Customers, insurers, certification bodies and cyber rules all ask a version of the same questions: what is installed, what is it running, who changed it, who can access it, and what happens when it fails. Command Centre keeps the records that answer them as part of normal engineering work, not as a separate compliance exercise.
The four records
Asset inventory
Every PLC, HMI, drive and network device, with part number, firmware, location and lifecycle status.
In Command Centre: Device hierarchy, site to module
Versioned program backups
Every program stored against its device, each change a new version, with the software, version and cable to restore it.
In Command Centre: Project revisions per device
Change and access log
Every change, download and remote session logged against a named person and time.
In Command Centre: Activity log and Connect sessions
Lifecycle and recovery view
Which devices are discontinued or phasing out, which have spares, and which would stop a line if they failed.
In Command Centre: Lifecycle status and operational risk
// change control
Show what changed, who changed it, and why.
Every program change is a new version with an author, a note and a date. Lock the versions that matter, such as the one approved for a critical control point, and download any of them when you need to restore.
Revisions 5
Packer Panel 2 PLC · Studio 5000 Logix Designer v33
#
Author
Details
Created
Locked
5
AB
AB
a.brook@example.com
Recipe change: 400 g format added
Weigh setpoints and seal dwell for the new format. Tested on line.
14 Oct 2026
Download
4
CD
CD
c.dale@example.com
Output remapped after sensor change
Reject gate moved to O:2/3 after the photo-eye swap.
02 Sep 2026
Download
3
AB
AB
a.brook@example.com
Verified against running PLC
Compared online. No differences.
18 Jul 2026
Download
2
EF
EF
e.fox@example.com
Alarm text tidy-up
HMI alarm messages aligned with the panel drawings.
05 Jun 2026
Download
Command Centre project revisions. Example data.
// food defence · pas 96
Your threat assessment now has to cover the controls.
PAS 96 is the BSI guide most food sites use for the threat assessment BRCGS asks for. The July 2026 revision puts more weight on cyber-enabled threats: a recipe, setpoint or critical limit changed through a connected system, or a line stopped by an attack on its controllers.
Which controllers enforce a critical control point?Every device is recorded against the machine and line it runs.
Which program version is the approved one?Lock the approved revision; any later version is visible.
Who changed it, and who can reach it remotely?Changes, downloads and Connect sessions are logged against a named person.
How fast can you get back to a known good state?The backup, software version and cable needed to restore it are held together.
// nis2 · article 21
NIS2 measures, and where we fit.
NIS2 isn't UK law, but medium and large food producers and processors in the EU are in scope, so it applies to UK groups with sites there, and EU customers pass its supply-chain duties on to their suppliers. Here is what Command Centre, Capture and Connect support, and what they don't. NIS2 for UK food groups with EU sites
Measure
What we provide
Still yours
21(2)(b)Incident handling
Activity log and Connect session history show what changed, who did it and when.
Your incident response plan and reporting to the authority.
21(2)(c)Business continuity, backup and disaster recovery
Versioned program backups stored against each device, with what is needed to restore them.
Your continuity plan and recovery testing.
21(2)(d)Supply chain security
Connect access is authorised per session, logged and closed when support ends, so the supplier relationship is evidenced.
Assessing your other suppliers.
21(2)(e)Security in acquisition, development and maintenance
Firmware and lifecycle status per device, so unsupported and unpatched equipment is visible.
Applying patches or vulnerability scanning.
21(2)(i)Access control and asset management
An inventory of every PLC, HMI and drive, and named-user access to records and backups.
IT asset management and HR security.
Risk analysis policies (a), measuring effectiveness (f), cyber hygiene and training (g), and governance by the management body (Article 20) remain your organisation’s responsibility.
// regulation tracker
The rules affecting UK food and FMCG manufacturers.
What is in force, what is coming, and when. Last reviewed .
NIS2 Directive
EU law
In force across the EU, through each member state’s own law.
Oct 2024Deadline for member states to apply it
Who it applies to. Medium and large food producers, processors and distributors operating in the EU, as “important entities”. Not UK law, but it reaches UK groups with EU sites, and EU customers pass its supply-chain duties down to suppliers.
What helps. Asset inventory, versioned backups, access and change logs, controlled remote access.
Going through Parliament. Lords Report Stage scheduled for 26 October 2026.
Late 2026 – spring 2027Royal Assent expected
Around 2028Duties phased in
Who it applies to. Updates the UK NIS Regulations. Food manufacturers are not directly in scope, but a supplier to essential services could be designated a critical supplier.
What helps. The same records NIS2 asks for, if you are designated or your customers are in scope.
Reporting duties apply now. Full application from December 2027.
11 Sep 2026Manufacturers must report actively exploited vulnerabilities
11 Dec 2027All requirements apply
Who it applies to. Makers of products with digital elements sold in the EU, including machinery and industrial devices. It falls on suppliers, but buyers will see defined support periods and security update commitments.
What helps. Lifecycle status and support periods recorded against every device.
Replaces the Machinery Directive. GB keeps recognising CE marking and the government plans to update GB machinery rules.
20 Jan 2027Applies in the EU, with no transition period
Who it applies to. Machines placed on the EU market. New requirements cover protection against corruption and cyber-attack, protecting safety-related software, and logging interventions.
What helps. Program versions and an intervention log for the machines you build, modify or retrofit.
Command Centre supports the evidence these rules ask for; it does not on its own make a site compliant or certified. Whether a rule applies to you depends on your sector, size, locations and customers, so take advice on your own obligations. This summary is reviewed quarterly and is not legal advice.
Audit coming up?
A Capture site audit builds the inventory and takes the backups in one visit, usually one to three days. The findings report shows an assessor exactly what you have.
We use cookies to understand how the site is used and to measure our advertising.
Nothing is set until you choose. You can change your mind at any time using the
cookie settings link in the footer.
Read our cookie policy.