Meat Processing: The Complete NIS2 Guide

Meat processing companies are in scope under NIS2 Annex II No. 5 as food manufacturers as soon as they exceed 50 employees or EUR 10 million in annual revenue. Because slaughter lines, cutting operations, and cold chain logistics are so tightly IT-dependent, NIS2 compliance here is not a bureaucratic exercise - it is critical operational safety. This guide is written for operations managers, managing directors, and IT managers in the meat industry.

Who is affected?

Slaughterhouses and meat processors fall under NIS2 Annex II No. 5 (Food, NACE C.10.1) when they exceed the SME thresholds from EU Recommendation 2003/361/EC Art. 2: at least 50 employees or at least EUR 10 million in annual revenue.

Large slaughterhouses with more than 250 employees and over EUR 50 million in revenue are Essential Entities under Annex I if they reach the KRITIS threshold under BSI-KritisV. For slaughter animals, this is approximately 1.5 million cattle equivalents per year; exact values are set out in BSI-KritisV Annex 6.

A facility with 150 employees, a deboning line, and its own distribution to food retailers exceeds the NIS2 threshold and is an Important Entity.

Obligations under § 30 BSIG-new

§ 30 BSIG-new lists seven obligation categories that in meat processing are heavily shaped by OT/IT overlaps:

1. Risk analysis and management: Slaughter line controls, cold storage monitoring, cutting band automation, and logistics IT must all be included in the risk assessment.
2. Incident handling: A failure of the stunning equipment control system or a cold storage alarm is an incident under NIS2. Reporting and escalation paths must be clearly defined.
3. Business continuity: Meat processing is time-critical - a production stoppage of more than a few hours means spoilage. A detailed BCP with alternative processes and communication plans is mandatory.
4. Supply chain security: Suppliers of animal transport IT, slaughter technology, MES, and ERP must provide security certifications. § 30 Para. 2 No. 4 BSIG-new requires contractual clauses.
5. Access control and MFA: Access to production systems and company IT must be secured by MFA. Remote maintenance access from equipment manufacturers must be specifically secured.
6. Encryption: Supplier and customer data, slaughter records, and traceability data must be stored encrypted.
7. Training and awareness: Shift supervisors, IT staff, and administrative personnel must receive regular cybersecurity awareness training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new: within three months. For security incidents, § 32 BSIG-new applies: initial report within 24 hours, full report within 72 hours, final report within 30 days.

A ransomware attack on slaughter line controls that interrupts production for more than 12 hours is a reportable significant incident. A cold storage failure caused by a cyberattack also falls under this obligation if it affects food safety.

Fines and personal liability

Important Entity (Annex II): up to EUR 7 million or 1.4% of turnover. Essential Entity (Annex I): up to EUR 10 million or 2% of turnover.

§ 38 BSIG-new: managing directors are personally liable for the negligent failure to implement NIS2 measures. Combined with potential product liability claims for spoiled food (e.g., from a failed cold chain), the consequences can be existential.

Slaughter and cutting lines: why IT resilience is so critical

Meat processing is more threatened by IT failures than almost any other food sector: processes are time-bound (hygiene, cold chain), highly automated, and poorly prepared for manual fallbacks.

An example: JBS, the world's largest meat processor, paid USD 11 million in ransom after a 2021 ransomware attack. In Germany, such attacks also affect mid-sized operations. A cutting line failure lasting 8 hours means: perishable semi-finished product, delivery obligation breaches toward retail customers, and possible recall actions if temperature deviations occur.

What NIS2 concretely requires: network segmentation so that an office IT attack cannot reach production systems; regular backups of production configurations; tested recovery procedures for slaughter line software; and a clear escalation protocol for incidents.

First steps

1. Check your headcount and revenue against the SME thresholds.
2. Map all networked systems: slaughter line controls, cutting band, cold storage monitoring, MES, ERP, traceability software.
3. Analyze remote maintenance access points from equipment manufacturers (e.g., Henny Penny, Stork).
4. Ensure OT networks are separated from the office network.
5. Create a contingency plan specifically for IT failure during live production.
6. Document supplier contracts with respect to § 30 Para. 2 No. 4 BSIG-new.
7. Register with the BSI.

Common pitfalls

IT failure planning ignores production timing: A contingency plan that does not account for what happens after 4 hours of stoppage with semi-finished product on the line is incomplete.

Traceability systems not classified as critical: Quality assurance systems and origin records are regulatorily critical. Their failure is reportable.

Slaughter operation and processing assessed separately: If slaughter and deboning run in the same company but on different IT systems, both must be included in the overall risk assessment.

Cold chain monitoring not recognized as an IT security issue: Sensor infrastructure for temperature is IT. Its failure is a security incident with food law consequences.

Use the industry-specific NIS2 calculator for meat processing to determine your obligations.