Mill: The Complete NIS2 Guide

Mills are in scope under NIS2 Annex II No. 5 as food manufacturers as soon as they exceed 50 employees or EUR 10 million in annual revenue. As part of the grain supply chain, industrial mills are among the most networked segments of the food sector, with automated milling systems and just-in-time logistics that rely entirely on IT. This guide is written for mill owners, operations managers, and IT managers.

Who is affected?

Grain mills (NACE C.10.6 Grain Milling) fall under NIS2 Annex II No. 5 (Food) when they exceed the SME thresholds: at least 50 employees or at least EUR 10 million in annual revenue (EU Recommendation 2003/361/EC Art. 2).

Large mills that play a critical role in national grain supply and exceed the KRITIS threshold under BSI-KritisV (434,500 t/a grain equivalent) are Essential Entities under NIS2 Annex I.

A mill with 70 employees, its own wheat silos, and daily deliveries to bakery chains and food retailers exceeds the NIS2 threshold and is an Important Entity.

Obligations under § 30 BSIG-new

§ 30 BSIG-new defines seven obligation categories that are particularly relevant for mills with their automated milling equipment:

1. Risk analysis and management: Milling system controls, sieve automation, silo management IT, and logistics ERP must all be assessed.
2. Incident handling: A milling control system failure caused by a cyberattack is a significant incident. Escalation paths and reporting processes must be defined.
3. Business continuity: Mills often deliver daily on fixed schedules. A BCP must include alternative delivery concepts and manual fallback processes.
4. Supply chain security: Grain suppliers, logistics providers, and software vendors for milling management systems must be reviewed for security standards.
5. Access control and MFA: Access to production systems and corporate networks must be secured by MFA. Remote maintenance access from equipment manufacturers must be secured.
6. Encryption: Customer data, supplier contracts, and quality data (analysis certificates) must be stored encrypted.
7. Training and awareness: Millers, dispatchers, and administrative staff must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months of determining obligations. For security incidents, § 32 BSIG-new requires: initial report within 24 hours, full report within 72 hours, final report within 30 days.

A ransomware attack on the milling control system that stops production for more than one business day and violates ongoing delivery obligations is reportable. The initial report must be filed even if a full root cause analysis is not yet available.

Fines and personal liability

Important Entity (Annex II): up to EUR 7 million or 1.4% of turnover. Essential Entity (Annex I): up to EUR 10 million or 2% of turnover.

§ 38 BSIG-new establishes personal liability for management for negligently missed NIS2 obligations. In family-owned mills where owner and managing director are the same person, the personal risk is significant.

Just-in-time grain logistics and milling controls as NIS2 risk factors

Modern mills operate on tight schedules: grain is delivered just-in-time from silos or directly from farmers, processed, and shipped the same day. These processes depend on ERP, dispatch software, automated weighing systems, and digital delivery notes.

The risk scenario: an attacker infiltrates the ERP through a compromised supplier account. He manipulates delivery planning data so that raw material orders are incorrectly scheduled and production runs idle. At the same time, ransomware encrypts the dispatch software. Result: delivery stops to major buyers, contract penalties, and production losses.

What § 30 BSIG-new requires here: data backups for dispatch software with short recovery times (define RTO/RPO targets), access controls for supplier portals, and network segmentation between administrative IT and production IT.

First steps

1. Check headcount and revenue against the SME thresholds.
2. Inventory all networked production systems: milling controls, silo management, weighing IT, laboratory software.
3. Review all remote maintenance access points from equipment manufacturers.
4. Conduct a risk analysis for dispatch software failure.
5. Create a contingency plan: what happens if the ERP fails when delivery deadlines are approaching?
6. Review supplier contracts for security requirements under § 30 Para. 2 No. 4 BSIG-new.
7. Ensure that backups of production configuration data are created and tested regularly.

Common pitfalls

Milling software not recognized as an IT security topic: The control software for the milling plant is IT. Its failure means production stoppage and immediate financial damage.

Supplier portals without access control: Many mills operate web portals for suppliers and customers. These are potential attack vectors that must be included in the risk analysis.

Quality certificates and analysis data not backed up: Flour quality analyses and certificates are legally relevant for customers. Their loss or manipulation is a security incident.

Contingency plan does not account for delivery deadlines: A BCP that does not include customer escalation and alternative delivery options is incomplete for mills.

Use the industry-specific NIS2 calculator for mills to determine your obligations.