Covered are food production, processing and distribution. Whether the obligations apply depends on company size. Cold-chain control, traceability systems and production OT extend the cybersecurity scope. Our vCISO leads the implementation of the information security obligations and works with OdySecure, the security platform by Cybervize.
Book the NIS-2 risk checkStandard case under § 28 BSIG. Calculating the figures in annual work units, attributing partner and linked enterprises, special cases and the final classification all require a case-by-case legal review.
Your vCISO works with OdySecure: ISMS, BCM, assessment and supplier risk on one data foundation. Especially relevant for food and beverage: cold-chain control and traceability in the risk register.
Free 30-minute initial call with an indicative NIS-2 classification, top-5 gaps and a path recommendation.
Learn moreA senior CISO takes on the CISO function permanently, from €3,600/month. OdySecure is included in the mandate.
Learn moreISMS, compliance and evidence from a single platform. Multi-entity, multi-country, AI-supported.
Learn moreGap assessment, roadmap, implementation via the platform. Fixed price from 4,500 euros.
Learn moreSelf-check available
Free, no signup, around 5 minutes. Detailed evaluation by email if desired.
Covered are industrial food production, processing and wholesale distribution; retailers and small producers typically remain outside the scope. Four consequences of this classification (EU Annex II targets in particular wholesale distribution as well as industrial food production and processing). Sector alone is not enough: classification depends on size thresholds and concrete activity. The legally binding evaluation remains a matter for specialised counsel.
Annex II means lower sanctions than Annex I, but the same obligations across the ten minimum measures per § 30 of the German BSI Act. On a cyber incident with food safety impact, additional authority obligations add up.
Refrigeration systems, MES, packaging controllers and traceability systems are part of the cybersecurity scope. A cyber incident in cold-chain control can become a food safety question.
Food standards such as IFS Food, FSSC 22000 and BRC Global Standard require IT security components in supply-chain assessment. NIS-2 complements them on the statutory level but covers different aspects.
Traceability systems (lot tracking, batch management, EPCIS) are critical business data. Data tampering or outage can make recalls impossible or trigger them. NIS-2 requires integrity and availability controls.
Production lines, cold chains and inventory systems all hang on the same technology. When it fails, more than IT comes to a halt. In OdySecure the relevant catalogues sit side by side.
IFS and FSSC 22000 stay out: they govern food safety, not information security. The classification under § 28 BSIG is set out below.
Five NIS-2 minimum measures per §30, translated into food and beverage practice.
Risk register separating cold-chain control, MES, ERP and office IT but tying them together. Cyber risks with food safety impact classified separately.
Supplier inventory with raw-material origin, single-source risks, cold-chain requirements. IFS/FSSC 22000 audits of suppliers documented, cyber components integrated.
BCM plans for cold-chain outage, traceability-system outage and production stoppage. Recall scenarios with a cyber incident as trigger documented.
Incident response plan with escalation to the BSI on cyber incident, to food safety authorities on food safety impact and possibly to customers on traceability impact.
Recipes, process know-how and allergen specifications are critical data with high confidentiality. MFA for recipe databases, need-to-know access, audit trail for changes.
Methodology built for audit acceptance towards the BSI.
IFS Food and FSSC 22000 contain requirements for supply-chain security and crisis management but do not cover all NIS-2 minimum measures. In particular BSI reporting obligations (24/72 hours), specific OT risk analysis and management accountability are not part of the food standards. IFS Food and FSSC 22000 are not in the OdySecure catalogue; they govern food safety, not information security.
That depends on the trade level. Annex 2 of the German BSIG (NIS-2 Annex II) covers food businesses in industrial production and processing as well as wholesale; pure retail is not covered by food distribution alone. Where the annex applies, the obligations apply from 50 employees, or when annual turnover and balance sheet total each exceed 10 million euros. Focus then is ERP security, traceability and logistics IT. IFS Food and FSSC 22000 are private certification standards, not laws. The legally binding evaluation remains a matter for counsel.
Double escalation: BSI on NIS-2 deadline (24-hour initial report), food safety authority on food safety impact, possibly customer notification on recall risk. OdySecure supports with documented reporting paths inventory.
Recipes and allergen specifications are critical data. NIS-2 requires adequate encryption, access control and audit trail. In practice: separate database class for product IP, need-to-know access, documented data flows to suppliers and authorities.
Typically 10 to 14 weeks for audit-ready NIS-2 readiness at one site, depending on cold-chain complexity and existing food standards. Multi-plant manufacturers need 16 to 22 weeks. Exact indication from the risk check.
Free risk check with indicative NIS-2 classification, traceability indicator and path recommendation. Ideally with IT security or QM plus management board present.
Book the NIS-2 risk checkIf the classification above fits your organisation, the first step is to establish where you stand. Once it is clear which obligations apply and where the gaps are, the question is who closes them: a vCISO working with OdySecure, or your own team with a platform licence.
Book a vCISO callSee the journey in five stationsMemberships, programmes and partnerships
Many companies treat NIS2 as a tick-box exercise. But compliance is not the same as resilience. The Cross-Border Cybersecurity Tour #2 in Saarbrücken made it clear: a functioning security operation outweighs any tool collection.
70% of SMEs treat NIS2 as a compliance checkbox. But organizations that see it as a strategic lever can turn regulatory requirements into operational excellence and genuine resilience.
Structured NIS-2 compliance: gap assessment, roadmap, and implementation in 12 weeks.
Learn moreFree self-check: where do you stand on the ten §30 BSIG measures? 30 questions, instant traffic light.
Learn moreThe ten regulated sectors in which we take on the CISO function.
Learn more