Written by the NIS2Compass Team ·
Machinery manufacturers are listed in Annex 2 BSIG (no. 5.4, division 28 of the NACE Rev. 2 classification). With 50 or more employees, or more than EUR 10 million in both annual turnover and balance sheet total, they have been important entities under the German NIS2UmsuCG since 6 December 2025: with registration with the BSI (Section 33 BSIG), risk management measures (Section 30), reporting duty (Section 32) and management duties (Section 38). If you have TISAX or ISO 27001, you are not starting from zero. NIS2Compass shows which gaps typically remain and guides you step by step through implementation, without parallel bureaucracy.
Sector
Annex 2 BSIG, manufacturing sector: machinery (no. 5.4, NACE division 28). Also covered: computer and electronic products (26), electrical equipment (27), motor vehicles and parts (29), other transport equipment (30) and medical devices.
Size
From 50 employees or more than EUR 10 million in both annual turnover and balance sheet total (Section 28(2) BSIG). Size follows SME Recommendation 2003/361/EC; data of linked enterprises is not added if your IT is operated independently (Section 28(4) BSIG).
Classification
Section 28 BSIG provides no size-based classification as an essential entity for Annex 2 sectors: machinery manufacturers are important entities unless they operate a critical installation. Activities that are negligible in relation to the overall business may be disregarded (Section 28(3) BSIG).
PLCs, CNC controls and robot cells often run for many years on unchanged firmware. Section 30(2) no. 5 BSIG requires vulnerability management. Where no update is possible, documented alternative measures are needed.
Suppliers to automotive customers often already hold a TISAX label. According to the BSI, a comprehensively implemented ISO 27001 usually covers a large part of Section 30 BSIG, but not automatically everything. The gaps must be identified specifically.
Nobody wants to publicise incidents involving data theft. Reports under Section 32 BSIG go to the joint reporting office of the BSI and the BBK. The BSI may order you to inform your customers in individual cases (Section 35 BSIG).
Equipment suppliers, integrators and engineering service providers access machines remotely. These relationships fall under supply chain security under Section 30(2) no. 4 BSIG.
NIS2 applies to your own IT and production. For the machines you place on the market, the Cyber Resilience Act and the Machinery Regulation apply in addition. Mixing them up means planning with the wrong framework.
In family-owned companies, IT security often rests with the IT manager alone. Section 38 BSIG requires management to implement the measures, monitor their implementation and attend training regularly.
Example: A family-owned machinery manufacturer with 280 employees and five people in IT has held a TISAX label for years because automotive customers require it. Since 6 December 2025, the company has also been subject to NIS2 as an important entity under Annex 2 BSIG. Using the NIS2 Guide, the IT manager checks step by step which Section 30 BSIG requirements the existing ISMS already covers. What remains are the points the BSI names as typical gaps for ISO 27001 companies: registration, the reporting process under Section 32, management training and accountability under Section 38, and implementing all measures for the whole company instead of a limited scope. For these gaps, the team uses templates from the Template Library, such as the incident register, the incident report form and the management training record.
NIS2 Guide
8 chapters, 124 steps along Section 30 BSIG
Template Library
45+ templates, including report forms and training records
Knowledge Hub
40+ articles, including NIS2 and ISO 27001 compared
Important entities must register with the BSI no later than three months after they first qualify as such, providing among other things their sector under Annex 2, contact details and public IP address ranges. For companies already in scope when the law entered into force, the deadline expired on 6 March 2026.
The most demanding duty for the shopfloor. Where PLC or CNC controls cannot be updated, reduce the risk in other ways: network segmentation, an asset inventory with protection requirements, controlled remote access, monitoring. The scope follows the risk analysis; Section 30(1) BSIG names risk exposure, size, implementation costs and potential impact as criteria.
You assess your direct suppliers and service providers, such as control and software vendors, integrators with remote maintenance access and cloud providers. At the same time, as a supplier you receive security requests from your own customers.
Early initial report no later than 24 hours after becoming aware, an incident report with a first assessment after 72 hours, and a final report one month later. An incident is significant if it has caused or can cause severe operational disruption or financial loss (Section 2 no. 11 BSIG). A production stoppage caused by a cyberattack must therefore always be assessed.
Management must implement the risk management measures, monitor their implementation and attend training regularly. If it breaches these duties, it is liable to the entity under the rules of company law.
| Kriterium | NIS2Compass | Klassische Beratung | ISMS-Tool | Selbstumsetzung |
|---|---|---|---|---|
| Monthly cost | €29 | €700-1,600/day | €200-2,000/month | €0 |
| Alignment with TISAX / ISO 27001 | structure along Section 30 BSIG provided | consultant takes over (expensive) | for individual standards | build yourself |
| German templates | yes (45+) | tailored | mostly English | no |
| OT and shopfloor topics | yes (Knowledge Hub) | depends on consultant | general | build yourself |
| Onboarding | 10 minutes | days to weeks | days + setup | months |
| For 4-8-person IT team | yes | too expensive | too complex | capacity-constrained |
8 chapters, 124 steps, 45+ templates: use existing TISAX and ISO evidence, close gaps in a targeted way.
TISAX® is a registered trademark of the ENX Association. NIS2Compass has no business affiliation with the ENX Association, is not an audit provider approved by ENX and does not conduct TISAX assessments.