NIS2 OT Security It has been a legal requirement in production since December 6, 2025. The NIS2 Implementation Act took effect on that date. BSI Act The regulation was amended without a transition period, and since then, production networks have been explicitly included among the systems for which companies must demonstrate security.
For plant management and maintenance, this changes the order of priorities. Until now, network segmentation was a hallmark of good production IT. Now, along with a comprehensive asset inventory, it is a prerequisite for being able to report what happened at all in the event of an emergency.
To comply with NIS2 OT security requirements, manufacturing companies must demonstrably secure their network and information systems—including production control systems—once certain thresholds are reached. This includes network segmentation between IT and OT, an up-to-date asset inventory, regulated patch management, and a three-tiered Registration System with deadlines of 24 hours, 72 hours, and one month. Under Section 38 of the BSIG, management must approve the risk management measures and oversee their implementation. If management culpably violates this duty, it is liable internally to its own institution.
Who Is Covered by the NIS2 Implementation Act
The law distinguishes between particularly important and important facilities. The first category includes, for example, energy suppliers, water utilities, and public transportation agencies. For the manufacturing sector, which is classified as an “other critical sector,” the threshold is lower: Companies with 50 or more employees or annual revenue of 10 million euros are generally considered important facilities, provided the sector is covered by the BSI.
The number of affected organizations in Germany has thus risen from about 4,500 under the old IT Security Act to about 29,500 has increased. Anyone who was already included in this group when the regulation took effect on December 6, 2025, was required to register with the BSI by March 6, 2026. For all those who exceed the thresholds at a later date, the same three-month deadline applies starting from the date on which the organization is first deemed to be affected.
What NIS2 OT Security Actually Means in Production
OT systems operate differently from traditional IT. In manufacturing, availability takes precedence over confidentiality; a furnace that comes to a standstill or a production line that is interrupted immediately costs money. A security update that runs overnight on an office PC can cause a control system to crash. Many existing systems run on operating systems for which patches are no longer available anyway.
NIS2 nevertheless requires state-of-the-art risk management measures, and the established reference framework for this is the IEC 62443 Series of Standards. It describes security zones and controlled transitions between them, based on the Purdue model. In practice, this means: The office network and the production network must be physically or logically separated; remote maintenance must be conducted via a secure gateway; and direct Internet access from the production network is strictly prohibited. Furthermore, access to control systems should only be granted via multi-factor authentication through a logged jump server, not via a shared password directly from the office network.
A comprehensive asset inventory is the foundation of NIS2 OT security. Without an overview of which control system is connected where in the network and running which firmware, it is impossible to assess the patch status or, in the event of an emergency, determine the extent of the impact. This is precisely where the biggest gap arises in many companies, because IT inventories are maintained while OT inventories are not.
Since the NIS2 Implementation Act took effect, so many companies and federal agencies have been subject to the new requirements—more than six times as many as before.
Security Insider, May 2026
Reporting Requirements and Their Deadlines
Whereas a single-step notification used to suffice, a three-tier registration system. An early warning must be received by the BSI within 24 hours of discovery; a more detailed report must follow within 72 hours; and a final report, including a root cause analysis and corrective measures, is due no later than one month after discovery. In this process, the BSI follows the principle of “speed over completeness”; missing details may be submitted later.
These deadlines cannot be improvised. Anyone who waits until an incident occurs to clarify these matters, anyone who identifies an incident, and anyone who drafts the report wastes valuable hours. A documented procedure with clear responsibilities for both IT and OT is therefore part of the obligation to provide evidence.
Management Liability Under Section 38 of the BSIG
The often-overlooked aspect of the law pertains to management itself, not the IT department. According to Section 38 of the BSIG, management must approve risk management measures, monitor their implementation, and undergo regular training to be able to assess risks on their own. This training requirement expressly cannot be delegated. An IT director cannot fulfill this requirement on behalf of management.
If management culpably violates these obligations, it is liable to its own entity in accordance with the provisions of the applicable corporate law—in the case of a GmbH, pursuant to Section 43 of the German Limited Liability Companies Act (GmbHG). This is an internal liability toward the company itself, not a direct claim by third parties; however, it may affect the manager’s personal assets. Separate from this are the fines imposed on the entity itself, which are tiered up to 10 million euros or 2 percent of global annual revenue for particularly important entities.
| Stage | Deadline | Contents |
|---|---|---|
| Early Warning | 24 hours | Initial report upon becoming aware of the incident, even if the information is incomplete |
| Notification | 72 hours | Supplementary Assessment of Severity and Impact |
| Final Report | 1 month | Root Cause Analysis, Corrective Actions Taken and Planned |
Traceability requires data from monitoring
NIS2 OT Security requires data as proof. In case of doubt, a BSI auditor does not ask whether a company considers network segmentation to be appropriate, but rather requests the network diagram, the firewall rules, and the date of the last patch on a specific control system. It is precisely this evidence that is not generated by a statement of intent, but rather through ongoing Plant Monitoring, which records states rather than merely asserting them.
Anyone who is already building a system that captures machine data for availability and performance metrics often already has half the infrastructure for an OT asset inventory. The other half is separating the networks through which this data flows. The same data path often provides the basis for Energy Monitoring, because consumption and status data usually travel along the same paths. Access Rights to Machine Data and security requirements therefore belong in the same planning.
A monitoring system does not replace an information security management system or a risk analysis under Section 30 of the BSIG. It provides the evidence required by an ISMS, but does not replace either the organizational processes or management’s obligation to provide training. For very old control systems without any network interface, even the best monitoring system will not provide any data; in such cases, physical isolation remains the only compensatory measure.
Create an asset inventory and documentation
It often isn't until a crisis strikes that it becomes clear whether your own asset inventory is sufficient for a BSI audit. Taking a look at the available data in advance reveals any gaps that still exist.
Frequently Asked Questions
When does NIS2 take effect for manufacturing companies?
The NIS2 Implementation Act took effect on December 6, 2025, without a transition period. Those who already met the thresholds at that time were required to register with the BSI by March 6, 2026. Those who exceed the thresholds at a later date have three months from that date to register. The substantive obligations take effect immediately upon reaching the threshold, regardless of whether the registration itself has already been completed. The start of the deadline is thus determined by when the threshold is actually exceeded, not by the date of registration. Classification in individual cases is the responsibility of the legal department or law firm.
Does a production control system without an Internet connection also count as an OT system under NIS2?
Yes, if it is part of the organization’s network and information systems. NIS2 does not distinguish based on whether a system is directly connected to the Internet, but rather on whether it is relevant to operations. Although an isolated control system without any network connectivity does not fall under traditional network security measures, it must still be included in the risk analysis and asset inventory. If it fails or is tampered with later, this is still a reportable security incident in cases of doubt, because what matters is the impact on production, not the transmission path.
Can management delegate NIS2 responsibilities to the IT department?
Operational tasks can be delegated, but responsibility cannot. Section 38 of the BSIG requires management to personally approve and monitor risk management measures and to participate in training sessions—a responsibility that cannot be delegated. „The IT department is already handling that“ is expressly insufficient as evidence during a BSI audit. If management culpably violates its monitoring obligation, it is liable internally within its own organization, regardless of how well the IT department is structured operationally.
torck has been building data paths from the control system to the dashboard for years and is therefore familiar with both aspects of the NIS2 requirements for OT security in production: the technical integration and the documentation required for an audit. Our development teams in Maxhütte-Haidhof, Vienna, and Rabat work under a contract governed by German law with the German company torck GmbH and a German-speaking point of contact, without the friction losses associated with a chain of subcontractors. If you’d like to see how network segmentation, asset inventory, and record-keeping work together in a unified Plant Monitoring If you'd like to combine them, please contact us.
This article refers to laws and regulations to put technical decisions in context. It is not legal advice. Whether and how a rule applies to your company is a question for your legal department or a law firm.
German 
English 
French