NIS2 and the Cyber Resilience Act: The Hardware Checklist for Manufacturers

Two EU instruments matter for anyone who runs or supplies a factory. NIS2 (Directive 2022/2555, transposed into national law from October 2024) obliges "essential" and "important" entities — which now includes manufacturing of machinery, electrical equipment, vehicles, food, chemicals, medical devices and more, above size thresholds — to manage cybersecurity risk, report significant incidents within 24 hours, secure their supply chain and hold management personally accountable. The Cyber Resilience Act (Regulation 2024/2847) is product law: from September 2026 manufacturers must report actively exploited vulnerabilities, and from December 2027 every "product with digital elements" placed on the EU market — PLCs, HMIs, switches, drives with Ethernet, IoT gateways, sensors with IO-Link masters — must meet essential cybersecurity requirements, carry CE marking for it and have security updates for its support period. Neither law says "buy a firewall". Both are enforced by auditors who ask for evidence, and the evidence lives in the hardware and its configuration.

The translation layer: IEC 62443

NIS2 leaves the "appropriate and proportionate technical measures" to the operator; national guidance (BSI in Germany, ANSSI in France, ENISA at EU level) points to IEC 62443 for OT. The CRA's harmonised standards are still being written, but IEC 62443-4-1 (secure development) and 62443-4-2 (component requirements) are the obvious candidates and the ones manufacturers are certifying against now. For a plant the practical structure is: 62443-3-2 for the risk assessment and zoning, 62443-3-3 for the system-level requirements (security levels SL1–SL4 per zone), 62443-4-2 for what to demand of each component, and 62443-2-4 for integrators and service providers. The checklist below follows that.

Part A — Architecture (62443-3-2/3-3)

• Zones and conduits documented. A drawing that shows every network segment, what is in it, its target security level and every connection between segments. If this drawing does not exist, nothing else can be audited. Our segmentation guide describes the method.
• Industrial firewall/router at every zone boundary with stateful inspection and, where protocols allow, deep-packet inspection (Modbus function codes, OPC UA, S7comm). Hirschmann EAGLE40, Phoenix mGuard, Siemens SCALANCE S, Moxa EDR, Fortinet FortiGate Rugged are the usual candidates; what matters is a documented rule set with a deny-by-default policy and logging.
• IT/OT DMZ. No direct connection from the office network to the control network; historians, patch servers and jump hosts sit in the DMZ.
• Managed switches only in production networks, with unused ports disabled, port security or 802.1X, VLANs matching the zone model, and management on a dedicated VLAN. Unmanaged switches are acceptable inside a single machine zone, not between zones. The BOBCAT and EDS-G4012 classes are IEC 62443-4-2 certified or designed to it.
• Remote access through a controlled gateway — VPN with per-user accounts, MFA, session logging, time-limited access for OEMs. See the remote-access guide.
• Redundancy where availability is a security requirement: ring topologies (MRP, HIPER-Ring, Turbo Ring) and redundant power on switches at the cell level and above.

Part B — Components (62443-4-2)

Requirement	What to check on a PLC, HMI, switch, drive, gateway	Evidence to keep
Identification and authentication	Individual user accounts, no shared "admin"; default passwords changed; role-based access (operator/engineer/admin)	User list export, password policy
Use control	Write protection on PLC program and configuration; HMI functions by role; physical mode switch where available	Access-level configuration screenshot
System integrity	Signed firmware, secure boot, integrity check on project download; disable unused services (web server, FTP, Telnet, SNMP v1/v2)	Firmware version list, service inventory
Data confidentiality	Encrypted engineering connections (TLS), HTTPS only, SNMP v3, no plain-text protocols on the plant backbone where avoidable	Protocol inventory per zone
Restricted data flow	Firewall rules per conduit; PLC-to-PLC communication whitelisted; no "any-any"	Rule-set export with change history
Timely response to events	Syslog/SNMP traps from switches, firewalls, PLCs to a central log; alarm on failed logins and configuration changes	Log retention policy, sample logs
Resource availability	Backups of every PLC/HMI/switch configuration, tested restore; spare parts for boundary devices; DoS protection settings on switches	Backup register, restore test record

Part C — Procurement and supply chain (NIS2 Art. 21, CRA)

• Ask suppliers for 62443-4-1/4-2 certification or a security development statement for every new networked component. Siemens, Rockwell, Schneider, Hirschmann, Moxa, Phoenix and Omron publish these; for others, ask.
• Vulnerability handling. Supplier must have a published security advisory process (PSIRT) and a channel for coordinated disclosure — a CRA requirement from September 2026.
• Software bill of materials (SBOM) on request for devices with firmware; the CRA requires manufacturers to produce it.
• Support period stated. Security updates for the expected lifetime (CRA default five years). An obsolete PLC with no firmware updates is a NIS2 finding, which turns the EOL calendar into a security document.
• Genuine products with traceable origin. Counterfeit or relabelled network hardware is a supply-chain risk by definition; keep the serial-number verification records.
• Integrator and service contracts aligned to 62443-2-4: who may connect what, how, and with what logging.

Part D — Operations

• Asset inventory with firmware versions, kept current — most auditors start here.
• Patch and firmware policy with a test bench; compensating controls (firewall rules) where patching is not possible.
• Incident response plan that can meet NIS2's 24-hour early warning and 72-hour notification; the plant must know who reports.
• Annual review of the zone model and rule sets; change management for firewall and switch configurations.

A realistic first year

For a typical mid-size plant that has never done this: quarter one, inventory and zone drawing; quarter two, boundary firewalls and managed switches at the cell level with a DMZ; quarter three, remote-access gateway, PLC/HMI hardening and backups; quarter four, logging, incident plan and supplier questionnaires. Hardware is usually the smaller part of the cost; the drawing and the discipline are the larger. We supply the certified switches, firewalls and gateways and help with the zone design and the 62443 evidence file.

Quick answers

Does NIS2 apply to a factory outside the EU?

Not directly. NIS2 applies to entities established in the EU, but an EU customer under NIS2 must manage supply-chain risk and may pass requirements down to you contractually. The CRA applies to any product placed on the EU market regardless of where it is made.

Is an IEC 62443-4-2 certified switch mandatory?

No law names a certification. Certified components make the evidence easier and are what auditors expect at the zone boundaries; inside a single machine zone a well-configured non-certified managed switch can be acceptable with compensating controls.

What does the CRA mean for machine builders?

A machine with a networked PLC or HMI is a product with digital elements. From December 2027 it needs a cybersecurity risk assessment, secure defaults, a vulnerability-handling process, an SBOM and security updates for its support period, documented in the technical file alongside the Machinery Regulation evidence.