NIS2 for Manufacturers: Scope, Security Measures and Incident Reports
Check whether your plant is in scope, document the Article 21 measures, have management approve them and rehearse reporting.
In Short
- Pharma, device, chemical, food listed.
- Early warning within 24 hours.
- Management approves the measures.
Directive (EU) 2022/2555 (NIS2) requires medium and large entities in listed sectors to manage cybersecurity risk and report significant incidents. Member States had to apply their national rules from 18 October 2024. Annexes I and II name pharmaceutical manufacturing, medical device and IVD manufacturing, chemicals and industrial food production. DORA, Regulation (EU) 2022/2554, is a separate regime for the financial sector and was not opened for this guide. This is orientation, not legal advice; national law decides the detail. Sources checked 4 Oct 2026.
Are you in scope?
Article 2 applies NIS2 to entities of a type in Annex I or II that are at least medium-sized and operate in the EU. Annex I's health sector includes entities manufacturing basic pharmaceutical products and preparations (NACE C21) and certain critical medical devices.
More on are you in scope?
Annex II covers manufacturers of medical devices and IVDs, manufacturers and distributors of chemicals, and food businesses engaged in industrial production, processing and wholesale distribution. Article 3 then sorts entities into essential and important; large Annex I entities are generally essential. Member States can add entities regardless of size, so check your national transposing law and any registration duty.
The Ten Minimum Measures
Article 21(1) requires appropriate and proportionate technical, operational and organisational measures, taking account of the state of the art, cost, exposure, size and likely severity. Article 21(2) lists at least: risk analysis and information security policies; incident handling; business continuity, backups and crisis management; supply chain security; secure acquisition, development and maintenance, including vulnerability handling; ways to assess whether measures work; cyber hygiene and training; cryptography; human resources security, access control and asset management; and multi-factor authentication or secured communications where appropriate.
Article 21(2) measures mapped to existing records
| Measure | Typical existing record |
|---|---|
| Supply chain security | Supplier qualification file |
| Business continuity and backups | Backup and restore test records |
| Access control and asset management | User access reviews, asset register |
| Training and cyber hygiene | Training matrix |
- Supply chain security
- Typical existing record
- Supplier qualification file
- Business continuity and backups
- Typical existing record
- Backup and restore test records
- Access control and asset management
- Typical existing record
- User access reviews, asset register
- Training and cyber hygiene
- Typical existing record
- Training matrix
More on the Ten Minimum Measures
The measures cover the network and information systems you use for operations, which can include plant systems.
Management bodies are accountable
Article 20 requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures, oversee their implementation and be liable for infringements of Article 21, subject to national law. Members of management bodies must follow training, and entities are encouraged to offer similar training to employees regularly.
More on management bodies are accountable
In practice this means a documented approval of the security programme, a record of who attended training and when, and periodic management review of whether the measures still fit the risk, kept with the same discipline as quality management review.
Reporting a Significant Incident
Article 23 defines a significant incident as one that has caused or can cause severe operational disruption or financial loss, or considerable damage to others. Entities notify their CSIRT or competent authority in stages: an early warning without undue delay and within 24 hours of becoming aware; an incident notification within 72 hours with an initial assessment of severity and impact; intermediate reports on request; and a final report within one month of the notification, describing the incident, likely root cause, mitigation and any cross-border impact.
Worked example: incident INC-552 (ransomware on a packaging line server)
- Hour 0IT confirms incident; awareness time recorded
- Hour 20Early warning sent to CSIRT
- Hour 70Incident notification with initial severity assessment
- On requestIntermediate status report
- +1 monthFinal report: root cause and mitigation
More on reporting a Significant Incident
People decide whether an incident is significant; the record should show when awareness began.
Where quality and security meet
Many NIS2 measures overlap with GMP and quality system controls already in place: access control and user management, backup and restore, supplier qualification, change control and training. Linking them avoids two parallel systems.
More on where quality and security meet
Keep the asset register, supplier assessments, change records and incident timelines in controlled records, and let your security and quality owners review them together. The Directive does not prescribe specific software, certifications or tools, and implementing acts and national laws add sector detail that this guide does not cover.
Questions
Does NIS2 apply to pharmaceutical manufacturers?
Entities manufacturing basic pharmaceutical products and preparations are listed in Annex I. Medium or larger entities are generally in scope, subject to national transposition.
What are the NIS2 incident reporting deadlines?
An early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report within one month of that notification, under Article 23(4).
Does DORA apply to manufacturers?
DORA, Regulation (EU) 2022/2554, targets financial entities and their ICT providers. It was not opened for this guide, so confirm any exposure with counsel.
Who must approve NIS2 security measures?
The management bodies of essential and important entities, under Article 20, which also requires management body members to follow cybersecurity training.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.