Annex II of the German NIS-2 implementation act covers mechanical engineering as an important entity. From 50 employees and 10 million euros revenue, the cybersecurity obligations apply. For plants with OT installations, IEC 62443 and supplier requirements add up. The Cybervize platform covers ISMS, OT assessment and supplier risk in one solution.
Book the NIS-2 risk check
Mid-market mechanical engineering firms typically fall under NIS-2 Annex II as „important entity" once they exceed 50 employees AND €10M annual turnover or €10M balance sheet total. Four consequences arising from this classification. Sector alone is not enough: classification as important or essential entity depends additionally on size thresholds and concrete activity. The legally binding evaluation of NIS-2 status remains a matter for specialised counsel.
Annex II means lower sanctions than Annex I, but the same obligations across the ten minimum measures per §30 of the German NIS-2 implementation act. Supervision is reactive rather than proactive, but it kicks in after an incident.
Plant controllers, SCADA systems and engineering workstations are part of the cybersecurity scope, not just office IT. IEC 62443 becomes the natural anchor standard.
If you supply OEMs under Annex I, you receive their supplier audits via contract. NIS-2 turns supplier compliance into a contractual matter.
Initial report within 24 hours, follow-up within 72 hours, final report within one month. Hard to maintain with an Excel-based ISMS.
Five of the ten minimum measures per §30, translated into mechanical engineering practice.
In practice: a risk register that separates office IT and plant OT but ties them together. Plant controllers carry their own assessment because the risks (production stoppage) differ from office risks (data loss).
Supplier inventory with criticality ratings, documented security requirements in contracts, concentration risk for single-source OT suppliers. TISAX requirements can dock here for automotive customers.
Patch management for plant equipment, secure procurement of new controllers, documented remote-maintenance access for machine vendors.
Incident response plan that distinguishes office IT incidents from plant downtime. Escalation paths to the BSI with documented 24- and 72-hour deadlines.
BCM plan for production outages, RTO and RPO per critical machine, restart sequence documented. Beyond office backup, because plant downtime costs six-figure daily rates.
The Cybervize platform covers ISMS, BCM, Third-Party Risk Management and Assessment in one solution. Especially relevant for mechanical engineering: multi-site assessment, OT modules and supplier risk.
Free 30-minute initial call with an indicative NIS-2 classification, top-5 gaps and a path recommendation.
Learn more Service 02ISMS, compliance and evidence from a single platform. Multi-entity, multi-country, AI-supported.
Learn more Service 03Platform plus permanent CISO function. For organisations without an in-house CISO.
Learn more Service 04Gap assessment, roadmap, implementation via the platform. Fixed price from 4,500 euros.
Learn moreSelf-check available
Free, no signup, around 5 minutes. Detailed evaluation by email if desired.
Industry experience in manufacturing and KRITIS operators from 25 years of ISMS leadership at PwC, Deloitte and KPMG. The platform methodology was built under the BMFTR StartupSecure programme with the CISPA incubator.
Free risk check with indicative NIS-2 classification, top-5 gaps, path recommendation and cost estimate. Ideally with plant management or IT leadership plus management board present.
Book the NIS-2 risk checkMemberships, programmes and partnerships
Structured NIS-2 compliance: gap assessment, roadmap, and implementation in 12 weeks.
Learn moreFree self-check: where do you stand on the ten §30 BSIG measures? 30 questions, instant traffic light.
Learn moreThe ten regulated sectors the Cybervize platform runs in.
Learn moreMany companies treat NIS2 as a tick-box exercise. But compliance is not the same as resilience. The Cross-Border Cybersecurity Tour #2 in Saarbrücken made it clear: a functioning security operation outweighs any tool collection.
Most security programs do not fail at launch. They fail when initiative must become routine. Five binding routines for sustainable governance.
Organizations that treat AI agents as magic will never control them. What an AI agent actually is and why that changes everything.
