Manufacturing is in Annex 2 to OUG 155/2024 and has a narrow definition: only medical device manufacturers and the branches in NACE divisions C26–C30 are covered. Medium-sized and large companies are important entities, with standard scores of 115 and 172.5, so the important level.
Which manufacturers are covered by NIS2
Annex 2 lists exactly which branches are covered; the rest of manufacturing stays outside the sector:
- manufacturers of medical devices and in vitro diagnostic medical devices, other than the critical ones classified under health;
- manufacture of computer, electronic and optical products (division C26);
- manufacture of electrical equipment (C27);
- manufacture of machinery and equipment (C28);
- manufacture of motor vehicles, trailers and semi-trailers (C29), including parts and equipment for motor vehicles;
- manufacture of other transport equipment (C30): ships, rolling stock, aircraft.
Size is set under Law No. 346/2004: as a rule, 50–249 employees for a medium-sized company and 250 or more for a large one. Small and micro companies are covered only in the special cases set out in the law.
Which assurance level applies
| Organisation size | Entity type | Standard risk score | Assurance level | At self-assessment |
|---|---|---|---|---|
| Small or micro | outside NIS2, except for the cases in the law | 57.5 | basic | 34 controls, threshold 2.5 |
| Medium | important | 115 | important | 133 controls, threshold 3 |
| Large | important | 172.5 | important | 133 controls, threshold 3 |
The standard score is the DNSC value for the sector, multiplied by 1, 2 or 3 according to size. If you operate in several sectors, the highest score applies.
Find your level and maturity score in a few minutes. The calculator opens with the “Manufacturing” sector already selected; you choose the size and answer 12 questions.
Calculate the level for manufacturingWhich systems are assessed in a factory
In a factory, the assessment covers both the office and the shop floor. It usually includes:
- the manufacturing execution system and its link to the ERP;
- networked controllers, robots and CNC machines;
- the exchange of orders and delivery notes with clients, through EDI or their portals;
- technical documentation, drawings and machine programs, often owned by the client;
- end-of-line testing and quality systems;
- remote access by machine makers, for servicing.
Kojima and Toyota, March 2022
At the end of February 2022, Kojima Industries, a supplier of plastic components to Toyota, was hit by a cyberattack. On 1 March, Toyota stopped 28 production lines at 14 plants in Japan, because the ordering system with suppliers no longer worked. Around 13,000 vehicles were not built.
The lesson for an automotive supplier in Romania: your client works with minimal stock, and your ordering and delivery system is part of its production line. If you are a medium-sized or large company in division C29, you are covered by NIS2 too. If you are small, the client will require security measures through the contract anyway.
The automotive industry also has its own supplier standard, TISAX, based on the VDA ISA catalogue. Many controls overlap with NIS2, so you can prepare them together, with one inventory and one remediation plan.
What comes next
- notification to DNSC, within 30 days from the date OUG 155/2024 becomes applicable to the organisation; the first DNSC fine sanctioned exactly this deadline;
- the risk-level assessment, within 60 days of the DNSC decision;
- the self-assessment, within the following 60 days, on the controls of your level;
- the audit, carried out by a DNSC-certified auditor.
How TRU helps
In factories, the goal is not to stop the line, either through an attack or through testing. We start with:
- PenTest, external and internal, on the IT network and the crossing points to the shop floor, with reports within 48 hours of the scan being completed; production equipment is tested only as planned;
- SOC 24/7/365, for factories working in shifts and at weekends;
- Proton Workspace, for technical documentation and drawings received from clients, encrypted in transit and at rest, with the encryption keys under your control.
Through CIO-as-a-Service we coordinate the inventory, the relationship with suppliers and the remediation plan. The audit is carried out by DNSC-certified auditors who are TRU partners.
Frequently asked questions
We make furniture. Are we covered under manufacturing?
No. The NIS2 manufacturing sector covers only divisions C26–C30 and medical devices. You can be covered another way only if DNSC designates you.
We make vehicle wiring harnesses. Are we covered?
Yes, if the company is medium-sized or large: electrical and electronic equipment for motor vehicles is part of division C29.
What level does a large factory have?
The important level: the standard score is 172.5, below the 200 threshold. A large factory making critical medical devices, classified under health, would however have 217.5, the essential level.
Sources
OUG 155/2024 (in Romanian) · Directive (EU) 2022/2555 · DNSC risk-level methodology (in Romanian) · Security Affairs, Toyota halts production, 28 February 2022.