Mechanical Engineering: The Complete NIS2 Guide

Mechanical engineering companies with 50 or more employees or EUR 10 million in annual revenue are in scope under NIS2 Annex II No. 5 (Manufacturing). The particular challenge for mechanical engineering lies in the growing digitalization of machines: remote service, predictive maintenance, and digital twins create new attack vectors that NIS2 directly addresses. This guide is written for managing directors, product managers, and IT directors in mechanical engineering.

Who is affected?

Mechanical engineering companies (NACE C.28) fall under NIS2 Annex II No. 5 when they exceed the SME thresholds: at least 50 employees or at least EUR 10 million in annual revenue (EU Recommendation 2003/361/EC Art. 2).

Companies with more than 250 employees and more than EUR 50 million in revenue are Important Entities of the second-highest category under Annex II. Essential Entity (Annex I) status is rare in mechanical engineering unless the company is also an operator of critical infrastructure.

A mechanical engineering company with 300 employees, its own remote service platform, and customers in the energy and pharmaceutical sectors is clearly subject to NIS2 and has elevated risk exposure from its connected products.

Obligations under § 30 BSIG-new

§ 30 BSIG-new defines seven obligation areas that are especially relevant for mechanical engineers because of the connection between corporate IT and product IT:

1. Risk analysis and management: ERP, CAD/PLM, remote service platforms, and network connections to customer systems must all be assessed.
2. Incident handling: A security incident on the remote service platform can simultaneously affect many customer machines. The incident response plan must include customer notification.
3. Business continuity: Failures of remote service infrastructure can violate contractual SLAs with customers. BCPs must define escalation and manual service processes.
4. Supply chain security: Component suppliers, software providers for control systems, and cloud service providers must be reviewed for security standards.
5. Access control and MFA: Access to remote service systems, development environments, and ERP must be secured by MFA.
6. Encryption: Machine data, diagnostic data, and development documentation must be encrypted in transit and at rest.
7. Training and awareness: Service engineers, developers, and administrative staff must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months of becoming aware of obligations. For security incidents under § 32 BSIG-new: initial report within 24 hours, full report within 72 hours, final report within 30 days.

An attack on the remote service platform that compromises customer machine data or manipulates machine controls is a reportable incident. The reporting obligation applies even when the damage occurs at the customer's site.

Fines and personal liability

Important Entity (Annex II): up to EUR 7 million or 1.4% of turnover. § 38 BSIG-new establishes personal liability for management. Added to this is product liability if NIS2 compliance failures lead to compromise of customer systems.

Remote service and predictive maintenance as attack vectors: MITRE ATT&CK for ICS

Remote access to customer machines is one of the greatest security risks in modern mechanical engineering. Via remote service platforms, technicians can perform diagnostics, install software updates, and change parameters. These connections are direct access paths to industrial control systems at the customer's site.

The MITRE ATT&CK for ICS framework describes concrete attack techniques on industrial systems. Relevant for mechanical engineers: "Remote Services" (T0886), "Lateral Movement via Remote Services" (T0812), and "Modify Parameter" (T0836). An attacker who compromises the mechanical engineer's remote service platform can reach the control systems of dozens of customers through legitimate access paths.

§ 30 BSIG-new requires: dedicated security architecture for remote service access (jump servers, session recording), access only on demand with time limits, complete logging of all remote actions, and regular review of access permissions.

First steps

1. Clarify headcount and revenue. Over 50 employees or EUR 10 million: Important Entity.
2. Inventory all connected products and the associated remote service infrastructure.
3. Conduct a risk analysis for remote service access: who has access to which customer machines?
4. Check: are all remote actions fully logged? Is session recording in place?
5. Identify customers in NIS2-relevant sectors (energy, health, water): they will impose security requirements.
6. Create an incident response plan with a customer notification process.
7. Register with the BSI.

Common pitfalls

Remote service platform treated as "product" rather than IT security asset: The remote service infrastructure is corporate IT in the NIS2 sense. Its security is your responsibility.

No logging of remote actions: What a technician does remotely to a customer machine must be completely logged. Missing logs are both a compliance problem and a forensics problem.

Software updates without signed transmission: Firmware and software updates deployed remotely must be signed and transmitted with integrity verification.

Customer notification forgotten in security incidents: If the remote service platform is compromised, affected customers must be informed immediately - independently of the BSI reporting obligation.

Use the industry-specific NIS2 calculator for mechanical engineering to determine your obligations.