NIS2 in Manufacturing: OT/ICS Cybersecurity & 24-Hour Reporting.

The NIS2 Directive (EU 2022/2555) sorts sectors into Annex I (essential entities: energy, transport, banking, health, water, digital infrastructure) and Annex II (important entities: manufacturing, postal services, waste management, chemicals, food). Manufacturing of certain products — medical devices, computers, motor vehicles, machinery, among others — falls under Annex II. The practical difference: essential entities are subject to proactive supervision by authorities, while important entities are only supervised reactively, after an incident or complaint, although the security obligations are substantially the same.

As a general rule, NIS2 applies to medium and large companies: more than 50 employees or more than €10 million in annual turnover or balance sheet total, within the sectors covered by Annexes I and II. There are exceptions: some entities are covered regardless of size if they provide specific critical services (for example, the sole provider of an essential service in a Member State), and Member States can extend the scope in their national transposition.

IT cybersecurity protects traditional information systems (ERP, email, corporate networks). OT (Operational Technology) and ICS (Industrial Control Systems) cybersecurity protects the systems that control physical processes: PLCs, SCADA, distributed control systems, and plant sensors. The priorities differ: IT prioritises data confidentiality; OT prioritises availability and physical safety, because a cybersecurity failure can halt production or cause an accident. NIS2 requires technical and organisational measures tailored to this difference, rather than applying generic IT controls directly to OT systems.

NIS2 sets a three-stage reporting process: an early warning within 24 hours of becoming aware of a significant incident, a full incident notification within 72 hours including an initial assessment of severity and impact, and a final report within one month, with a detailed description, root cause, and mitigation measures applied. An incident is considered "significant" when it causes or is capable of causing severe operational disruption or considerable financial loss, or affects other persons causing significant material or non-material loss.

Article 21 of NIS2 requires assessing and managing the cybersecurity risks of direct suppliers and service providers, including the quality of secure-development practices from OT/ICS system vendors (PLCs, SCADA, plant control software). This is especially relevant in manufacturing, where many high-impact incidents have entered through equipment or industrial software vendors with remote access to the plant network.

For important entities, the maximum administrative fine is €7 million or 1.4% of global annual turnover, whichever is higher (for essential entities, the maximum is €10 million or 2% of global turnover). Beyond fines, national authorities can impose mandatory corrective measures, security audits, and, in serious cases, temporarily suspend relevant certifications or authorisations, or even temporarily bar responsible managers.

Article 21(2) lists ten minimum areas: risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, security in system acquisition/development/maintenance, policies to assess the effectiveness of measures, basic cyber hygiene and training, cryptography and encryption, human resources security and access control, and the use of multi-factor authentication and secure communications.

IgeraIndustria indexes the full NIS2 Directive alongside your internal OT/ICS cybersecurity documentation — network segmentation policies, industrial asset inventories, incident response plans — letting your security lead ask in plain language which Article 21 measure applies to a specific scenario and what reporting deadline applies. For a deeper look at critical manufacturers, see our FAQ on critical manufacturers under NIS2.