For a manufacturer, NIS2 stops being an IT topic the moment the directive reaches the production line: the same obligations cover office systems, PLC controllers and SCADA workstations, and the board answers for them personally. Cybersecurity here is judged on whether an incident on the shop floor can be detected and reported at all.
NIS2 and the manufacturing sector — what changed?
The NIS2 directive significantly expanded the scope of entities covered by cybersecurity regulations. The manufacturing sector, previously largely overlooked by NIS1, has been explicitly included as important entities. This is a fundamental change for European industry.
In practice, this means manufacturing companies with turnover above EUR 10 million or employing more than 50 people must implement comprehensive cybersecurity risk management — covering not only IT but also OT/ICS systems controlling production.
Which manufacturing companies fall under NIS2?
NIS2 covers the manufacturing sector broadly:
- Medical device manufacturing — essential entities
- Computer, electronic and optical product manufacturing — important entities
- Machinery and equipment manufacturing — important entities
- Motor vehicle and transport equipment manufacturing — important entities
- Chemical manufacturing — important entities
- Food manufacturing — important entities
Size criteria: revenue > EUR 10 million or employment > 50 people. Many mid-sized manufacturing companies meet these thresholds.
Key NIS2 requirements for manufacturing
1. Cybersecurity risk management
NIS2 requires implementation of proportionate risk management measures covering:
- Risk analysis — identifying threats to IT and OT systems
- Security policies — procedures covering IT/OT convergence
- Incident handling — IR plan accounting for OT scenarios
- Business continuity — backup, disaster recovery, crisis management
- Supply chain security — OT supplier and integrator assessment
- Security in procurement and system development — verification of new OT devices
- Cybersecurity training — for IT personnel and OT engineers
- Cryptography and encryption — where applicable in OT environments
- Access control and asset management — OT device inventory
- MFA and secure communication — authentication to OT systems
2. Incident reporting
Rigorous reporting timelines:
- 24 hours — initial CSIRT notification of a significant incident
- 72 hours — full report with impact assessment and IoC indicators
- 30 days — final report with root cause analysis and actions taken
For OT environments, this means deploying monitoring that detects incidents and enables analysis within the required timeframes.
3. Management accountability
NIS2 introduces personal liability of management for cybersecurity. Management must:
- Approve risk management measures
- Oversee their implementation
- Undergo cybersecurity training
- Bear responsibility for violations
This is a significant shift for manufacturing, where cybersecurity was traditionally delegated exclusively to the IT department.
OT-specific NIS2 implementation considerations
OT asset inventory
In IT, asset inventory is standard. In OT, it is often the starting point — many companies lack complete knowledge of devices on their production network. The inventory must include:
- PLC/RTU controllers and their firmware versions
- SCADA/HMI systems and their operating systems
- Industrial switches and routers
- Engineering workstations and historian servers
- IoT devices on the shop floor
Risk analysis covering OT
Traditional risk analysis methodologies (ISO 27005) must be extended for OT specifics:
- Physical risk — process manipulation can endanger people
- Availability risk — priority over confidentiality
- Legacy systems — inability to patch
- Maintenance window constraints — 24/7 production
OT monitoring and detection
NIS2 requires continuous monitoring — in OT environments this means:
- Passive network traffic monitoring (without impacting processes)
- Anomaly detection in industrial protocols
- PLC configuration integrity monitoring
- SOC with OT competencies or SOC as a Service
Non-compliance penalties
For important entities (manufacturing sector):
- Up to EUR 7 million or 1.4% of global annual turnover (whichever is higher)
- Personal management liability — possibility of temporary suspension from duties
- Audit orders — regulators can order audits at the company’s expense
Practical NIS2 implementation plan for a factory
Phase 1: Assessment (months 1-2)
- OT/ICS security audit — current state assessment
- IT and OT asset inventory
- Gap analysis against NIS2 requirements
- Mapping suppliers with OT access
Phase 2: Strategy and planning (months 2-3)
- IT and OT risk analysis
- Development of security policies
- Implementation plan with prioritization and budget
- Management training on NIS2 requirements
Phase 3: Technical implementation (months 3-9)
- IT/OT segmentation
- OT monitoring deployment (SOC as a Service)
- OT system hardening
- Access control and identity management
- Backup and OT recovery procedures
Phase 4: Processes and people (months 6-12)
- OT incident response plan
- IT and OT personnel training
- Incident reporting procedures
- Security requirements in supplier contracts
- Regular testing and exercises
Not sure if your company meets NIS2 requirements? Schedule a free consultation — we will assess your readiness and propose an implementation plan.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
