Electronics: The Complete NIS2 Guide

Electronics companies with 50 or more employees or EUR 10 million in annual revenue are in scope under NIS2 Annex II No. 5 (Manufacturing). The particular challenge in the electronics sector lies in complex contract manufacturing and ODM supply chains: NIS2 requires that these supplier relationships be secured under § 30 Para. 2 No. 4 BSIG-new. This guide is written for managing directors, supply chain managers, and IT security directors in the electronics sector.

Who is affected?

Electronics manufacturers (NACE C.26 Computer and Electronic Products, C.27 Electrical Equipment) fall under NIS2 Annex II No. 5 when they exceed the SME thresholds: at least 50 employees or at least EUR 10 million in annual revenue (EU Recommendation 2003/361/EC Art. 2).

Companies producing electronic components for critical infrastructure (e.g., control units for energy, medical technology, or automotive) are especially required as suppliers under § 30 Para. 2 No. 4 BSIG-new.

An EMS/ODM service provider with 200 employees producing PCBs and assemblies for automotive and medical technology customers is an Important Entity under NIS2.

Obligations under § 30 BSIG-new

§ 30 BSIG-new defines seven obligation areas that are especially relevant for electronics companies because of supply chain complexity:

1. Risk analysis and management: ERP, PLM, manufacturing management systems (MES), test systems, and supplier portals must all be included in the risk analysis.
2. Incident handling: A security incident in development IT can compromise intellectual property (schematics, layouts) and endanger customer IP. Customers must be notified.
3. Business continuity: Delivery failures in the electronics industry trigger production stops at customers in critical sectors. BCPs must explicitly address supply chain disruptions.
4. Supply chain security: Customers from NIS2-relevant sectors will impose security requirements under § 30 Para. 2 No. 4 BSIG-new. Contract adjustments must be prepared.
5. Access control and MFA: Access to development environments, customer IP repositories, and ERP must be secured by MFA.
6. Encryption: Customer IP (schematics, firmware, layouts), production data, and test reports must be stored encrypted.
7. Training and awareness: Developers, production staff, and administrative employees must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months. For security incidents under § 32 BSIG-new: initial report within 24 hours, full report within 72 hours, final report within 30 days.

Theft of customer IP (schematics, firmware) is a reportable security incident. Reporting is required even when the primary damage occurs at the customer's site.

Fines and personal liability

Important Entity (Annex II): up to EUR 7 million or 1.4% of turnover. § 38 BSIG-new: personal liability for management. Added to this is contractual liability to customers for IP loss.

Securing contract manufacturing and ODM supply chains under § 30 Para. 2 No. 4 BSIG-new

The electronics sector is characterized by multi-tier supply chains: OEM engages EMS/ODM, who in turn uses assembly partners, component suppliers, and logistics service providers. Each stage of this chain is a potential attack point.

§ 30 Para. 2 No. 4 BSIG-new obligates NIS2 entities to include security requirements in supplier contracts. For electronics companies with NIS2-obligated customers, this means: customers will demand contractual security certifications (ISO 27001, SOC 2), audit rights, and incident notification.

Concrete contract clauses that will be expected: MFA requirement for access to customer systems, encryption of customer IP, incident notification obligations within 24 hours, rights to security audits, and proof of a risk analysis.

For ODM service providers with many small customers: standardized security certifications are more efficient than individual contract negotiations.

First steps

1. Clarify headcount and revenue. Over 50 employees or EUR 10 million: Important Entity.
2. Identify NIS2-obligated customers: automotive, healthcare, energy, water, IT service providers.
3. Inventory all systems where customer IP is stored.
4. Review existing contracts for missing security clauses.
5. Conduct a gap analysis against the ISO 27001 standard to estimate certification effort.
6. Create an incident response plan with a customer notification process.
7. Register with the BSI.

Common pitfalls

Customer IP not separated from corporate IT: Customer schematics and firmware repositories must be stored in separate, specially secured environments.

EMS/ODM chain not recognized as NIS2-relevant: Even if you are "only" a manufacturer, you are a critical supplier to NIS2-obligated customers and must meet their requirements.

Certification deferred until customer pressure: Those who wait until customers demand certifications have no time for a careful ISO 27001 implementation.

Test reports and test data not secured: Quality inspection reports and test data are trade secrets and must be included in the security architecture.

Use the industry-specific NIS2 calculator for electronics to verify your obligations.