IT security in production

With the entry into force of the Network and Information Security 2 Directive (NIS2) in spring 2023 – which must be transposed into national law by October 18, 2024 – the European Union is sending a clear signal. This directive expands the definition of security-critical key sectors to include companies in the manufacturing industry.

It requires companies to implement appropriate technical and organizational measures to protect their IT and OT systems and to report cyber incidents immediately. The goal is to increase resilience against cyberattacks across Europe and ensure a uniform level of security. For many companies, NIS-2 marks the first time they face direct legal responsibility in the area of cybersecurity – with specific requirements, liability provisions, and penalties for violations.

That is why we assess whether the NIS 2 Directive applies to your company and support you in its implementation so that you can meet the compliance requirements.

With the Cyber Resilience Act (CRA), the European Union is setting another milestone in the field of cybersecurity. The regulation, which came into effect at the end of 2024, requires manufacturers and providers of digital products to implement comprehensive security measures – across the entire product lifecycle.

The goal of the CRA is to establish a uniform level of protection for so-called “products with digital elements.” These include, among others, connected devices, software, and industrial control systems. In the future, companies must demonstrate that their products meet fundamental security requirements – from development and market release through to updates and support. Reporting obligations for security incidents are also stipulated.

The focus is on manufacturers, distributors, and importers, who will be required in the future to ensure IT security already during development (Security by Design) and throughout the entire lifecycle of their products. The CRA requires, among other things, risk analyses, regular security updates, the remediation of vulnerabilities, and clear documentation.

For many companies, the CRA represents a fundamental shift in development, quality assurance, and product responsibility – with clearly defined obligations, CE marking requirements, and market surveillance measures in the event of non-compliance.

That is why we assess whether your products fall within the scope of the CRA and support you in its implementation – in a practical and targeted manner.

With the EU Machinery Regulation (EU) 2023/1230, the European Union is setting the course for modern, safe, and digital machinery legislation. The regulation entered into force on July 19, 2023, and will be binding in all member states as of January 20, 2027.

The focus is on the safety and conformity of machinery and related products – taking into account digital technologies such as software, artificial intelligence, and remote access. The regulation sets clear requirements for design, risk assessment, and documentation. New obligations for manufacturers, importers, and distributors are also established, including CE marking and market surveillance.

For manufacturing companies, this means that IT security is becoming an integral part of machine safety – and thus also a prerequisite for CE marking.

That is why we analyze for you whether and how the new Machinery Regulation affects your products and support you in its secure implementation – from risk management to technical documentation.