Production, processing and distribution of food is in Annex 2 to OUG 155/2024. Medium-sized and large companies are important entities, but the assurance level differs: a medium-sized company has a score of 85 and stays at the basic level, with 34 controls, while a large one has 127.5 and moves to the important level, with 133.
Who is covered by NIS2 in the food industry
Annex 2 to OUG 155/2024 takes over the list in the NIS2 Directive, which uses the definition of a food business in Regulation (EC) No 178/2002. It covers:
- industrial producers of food and drink: dairies, meat plants, industrial bakeries, beverage plants;
- processors: slaughterhouses, mills, oil, canning and frozen food plants;
- food wholesalers;
- not covered: retail, restaurants and small-scale, non-industrial production.
Size is set under Law No. 346/2004: as a rule, 50–249 employees for a medium-sized company and 250 or more for a large one. Small and micro companies are covered only in the special cases set out in the law.
Which assurance level applies
| Organisation size | Entity type | Standard risk score | Assurance level | At self-assessment |
|---|---|---|---|---|
| Small or micro | outside NIS2, except for the cases in the law | 42.5 | basic | 34 controls, threshold 2.5 |
| Medium | important | 85 | basic | 34 controls, threshold 2.5 |
| Large | important | 127.5 | important | 133 controls, threshold 3 |
The standard score is the DNSC value for the sector, multiplied by 1, 2 or 3 according to size. If you operate in several sectors, the highest score applies.
Find your level and maturity score in a few minutes. The calculator opens with the “Food” sector already selected; you choose the size and answer 12 questions.
Calculate the level for foodWhich systems are assessed in a food plant
In a food plant, traceability and the cold chain are as critical as the production line. The assessment usually covers:
- production lines, controllers and packaging and labelling systems;
- temperature monitoring in warehouses, cold rooms and lorries;
- batch traceability, on which a fast product recall depends;
- the ERP, orders from retail chains and electronic invoicing;
- production and delivery planning;
- equipment suppliers’ access to production lines.
JBS, May 2021
At the end of May 2021, a ransomware attack attributed to the REvil group stopped slaughterhouses and plants of JBS, the world’s largest meat processor, in the United States and Australia for at least a day. The company paid a ransom of around 11 million dollars, even though most of its facilities were running again by the time of payment.
The attack showed how fast an IT incident reaches the shelf: a few days of disruption at a single group put pressure on meat supplies.
For a food company, NIS2 asks for what a food safety audit asks for: knowing what you do when a system goes down. The difference is that the continuity plan must also cover information systems: how you produce, label and deliver if the ERP is down for a week.
What comes next
- notification to DNSC, within 30 days from the date OUG 155/2024 becomes applicable to the organisation; the first DNSC fine sanctioned exactly this deadline;
- the risk-level assessment, within 60 days of the DNSC decision;
- the self-assessment, within the following 60 days, on the controls of your level;
- the audit, carried out by a DNSC-certified auditor.
How TRU helps
In the food industry, margins are thin and a stoppage costs money straight away. We start with:
- PenTest, external and internal, with reports within 48 hours of the scan being completed, so that you know what is exposed before an attack;
- SOC 24/7/365, for plants and warehouses working three shifts;
- Proton Workspace, for orders and correspondence with retail chains, encrypted in transit and at rest.
Through CIO-as-a-Service we coordinate the inventory, the relationship with suppliers and the remediation plan. The audit is carried out by DNSC-certified auditors who are TRU partners.
Frequently asked questions
Is a supermarket chain covered under food?
Not for retail, which is not in the annex. Only wholesale distribution and industrial production and processing are covered.
Is a medium-sized bakery covered?
If production is industrial and the company is medium-sized, yes, as an important entity at the basic level. An artisan bakery selling in its own shops, as a rule, no.
When does a food company move to the important level?
When it is large, because the standard score reaches 127.5. Or when it also operates in a sector with a higher score, for example chemical distribution, because the highest score then applies.
Sources
OUG 155/2024 (in Romanian) · Directive (EU) 2022/2555 · DNSC risk-level methodology (in Romanian) · CNBC, JBS paid 11 million dollars, 9 June 2021.