NIS2 in Practice: A Manufacturing Industry Perspective

Lucia Žvačeková from Mitsubishi Chemical Group explains how NIS2 changes the way cybersecurity is approached in a manufacturing company, why a single European checklist is not enough, and what companies often underestimate during implementation.

What does NIS2 change for companies, and why is it important beyond IT or legal departments?

Mitsubishi Chemical Group operates in the chemical industry. For us, as a group of companies in the EMEA region, the NIS2 Directive represents a new framework of responsibilities in cybersecurity.

Until now, this type of industry was not regulated in the same way, since we did not fall under the scope of critical infrastructure. NIS2, however, forces management in the manufacturing sector to start taking this topic seriously.

In practice, this means allocating budget and personnel, selecting suitable technical solutions, creating controlled documentation and introducing a new approach to supply chain management from a cybersecurity perspective.

I also consider the personal responsibility of top management for failing to comply with cybersecurity risk management measures to be a key element of NIS2. For cybersecurity managers, the directive creates a strong argument when explaining to leadership why improvements are necessary.

Why should companies not view NIS2 as just another compliance obligation?

Cyber resilience will increasingly influence a company’s reputation and trustworthiness. A good reputation in the sense that “this company has not been compromised so far” may become important not only reputationally, but also commercially.

Companies that are more resilient against cyberattacks and industrial espionage will, in my view, logically be more likely to win customers and orders. In the long term, the organisations that survive will be those that can protect their know-how, data and intellectual property.

Our company holds hundreds of patents. When a company has assets of that value, it is natural to ask what kind of property has the greatest strategic importance and how it should be protected.

How did you start implementing NIS2 within the company?

We began preparations at the start of 2023. We created a project team for the EMEA region, and the first step was a GAP analysis, covering everything from governance to technical solutions.

Since we have more than 20 legal entities in the EMEA region, the next step was to assess individual companies. We had to determine whether they fell within the scope of NIS2, whether they qualified as regulated entities and whether registration with the relevant authority would be required.

This assessment was quite demanding. Some countries, for example Italy, had a more complex methodology and more local differences.

Who had to be involved in the process?

All relevant stakeholders had to be involved. It is not enough to involve only the legal team, security or IT. Implementing NIS2 also requires local branches, management, procurement, supplier development and the risk manager.

That is one of the reasons why NIS2 cannot be understood as the responsibility of one department only. It is a cross-functional project that affects almost the entire organisation.

How did you divide the work between the central team and local countries?

We created a list of tasks based on the NIS2 requirements. We are trying to align local approaches under a unified EMEA approach.

In practice, this means that we took the strictest legal requirements from national legislation and guidance issued by authorities, and we apply those standards across the region.

In the past, we implemented many solutions globally. Most of our processes and technical solutions are therefore set up quite consistently across the region, which makes it easier for us to introduce changes and reduce risks.

At the same time, we had to undergo a mandatory external audit in Hungary. It turned out to be a very useful assessment of the current state.

What looked simple on paper but became difficult in practice?

One of the most difficult parts was the self-assessment of legal entities, meaning the assessment of whether a specific company qualifies as a regulated entity or not.

Within the group, we have different areas of manufacturing, complex ownership structures and internal links related to the provision of services. This means that a simple checklist is often not enough.

On paper, assessing the scope may seem relatively straightforward. In practice, however, it comes up against the structure of the group, local legislative differences and operational interdependencies.

Which part of the implementation required the most time or energy?

We are still in the implementation process. So far, the most time and energy have been required by the risk analysis, preparation of controlled documentation and the development of a supplier management system.

The supply chain is one of the areas that NIS2 brings much more strongly into focus. Companies need to understand not only what they have set up internally, but also how they manage cybersecurity risks related to their suppliers.

When did you realise that one common European checklist would not be enough?

After NIS2 was transposed into Hungarian and Italian legislation. That is when it became clear that the approach to certain obligations may differ from country to country.

For example, in Hungary, an external audit is mandatory under national legislation. The authority has also specified a list of several certified companies that are authorised to carry out such an audit.

In Italy, the authority requires information about digital service suppliers. It is therefore necessary to monitor not only the directive itself, but also local decrees, methodologies and expectations of national authorities.

Where do the individual countries differ the most?

The biggest differences are in the requirements of individual authorities and in how countries approach practical implementation.

In Belgium, for example, the CyFun model was created to verify compliance with individual controls. In Poland, there is an interesting provision concerning high-risk ICT suppliers.

Regulated entities that use ICT solutions from suppliers identified as high-risk must phase out those solutions within seven years of the authority’s decision being published. At the same time, they may not purchase any new products or services from such a supplier, and until the solutions are fully phased out, only necessary repairs and maintenance are allowed.

This shows that although NIS2 creates a common European framework, local implementation can have very specific and practical consequences.

How do you coordinate a central approach with local legal requirements?

We hold regular meetings within the project group. Tasks that need to be carried out are assigned to local management and, where necessary, also to local IT departments.

In a project like this, it is important that central coordination does not become disconnected from local reality. Local teams need to understand what is expected of them, and the central team needs to understand the specific conditions in each country.

Where did the biggest uncertainties arise between the legal, security and operational perspectives?

The biggest uncertainties arose during the self-assessment of companies.

This is where legal interpretation, organisational structure, operational reality and the security perspective meet. It is not enough to look at a legal entity in isolation. You also need to understand what services it provides, how it is connected to other entities and what role it plays within the wider group.

What do companies most often underestimate when implementing NIS2?

Budget and the necessary personnel.

NIS2 implementation cuts across almost all departments, including HR, IT, legal, procurement, finance and other teams. It is therefore a mistake to think that it is only about updating documentation or assigning the task to one team.

If a company does not have sufficient capacity, implementation can quickly become a problem.

What cannot be solved by documentation alone?

Documentation is important, but it is not enough. In practice, implementation has to be reflected in the expertise of personnel and in suitable technical measures.

In a manufacturing company, it is also necessary to focus on the OT sector and its security. Equally important are the technical solutions that the security team must configure and maintain correctly.

NIS2 is therefore not only about being able to present the right documents. The company must also be able to show that its security measures actually work.

What would you recommend to companies implementing NIS2 across multiple countries?

If I had to name three recommendations, they would be:

Have qualified personnel.

Allocate sufficient budget.

And if you are a manufacturing company, or an organisation starting almost from scratch, consider support from an external consulting company, ideally one with offices in the countries where your regulated entities are located.

The scope of activities involved in NIS2 implementation is broad. If a company operates in multiple countries, it needs to combine a central approach with local knowledge of legislation and the expectations of authorities.

Conclusion

NIS2 is not just another item on the compliance checklist. In practice, it opens up the question of how a company manages risk, suppliers, local legal requirements, technical measures and management responsibility.

For organisations operating across multiple countries, the biggest challenge is connecting a common framework with local reality. A single European checklist can be a starting point. But it is not enough for real implementation.