NIS2 Compliance for Manufacturing: OT & Industrial Control System Security

Why OT Security Is Different

• Availability over confidentiality: In IT, data confidentiality is priority. In OT, uptime is everything. A production line that stops costs €10K-100K+ per hour.
• Legacy systems: PLCs running firmware from 2005. Windows XP HMI stations. Protocols designed without authentication (Modbus, OPC Classic). These can't be patched or replaced easily.
• Physical safety: OT systems control physical processes — temperature, pressure, motion, chemical mixing. A cyber attack on OT can cause physical harm.
• Change management: Every change to an OT system requires validation against process safety. You can't "just patch" a PLC controlling a blast furnace.
• 24/7 operations: Many manufacturing processes run continuously. Maintenance windows for security updates may only exist during annual shutdowns.

Network Segmentation (Purdue Model)

The Purdue/ISA-95 model remains the gold standard for OT network architecture:

• Level 0-1 (Process): Sensors, actuators, PLCs — isolated from all external networks
• Level 2 (Control): SCADA, HMI, engineering workstations — limited access from Level 3
• Level 3 (Operations): MES, historian, OT DMZ — controlled interface between IT and OT
• Level 3.5 (DMZ): Data diodes, jump servers, one-way data transfer from OT to IT
• Level 4-5 (Enterprise): ERP, business systems, internet access — standard IT security applies

NIS2 requires documented network architecture. If your IT and OT networks are flat (no segmentation), this is your highest-priority remediation.

Asset Inventory — The Foundation

• You can't protect what you don't know exists. Many manufacturers don't have a complete inventory of OT assets — especially older facilities.
• Passive discovery: Tools like Claroty, Nozomi Networks, or Dragos can passively discover OT assets by monitoring network traffic — no disruption to production.
• Classify by criticality: Which systems, if compromised, would stop production? Cause safety incidents? Affect product quality?
• Firmware versions: Document firmware/software versions on all PLCs, HMIs, and network devices. Map against known CVEs.

Manufacturing incident response must address both cyber and physical dimensions:

• Detection: OT-aware monitoring (not just IT SIEM). Network anomaly detection on OT protocols. Physical process anomaly detection (unexpected temperature, pressure, speed changes).
• Containment: Pre-planned network isolation procedures. Know which switches/firewalls to reconfigure. Have tested fallback to manual operations.
• Safety first: If a cyber incident could affect physical safety, initiate safe shutdown procedures. Cyber response is secondary to human safety.
• NIS2 reporting: 24-hour early warning, 72-hour notification, 1-month final report. Include production impact assessment.
• Recovery: PLC programme backups (verified and current). Known-good firmware images. Tested restoration procedures.

• OT vendor access: Siemens, Rockwell, ABB, Schneider — all require remote access for support. Must be controlled, monitored, and time-limited.
• MES/ERP integration: SAP or similar connecting to production — this IT/OT bridge is a prime attack vector
• Industrial IoT: New sensors and edge devices connecting to cloud platforms — each one is a potential entry point into the OT network
• CRA interaction: From December 2027, all products with digital elements (including industrial control components) must meet CRA cybersecurity requirements. This will improve baseline security of new OT equipment.