Brewery: The Complete NIS2 Guide

Breweries with more than 50 employees or EUR 10 million in annual revenue are potentially in scope under NIS2 Annex II No. 5 as food manufacturers. NIS2 is especially relevant for breweries with highly automated brewhouses and networked filling lines, because IT failures there directly halt production. This guide is written for brewmasters, managing directors, and IT managers who need clarity on their NIS2 obligations.

Who is affected?

Breweries fall under NIS2 Annex II No. 5 (Food, NACE C.11 Beverage Production) when they exceed the SME thresholds from EU Recommendation 2003/361/EC Art. 2: at least 50 employees or at least EUR 10 million in annual revenue. Craft breweries below these thresholds are exempt.

If you reach the KRITIS threshold under BSI-KritisV for food supply (434,500 t/a beverage equivalent), you are an Essential Entity under NIS2 Annex I. In practice, this affects large breweries with national distribution.

A mid-sized brewery with 120 employees, a fully automated brewhouse, and its own logistics ERP is clearly above the thresholds and qualifies as an Important Entity.

Obligations under § 30 BSIG-new

§ 30 BSIG-new defines seven mandatory areas you must address for your brewery:

1. Risk analysis and management: Brewery control systems (brewhouse automation, fermentation cellar climate control, filling lines) and their connection to your IT network must be included in the risk analysis.
2. Incident handling: Incidents in the OT area (production failure from control system failure) and in the IT area (ERP failure, email compromise) must be handled equally.
3. Business continuity: What happens if the brewhouse control system fails? A documented contingency plan with manual fallback processes is mandatory.
4. Supply chain security: Ingredient suppliers (malt, hops), packaging suppliers, and software vendors (ERP, MES) must be assessed for security standards. Contracts must account for § 30 Para. 2 No. 4 BSIG-new.
5. Access control and MFA: Access to production IT, ERP, and external services must be secured by MFA. Remote access by service technicians to production equipment requires special attention.
6. Encryption: Business data, recipes, and customer data must be stored and transmitted in encrypted form.
7. Training and awareness: Brewery technicians and administrative staff must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration must occur within three months of becoming aware of your obligations under § 33 BSIG-new. For security incidents, § 32 BSIG-new requires: an initial report within 24 hours, a full report within 72 hours, and a final report within 30 days.

A cyberattack that shuts down the filling line and impairs delivery capability for more than 24 hours is reportable. You must submit the initial report even while the attack is still ongoing.

Fines and personal liability

For Important Entities (Annex II): up to EUR 7 million or 1.4% of annual turnover. For Essential Entities (Annex I): up to EUR 10 million or 2% of turnover.

§ 38 BSIG-new introduces personal liability for management. Managing directors can be held personally liable if they negligently neglect NIS2 obligations. In family breweries where the owner is also the managing director, this is particularly relevant.

Automated brewhouse and filling line controls: IT/OT security in breweries

Modern breweries closely integrate OT and IT. Brewhouse automation (PLC/SCADA systems, process control) is connected to ERP over internal networks. This connection is an attack vector that is underestimated in many NIS2 analyses.

Concrete risks: an attacker who breaches the office network (e.g., through phishing) can reach production control systems through poorly segmented networks. A ransomware-induced shutdown of the filling line means: no output, perishable semi-finished products, and delivery failures.

What § 30 BSIG-new requires here: network segmentation between OT and IT, documented access concepts for remote maintenance, and regular security reviews of control software. Remote maintenance access from equipment manufacturers (e.g., Krones, GEA) must be explicitly addressed in the security concept and protected by VPN with MFA.

First steps

1. Clarify your headcount and revenue. Over 50 employees or EUR 10 million means you are likely an Important Entity.
2. Create a complete inventory of all networked systems: brewhouse controls, fermentation cellar, filling line, cooling systems, ERP, WMS.
3. Review all remote maintenance access points. Which suppliers access your systems remotely? Are these connections secured with VPN and MFA?
4. Conduct a network segmentation analysis: are OT networks separated from the office network?
5. Create a contingency plan for production failure due to IT disruption. Who decides? What are the manual fallback processes?
6. Assess your most critical IT suppliers against security standards.
7. Register with the BSI.

Common pitfalls

Excluding OT systems from scope: Brewhouse controls and filling line software are NIS2-relevant if they are connected to the company network. They belong in your risk analysis.

Forgetting remote maintenance access: Service technicians from equipment manufacturers often access production systems through poorly documented entry points. These access paths frequently lack MFA protection.

Treating recipe data as non-sensitive: Brewing recipes are trade secrets. Their theft is a security incident that may be reportable under NIS2.

Mid-sized breweries not taking themselves seriously: "We are too small for cyberattacks" is a common misconception. Breweries are specifically targeted because time-critical production processes make ransom payments more likely.

Use the industry-specific NIS2 calculator for breweries to quickly assess your obligations.