NIS2 Mechanical Engineering: Manufacturer Obligations and OT Security

Main article: NIS2 guide — scope, obligations, fines and roadmap at a glance. All articles on the topic are in the NIS2 knowledge area.

Mechanical and plant engineering is listed in Annex II of the NIS2 Directive among the other critical sectors. Two assignments are often confused: manufacturers of medical devices and in vitro diagnostic medical devices belong to manufacturing (Annex II no. 5(a)); only manufacturers of medical devices considered critical during a public health emergency are assigned to the health sector in Annex I. Manufacturers of power-supply components fall under NACE C27 (Annex II no. 5(c)), not under the energy sector, which covers operators and suppliers but not component manufacturers. Anyone operating machine data as a cloud computing service for customers may additionally fall under digital infrastructure (Annex I no. 8; see NIS2 for cloud providers).

1. Is mechanical engineering subject to NIS2?

Yes, above a certain size. Annex II no. 5 of the NIS2 Directive lists the sector "Manufacturing" with six sub-sectors; Annex 2 no. 5 BSIG adopts this list for Germany. Mechanical engineering in the narrower sense is sub-sector (d).

Thresholds: when does NIS2 apply?

The German term is "particularly important entity" (besonders wichtige Einrichtung); "essential entity" is the term used by the Directive and by Austrian law. Size is determined under Recommendation 2003/361/EC without Art. 3(4) of its Annex. Data of partner or linked enterprises are, however, not added where the undertaking is independent of them as regards the nature and operation of its information technology systems (§ 28(4) BSIG). Important for mixed businesses: business activities that are negligible in relation to the overall activity may be disregarded in the assignment (§ 28(3) BSIG). There is no size-independent special rule for manufacturing; among undertakings, the only ones covered irrespective of size are operators of critical installations and certain trust service, DNS, registry and telecommunications providers.

Classification in detail: important entity, NIS2 for enterprises with 50–100 employees and NIS2 implementation in Germany.

2. OT-security specifics: PLC, SCADA, industrial IoT

§ 30(1) BSIG does not distinguish between office IT and production. The measures are intended to avoid disruptions to the availability, integrity and confidentiality of the systems, components and processes that the entity uses for its services. The Directive counts as network and information systems any device that, pursuant to a program, carries out automatic processing of digital data (Art. 6(1)(b)). OT systems do, however, call for different priorities than office IT:

Typical OT weaknesses in mechanical engineering

• Controllers with default passwords or unencrypted engineering protocols
• Remote-maintenance access without multi-factor authentication
• Flat networks without separation between office IT and production
• HMIs running operating systems no longer supported by the vendor
• USB sticks as the route for updates and configurations
• OT devices without logging and monitoring

Recommended OT security measures

1. Segmentation: zones and conduits according to the IEC 62443 series of standards between office IT, MES and production (§ 30(2) no. 9 BSIG: management of ICT systems)
2. OT inventory: record all controllers, HMIs and sensors with their firmware level; the basis is a complete asset inventory
3. Vulnerability management: evaluate the security advisories of component manufacturers and schedule updates in maintenance windows (§ 30(2) no. 5 BSIG)
4. Monitoring: anomaly detection via passive sensors that do not disturb production traffic
5. Remote access: jump servers, multi-factor authentication, approval and recording of every session (§ 30(2) no. 10 BSIG)
6. Secure commissioning: hardening checklists per machine type

Control systems and SCADA from the utilities' perspective are covered in the article NIS2 in energy supply.

3. Cyber Resilience Act + NIS2: interplay

Mechanical engineers with connected products deal with two levels of regulation. NIS2 attaches to the company as an entity. Regulation (EU) 2024/2847 of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act, CRA) attaches to the product that is placed on the market.

The CRA's dates, manufacturer obligations, conformity assessment and penalties follow from the text of the Regulation on EUR-Lex (sources below). In practice a common line pays off: a vulnerability process that covers the company's own systems under § 30(2) no. 5 BSIG can be extended to its own products. The outlook on the CRA is given in the article Compliance future 2027/28.

A third strand is Machinery Regulation (EU) 2023/1230 of 14 June 2023. Since the amendment by Regulation (EU) 2026/1744 it is listed in Annex I Section B of the AI Act. For high-risk AI systems related to machinery, only Art. 6(1), Art. 60a and Art. 102 to 112 AI Act therefore apply directly (Art. 2(2) AI Act). The interlocking is explained in the article AI Act and robotics.

4. Supply chain: what mechanical engineering adds

§ 30(2) no. 4 BSIG (Art. 21(2)(d) NIS2 Directive) requires measures for supply chain security, including the relationships with direct suppliers and service providers. The general approach — inventory, classification, contract clauses, review, repetition — is set out in the article NIS2 supply chain security; a ready-made set of questions is provided by the supplier audit questionnaire. For mechanical engineers, four points come on top:

• Component origin: electronics, sensors and control software often come from suppliers outside the EU and the EEA. The risk assessment should include origin and substitutability.
• Remote-maintenance service providers: in module IND.2.4, the BSI IT-Grundschutz Compendium requires a central remote-maintenance policy and an agreement on how service providers may use the information stored in the machine (IND.2.4.A1).
• Operation after the warranty period: secure support services beyond the warranty period by contract (IND.2.4.A2).
• Exit plan: multi-sourcing, stockpiling of critical components and qualified alternative suppliers; for critical components, a preference for suppliers from the EU and the EEA can make on-site audits easier.

5. Concrete action list for mechanical engineers

The month figures are practice values, not statutory deadlines. The ten areas of § 30(2) BSIG are shown in the overview table; the mapping to ISO 27001 is set out under § 30 BSIG: 10 mandatory measures.

Phase 1: stock-take (months 1–2)

• Check and document sector and size (Annex 2 no. 5 and § 28 BSIG)
• Registration with the Federal Office for Information Security (BSI) via the joint registration facility of the BSI and the BBK, no later than three months after qualifying as an entity (§ 33(1) BSIG); the BSI points out that the statutory registration deadline has already expired. Changes must be notified without undue delay, no later than two weeks after becoming aware (§ 33(5) BSIG; under § 66 BSIG, for the time being in the version applicable until 28 July 2026, which contains the same deadline).
• Asset inventory for IT and OT
• Supplier inventory with criticality
• Review existing evidence (ISO 27001, IEC 62443, TISAX)

Phase 2: risk management (months 3–4)

• Risk analysis for IT and OT, for example according to BSI Standard 200-3 or ISO/IEC 27005 (§ 30(2) no. 1 BSIG)
• Risk register with action plan
• Management: implement the measures and monitor their implementation (§ 38(1)), liability towards the entity for culpably caused damage under the rules of company law (subsection 2), regular training (subsection 3); details in the article § 38 BSIG management liability

Phase 3: technical implementation (months 5–9)

• Multi-factor authentication for privileged access in IT and engineering (§ 30(2) no. 10 BSIG)
• Segmentation of IT and OT according to the IEC 62443 series of standards
• Backup concept including OT: PLC programs, recipes, parameters (§ 30(2) no. 3 BSIG)
• Patch management with OT maintenance windows (§ 30(2) no. 5 BSIG)
• Logging and monitoring of OT via passive sensors
• Hardening of engineering workstations

Phase 4: organisational implementation (months 6–10)

• Information security policy and roles matrix
• Incident response plan with OT escalation and production-stoppage scenarios; reports to the joint reporting office of the BSI and the BBK within 24 hours, 72 hours and one month (§ 32(1) BSIG), at the earliest from the time the reporting channel is set up; procedure in the article NIS2 incident reporting
• BCM with recovery concepts for production (§ 30(2) no. 3 BSIG); see BCM under NIS2
• Training and awareness for office and shop floor (§ 30(2) no. 7 BSIG)
• In-depth OT security training for engineering staff

Phase 5: checking effectiveness (from month 9)

• Internal audits per area of measures and KPIs (§ 30(2) no. 6 BSIG)
• Tabletop exercise with a production scenario
• External certification to ISO 27001 or IEC 62443 as a voluntary option

The NIS2 Kit contains 72 Word, Excel and PowerPoint templates in the version for Germany (BSIG) or Austria (NISG 2026), including scope assessment, sector classification, asset inventory, reporting templates, supplier questionnaire, risk scoring, contract clauses and gap mappings to ISO 27001 and BSI IT-Grundschutz. OT-specific content such as zone models is added by you. Packages: Basic with 66 documents for EUR 990, Plus with the training pack and certificate of participation (Teilnahmenachweis) for EUR 1,390, Komplett with the e-learning as HTML and SCORM 1.2/2004 for EUR 1,690, each net and one-off, with 12 months of legal-status updates. The Cybersecurity Awareness e-learning is available on its own from EUR 490 net.

6. Standards and guidance for OT

Under § 30(2) BSIG, the measures should comply with the state of the art and take into account the relevant European and international standards. For mechanical engineering these are above all:

• IEC 62443: series of standards for the security of industrial automation and control systems, with parts for asset owners, service providers and component manufacturers
• BSI IT-Grundschutz Compendium (Edition 2023), layer IND: IND.1 process control and automation technology, IND.2.2 programmable logic controller (PLC), IND.2.4 machine, IND.3.2 remote maintenance in industrial environments
• BSI ICS Security Compendium: test recommendations and requirements for manufacturers of components
• ISO/IEC 27001: overarching ISMS for office IT and organisation; on setting it up, see Build an ISMS for NIS2

7. Protection of design data and control software

In mechanical engineering the most valuable asset is often not in the office IT but in the know-how:

• CAD design data: repositories with multi-factor authentication, backup and version control with change log
• NC programs and tool paths: often on USB sticks or open network drives; encryption at rest and access logging (§ 30(2) nos. 8 and 9 BSIG)
• Control software and PLC projects: source-code repositories with code signing, protected branches and mandatory reviews
• Machine data, recipes, calibrations: backup and recovery procedures
• Data at the customer's site: machines with a remote-maintenance connection; lay down protective measures and rights of use by contract

A trade secret within the meaning of the German Trade Secrets Act (GeschGehG) exists only if the information is the subject of appropriate confidentiality measures (§ 2 no. 1(b) GeschGehG). These measures overlap with the NIS2 risk analysis but should be documented separately.

Austria: mechanical engineering under the NISG 2026

Austria (AT): the BSIG applies only in Germany. In Austria the NISG 2026 (BGBl. I No. 94/2025) applies; its §§ 2 to 45 and the Annexes have been in force since 1 October 2026 (§ 51(2)). Manufacturing is listed in § 2 no. 16 and in Annex 2. Medium-sized and large undertakings of an Annex 2 type are important entities (§ 24(2)); a medium-sized undertaking is one that employs at least 50 people or reaches an annual turnover exceeding EUR 10 million and an annual balance sheet total exceeding EUR 10 million (§ 25(3)). The competent authority is the Federal Office for Cybersecurity.

More in the article NIS2 Austria (NISG 2026).