Manufacturing and industry

In manufacturing, what costs money is a line that stands still. A security risk therefore shows not as a data leak but as an undelivered order and a contractual penalty — and the more tightly production is connected to office IT, the shorter the path from an ordinary incident on a computer to a stoppage on the shop floor.

Which regimes usually concern you

It is usually a combination of several things. Which of them carries the weight for you depends on what you make and for whom.

• Cybersecurity (NIS2). Directive (EU) 2022/2555 does not cover manufacturing as a whole: among the other critical sectors in its Annex II it names only selected groups of manufactured products. Where it applies, it does so through the national law of each Member State. Whether it covers you, and in which regime, depends on what you manufacture, on your size and on the national rules — it cannot be inferred from the industry alone.

• ISO/IEC 27001. It usually comes as a requirement of a customer or a tender. It pays to find out first whether the customer insists on a certificate or whether a documented management system is enough — the difference is months of work. The certificate is issued by an accredited certification body, not by an adviser.

• TISAX. If you supply the automotive industry, your customer may ask for a TISAX label. The assessment may be carried out only by a provider accredited by ENX — more in Automotive industry.

• Business continuity (ISO 22301). A stoppage is the risk the business feels first. ISO 22301 organises continuity of production into one system instead of several sets of documents: Business continuity management (ISO 22301).

• Cyber Resilience Act. Regulation (EU) 2024/2847 places requirements mainly on manufacturers of products with digital elements. It concerns you as a manufacturer if you place such products on the market yourself — and as a buyer when you purchase components for production lines and control systems.

• GDPR. It concerns every employer. In manufacturing the focus is usually attendance records, camera systems and agency workers — the areas where documentation and reality tend to drift apart.

Operational technology is an open question

Audit scopes now often cover operational technology as well as information systems — control systems, production lines and building technology. Such systems cannot be assessed with the same methods as office IT: active scanning can bring down a controller, and a shutdown for the sake of an audit costs more than the audit itself.

We mention this as a risk on your side, not a promise on ours. Whether and to what extent we assess operational technology ourselves is agreed case by case when the scope is set — for part of the environment we bring in a specialist in industrial control systems. Claiming more for these systems than we can evidence would serve neither us nor you.

We do not carry out penetration tests, threat-led or otherwise.

What we do for manufacturing

We assess whether and in which regime the rules apply to you, and carry out a risk analysis including asset owners and measures linked to specific risks. We prepare the security documentation and accompany you through the audit. If your customer also asks for ISO/IEC 27001 or a security questionnaire, the same system covers it — not a second project and not a risk analysis paid for twice.