NIS2 for UK food groups with EU sites

NIS2 is the EU’s cyber security law for essential and important sectors. It doesn’t apply in Great Britain, and the UK is updating its own NIS Regulations through the Cyber Security and Resilience Bill instead. But food production, processing and distribution is one of the sectors NIS2 covers. If your group runs a site in the EU, or sells to customers who are in scope, it is likely to reach you.

Who is in scope

NIS2 lists “production, processing and distribution of food” among its “other critical sectors” (Annex II). Businesses in that sector are in scope as important entities if they are medium-sized or larger: broadly, 50 or more staff, or annual turnover and balance sheet both above €10 million. Linked and partner businesses can count towards those figures, so a small EU site that belongs to a large group may still be in scope.

Each EU country applies NIS2 through its own law, so the detail and timing vary by country, and the site is regulated by the authority where it is established. For a UK group, that usually means the EU subsidiary is the regulated entity and the group’s shared systems, suppliers and support arrangements come under scrutiny through it.

What it asks for

Article 21 requires “appropriate and proportionate” measures to manage cyber risk, and lists a minimum set. Several fall directly on production systems:

• (b) Incident handling. Detecting, responding to and recording incidents.
• (c) Business continuity. Backup management, disaster recovery and crisis management.
• (d) Supply chain security. The security of relationships with direct suppliers and service providers.
• (e) Security in acquisition, development and maintenance, including handling vulnerabilities.
• (i) Access control and asset management.

The others cover risk policies, measuring effectiveness, cyber hygiene and training, cryptography, and multi-factor authentication. Management bodies have to approve the measures and oversee them (Article 20), and can be held responsible for failures.

Significant incidents must be reported in stages: an early warning within 24 hours, a notification within 72 hours, and a final report within a month. For important entities, fines can reach at least €7 million or 1.4% of worldwide turnover, whichever is higher.

Why OT is usually the gap

Most food groups have IT asset registers, managed backups and access control for their office systems. The production side is often different: PLC programs on an engineer’s laptop, remote access through a machine builder’s own modem, and no single list of what is installed or which devices are no longer supported.

Under NIS2 those are the same measures, just applied to the line. An auditor asking about business continuity will ask how you would restore a failed packing line controller. An auditor asking about supply chain security will ask which suppliers can reach it remotely, and how that is controlled.

How it reaches UK suppliers

Article 21(2)(d) means in-scope businesses have to assess the suppliers who can affect their systems. In practice that arrives as a security questionnaire, contract clauses on access and incident notification, or a request for evidence. Remote support providers, machine builders and integrators are usually first on the list, whether or not they are in the EU themselves.

What to have ready

1. An OT asset inventory. Every PLC, HMI, drive and network device, with firmware and lifecycle status. Devices no longer supported by the manufacturer are a maintenance risk under (e).
2. Versioned program backups, stored against each device with what you need to restore them, for (c).
3. A record of who can access production systems, including suppliers, and a log of when they did, for (d) and (i).
4. Change records showing what was changed, by whom and when, which support incident handling under (b).
5. Evidence from your suppliers on how their access is controlled.

None of these on its own makes a site compliant. They are the records the rest of a NIS2 programme depends on, and they take the longest to build from scratch.

Where ECS fits

A Capture site audit builds the inventory and takes the backups in one visit, without scanning your network. Command Centre keeps them current, with change and access logs. Connect remote support is authorised per session and logged, which is what a supply chain review looks for. The compliance page sets out what each covers against Article 21, and what stays with you.

This guide is a summary, not legal advice. Whether NIS2 applies depends on your structure, size and where you operate, so confirm your position with your advisers.