Question 1

Does NIS2 apply to manufacturing companies?

Accepted Answer

Yes. NIS2 extends cybersecurity obligations to many manufacturing sub-sectors under Annex II — including medical devices, electronics, electrical equipment, machinery, motor vehicles, other transport equipment, chemicals and food — and to pharmaceutical and emergency-critical medical-device production under Annex I. Medium and large companies in these sectors are in scope.

Question 2

What's the difference between an 'essential' and an 'important' entity?

Accepted Answer

Both must meet the same security measures. The difference is supervision and penalties: essential entities (typically large operators in Annex I sectors) face proactive supervision and higher fines; important entities face reactive supervision, triggered when non-compliance is suspected.

Question 3

How is company size determined?

Accepted Answer

NIS2 uses the EU SME definition. You're generally in scope if you have at least 50 employees or more than €10M turnover. Large means 250+ employees or over €50M turnover (with a €43M balance-sheet element). Below those thresholds you're usually out of direct scope, subject to special cases.

Question 4

What are the incident-reporting deadlines?

Accepted Answer

For a significant incident: an early warning to your CSIRT within 24 hours, an incident notification with an initial assessment within 72 hours, and a detailed final report within one month.

Question 5

Does NIS2 cover our OT / factory-floor systems?

Accepted Answer

Yes. Scope covers the IT and OT that support production — SCADA, PLCs, DCS, industrial IoT, HMIs and engineering workstations — not just office IT. Standards such as IEC 62443 help map NIS2 measures onto OT environments.

Question 6

When did NIS2 take effect and what are the penalties?

Accepted Answer

NIS2 entered into force in January 2023 and applied from 18 October 2024, implemented through national law (in Poland, the amended Act on the National Cybersecurity System). Fines reach up to €10M or 2% of global turnover for essential entities, with liability for management.

Question 7

What is OT, and does NIS2 cover it?

Accepted Answer

OT (operational technology) is the hardware and software that directly monitors or controls physical equipment and industrial processes — as opposed to IT, which handles data and business systems. A simple test: if it makes a motor turn, opens a valve or reads a sensor, it's OT; if it stores, analyses or reports the data afterwards, it's IT. On a factory floor, OT includes PLCs, SCADA and DCS systems, HMIs, industrial IoT sensors and the production machines themselves. NIS2 explicitly covers the OT that supports your operations, not just office IT, because an attack on OT can halt production or create safety hazards. The IEC 62443 standard is the recognised way to secure OT and maps directly onto the NIS2 Article 21 measures.

Question 8

Is my accounting or professional-services firm in scope?

Accepted Answer

Accounting, bookkeeping and audit firms are not a NIS2 sector — they don't appear in Annex I or II — so a standalone professional-services firm is generally not directly in scope. This is different from the financial sector: banks and financial-market infrastructure are covered under Annex I, but that does not extend to accountants. You can still be pulled in contractually if you supply an in-scope client, though the pressure is usually lighter for services that don't touch the client's network, OT or critical operations. In the checker, choose 'Other / not listed' as your sector to see this outcome.

Article	Obligation	Control area	What an audit checks
Art. 20	Management oversight	Governance	Board-approved strategy; training records for leaders and staff.
Art. 21(2)(a)	Risk-management policies	Risk management	Documented policy and risk register covering IT and OT.
Art. 21(2)(b)	Incident handling	Incident response	IR plan, roles and escalation; evidence of exercises.
Art. 21(2)(c)	Business continuity	Continuity & DR	BC / DR plan, backups and a recent restore test.
Art. 21(2)(d)	Supply-chain security	Vendor management	Supplier register, risk criteria and security clauses.
Art. 21(2)(e)	Secure acquisition & development	Secure SDLC / patching	Change control, patch schedule and vulnerability handling.
Art. 21(2)(f)	Effectiveness testing	Audit & assurance	Audit reports, scans and penetration-test results.
Art. 21(2)(g)	Basic cyber hygiene & training	Technical controls	Segmentation, endpoint protection and awareness training.
Art. 21(2)(h)	Cryptography & encryption	Encryption	Encryption policy, data at rest / in transit, key management.
Art. 21(2)(i)	HR security & access control	Access & assets	Least privilege, access reviews and asset inventory.
Art. 21(2)(j)	Multi-factor authentication	Authentication	MFA on remote / admin access; secure communications.
Art. 23	Incident reporting	Notification	24h early warning, 72h notification, 1-month final report.

Check your NIS2 obligations

1 · Are you in scope?

NIS2 obligations at a glance

NIS2 for manufacturers — FAQ

Turn your NIS2 result into a plan