Cyber resilience

Holistic security compliance for industrial equipment

With the Machinery Regulation (EU) 2023/1230 and the Cyber Resilience Act (CRA) , two new legal frameworks will come into force in the EU in 2027, imposing extensive requirements on operators of industrial facilities. Starting in 2025, the NIS2 Directive (EU) 2022/2555 will expand the European Union’s regulatory framework with binding cybersecurity requirements—directly impacting manufacturing companies.

All three sets of regulations pursue a common goal: to increase safety standards – both in terms of personal safety and information security – through clear requirements for manufacturers, distributors, and operators of industrial systems.

High relevance for manufacturing companies

The new EU directives are particularly relevant for manufacturing companies for three key reasons:

Legal certainty: From 2027, only compliant machines may be sold or operated.
Protection against cyberattacks: The regulations help prevent production downtime, data loss, and industrial espionage.
Liability avoidance: Violations can lead to significant fines and personal liability for company management.

The NIS2 Directive in particular significantly increases the liability of managing directors and board members. Responsibility for compliance with IT security requirements no longer lies solely with the IT department, but explicitly with company management.

Dürr Consulting supports security compliance

As part of the international machine and plant engineering company Dürr, we responded early to the new regulatory requirements and developed comprehensive measures to ensure compliance.
As part of our consulting services—both in the planning of new production facilities and in the optimization of existing production structures—we provide you with targeted support in minimizing risks and meeting legal requirements.
A key tool is our NIS2 checklist, which we use to evaluate the following points together with you.

NIS2 checklist for manufacturing companies:

Assessment of applicability
Registration requirement
Management responsibilities
Risk management
Minimum measures
Reporting obligations

Clear responsibilities as a factor for success

The NIS2 Directive requires the establishment of an internal risk management system. Although overall responsibility lies with management, operational tasks such as the implementation of technical security measures, risk analyses, or the creation of IT security concepts can be delegated—for example, to IT departments, CISOs, or external service providers.
Based on our experience, we support you in setting up a regulation-compliant organizational structure, defining central roles and responsibilities, and establishing effective processes – for example, for the timely update of security-relevant systems.

Safely planned. Safely operated.

With Dürr Consulting, you ensure not only technically sound factory planning but also an organizational structure that meets the upcoming requirements for security compliance in industrial facilities—holistic, feasible, and future-proof.