In brief
- Regulation: NIS2.
- Manufacturers and equipment suppliers exceeding the threshold are concerned as important entities.
- Manage IT/OT risks.
- Securing a deep supply chain.
- Notify incidents.
- For important entities, up to €7 M or 1.4% of global turnover, with possible personal liability for executives.
Regulatory deadlines
The key dates of this regulation.
January 2023
Entry into force (EU directive)
In forceOctober 2024
Transposition deadline (EU)
In force2026
French transposition (Resilience Act)
In forceWhat does NIS2 cover?
NIS2 classifies the manufacture of vehicles and other transport equipment among important entities, regardless of size thresholds. The measures set out in Article 21 apply to both IT and OT environments at production sites.
The automotive specificity lies in the depth of the supply chain: tier 1, tier 2 and beyond, with each link potentially becoming an attack vector.
Is the 'Automotive' sector affected?
Manufacturers and equipment suppliers exceeding the threshold qualify as important entities. Smaller suppliers are often affected indirectly, through requirements imposed by principal contractors.
Supply chain security is the most dimensioning obligation in the sector.
Detailed obligations
Manage IT/OT risks
Apply the Article 21 measures to management systems and industrial systems within plants.
Secure a deep supply chain
Frame and assess supplier security across multiple tiers.
Notify incidents
Issue an early warning then reports according to deadlines.
Ensure continuity
Having plans adapted to the just-in-time flows of automotive production.
Govern
Having senior management champion the programme.
Sanctions & risks
For important entities, up to €7M or 1.4% of global turnover, with potential personal liability for executives. An incident in the supply chain can halt just-in-time production, with immediate economic consequences.
Principal contractors additionally impose security requirements on their suppliers.
Application timeline
- 1Directive. Adopted end of 2022.
- 2France. Transposition in progress; anticipate given the depth of the supply chain.
Common mistakes in the sector
- 1Underestimated chain. Securing only tier 1 while neglecting subsequent tiers.
- 2Neglected OT. Forgetting industrial systems in factories.
- 3Fragile continuity. Underestimating the impact of an incident on just-in-time flows.
- 4Absent leadership. Confining cybersecurity to the technical domain.
Practical case
A manufacturer suffers an incident propagated from a tier-2 supplier. NIS2 remediation consists of mapping the supply chain beyond tier 1, imposing contractual security requirements, securing IT/OT interconnections, and strengthening continuity plans adapted to just-in-time flows.
Compliance roadmap
- 1
Qualify. Determining status (important, out of scope).
- 2
Map the supply chain. Identify critical suppliers across multiple tiers.
- 3
Securing IT/OT. Apply measures to factories and interconnections.
- 4
Frame vendor relationships. Deploying contractual security requirements.
- 5
Equip the notification process. Implement incident alerting and reporting.
Frequently asked questions
Yes, as an important entity above the size threshold.
Take action on NIS2
Free assessment or a chat with an expert dedicated to automotive.
They already trust us
See how organisations in the automotive sector secured their compliance with DCO.