No, unless you are a large energy or transport group, or an operator of vital importance. For these organisations, PNACC 3 planned a vulnerability study by the end of 2024 and an adaptation plan in 2025. For all other businesses, the plan is an incentive. However, businesses subject to CSRD must document their physical risks by site, which requires the same work under another name.
Read the source article: PNACC 3: what obligations do businesses face?