Frozen Food: The Complete NIS2 Guide

Frozen food manufacturers and distributors are in scope under NIS2 Annex II No. 5 (Food) when they exceed 50 employees or EUR 10 million in annual revenue. The entire value chain in the frozen food sector depends on IT: from production controls to cold chain monitoring. An IT failure can lead to millions in damages from spoiled goods within hours. This guide is written for operations managers and IT managers in the frozen food sector.

Who is affected?

Frozen food manufacturers (NACE C.10.8 Other Food Products) and cold chain logistics providers fall under NIS2 Annex II No. 5 when they exceed the SME thresholds: at least 50 employees or at least EUR 10 million in annual revenue (EU Recommendation 2003/361/EC Art. 2).

National or European frozen food providers that exceed the KRITIS threshold under BSI-KritisV for food supply are Essential Entities under Annex I.

A frozen food manufacturer with 100 employees, a fully automated blast freezing system, and its own refrigerated vehicle fleet exceeds the NIS2 thresholds and is an Important Entity.

Obligations under § 30 BSIG-new

§ 30 BSIG-new lists seven obligation areas that for frozen food operations are particularly shaped by dependency on cold chain monitoring:

1. Risk analysis and management: Production controls, blast freezing equipment, frozen storage management, and refrigerated vehicle telematics must be included in the risk analysis.
2. Incident handling: A temperature deviation event caused by IT failure is a potentially reportable incident requiring immediate response.
3. Business continuity: A BCP must cover the "worst case cold chain failure" scenario: what happens if cold monitoring fails at 2am?
4. Supply chain security: Raw material suppliers, packaging suppliers, and telematics providers for refrigerated vehicles must be reviewed for security standards.
5. Access control and MFA: Access to monitoring platforms and production systems must be protected by MFA. Remote alarms and management dashboards require special attention.
6. Encryption: Cold chain records (legally required under EU Food Hygiene Regulation), customer data, and production data must be encrypted.
7. Training and awareness: Shift supervisors, logistics dispatchers, and IT staff must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months. For security incidents under § 32 BSIG-new: initial report within 24 hours, full report within 72 hours, final report within 30 days.

A cyberattack that disables the central cold chain monitoring for several hours and thereby endangers significant stored inventory is a reportable significant incident. Even a pure IT incident without proven product damage is reportable if supply security is impaired.

Fines and personal liability

Important Entity (Annex II): up to EUR 7 million or 1.4% of turnover. Essential Entity (Annex I): up to EUR 10 million or 2% of turnover.

§ 38 BSIG-new: personal liability for management. In the frozen food sector, this must be taken especially seriously because an IT-related cold chain failure can trigger not only NIS2 fines but also food law sanctions and substantial insurance claims simultaneously.

Cold chain monitoring as an NIS2-critical process: securing sensor infrastructure

Cold chain monitoring in frozen food operations is entirely IT-dependent: temperature sensors in storage cells, blast freeze tunnels, and refrigerated vehicles transmit data in real time to central management platforms. These platforms control alerts, maintenance tasks, and quality records.

The risk scenario: an attacker compromises the monitoring platform through a stolen login credential. He manipulates alarm thresholds or suppresses notifications. Cold storage cells rise to critical temperatures - without triggering any alarm. When this is noticed 6 hours later, an entire frozen storage facility is destroyed.

What § 30 BSIG-new specifically requires: redundant alarm paths (SMS + app + physical on-site alarm), no single-cloud dependency for critical alerts, strong authentication for monitoring platforms, and regular alarm tests. The sensor infrastructure itself must be included in the network security architecture.

First steps

1. Check headcount and revenue against the SME thresholds.
2. Inventory all systems connected to the cold chain: temperature sensors, monitoring platform, refrigerated vehicle telematics, warehouse management system.
3. Check: are there redundant alarm paths for temperature deviations? Are they tested?
4. Identify all external access points (monitoring platform providers, maintenance access).
5. Create a contingency plan for cold chain monitoring failure at 3am.
6. Review supplier contracts (sensor manufacturers, telematics providers) for security clauses.
7. Register with the BSI.

Common pitfalls

Monitoring platform without MFA: Many frozen food operations use cloud-based monitoring platforms with simple password login. This is not sufficient under NIS2.

No redundant alarm path: If temperature alarms are only delivered through the cloud platform and that platform fails, there are no alarms at all. This is a critical single point of failure.

Cold chain documentation not recognized as an IT security objective: EU Food Hygiene Regulation 852/2004 requires temperature records. Their loss through an IT attack is a food law compliance issue.

Vehicle telematics not included in risk analysis: Refrigerated vehicle telematics often connect via public mobile networks. Attacks over these connections are realistic and must be assessed.

Use the industry-specific NIS2 calculator for frozen food to determine your obligations.