essential services, contractors, the board view.
Our host’s audience measurement (Vercel) uses no cookies and is not covered by this choice. Google Analytics and marketing trackers stay off until you say otherwise. Read the cookie policy
