NIS2 Annex II pulls a wide range of manufacturers into scope as important entities. For OT-heavy organisations new to this, the challenge is twofold: secure converged IT/ICS environments and produce the risk-management and incident evidence NIS2 demands, without adding downtime risk.
Aligns with IEC 62443 OT-security practices.
NIS2 for Manufacturing, in three questions
Yes — manufacturing is an “other critical” sector under NIS2 Annex II.
Important entity · NIS2 Annex II (Manufacturing)
Manufacturers of medium size and up are Important entities; medical devices, electronics, machinery and vehicles are named explicitly in Annex II.
NIS2 generally applies from medium-sized up — broadly 50+ staff, or annual turnover / balance-sheet total over €10M. (Medium is under 250 staff and up to €50M turnover or €43M balance sheet; larger than that is a “large” entity.) Some entities are in scope regardless of size, and the exact rules are set by your country’s transposition.
Register with your national competent authority once the transposing law applies.
Put the ten cybersecurity risk-management measures in place — and be able to show them working.
Report significant incidents: a 24-hour early warning, a 72-hour notification, and a final report within a month.
Your management body approves and oversees the measures — and can be held personally liable.
Scope is ultimately set by your national transposition — use the self-checks above, or ask us to confirm against your estate.
What makes NIS2 hard in Manufacturing
New to NIS2
Many manufacturers have never had a security-reporting obligation before and lack a ready evidence trail.
OT/ICS exposure
Production systems were built for uptime, not cyber-resilience, and an incident on the line is expensive by the minute.
Supplier-driven risk
Just-in-time supply chains widen exposure, and NIS2 expects that risk to be managed and evidenced.
The evidence layer, tuned for Manufacturing
OT-aware live inventory
A continuously reconciled map of IT and OT/ICS assets and dependencies, the foundation for Article 21 risk management.
Readiness scoring from day one
A live score against the 10 Article 21 measures, so a first-time entity sees exactly where the gaps are.
Incident reporting, ready to file
Article 23 early-warning and full reports generated from the operational graph, ready for you to review and submit.
Board accountability
Quarterly evidence for Article 20 due-diligence, defensible without a dedicated compliance team.