Security becomes mandatory: New EU regulations such as the Cyber Resilience Act (CRA), NIS 2 and the Machinery Regulation mandate greater Security in production. Matthias Kuczera and Simon Nutz explain what machine manufacturers and operators need to know now – and how they can provide effective protection for their plant.
The number of cyber attacks on companies is increasing. What is the first step towards greater protection against such attacks?
Matthias Kuczera: Cybersecurity distinguishes between IT and OT Security. IT concerns office communication, whereas OT concerns the physical processes in production. Our products and services are specialised for OT Security. Companies should first of all check whether they are affected by current legal requirements such as the Cyber Resilience Act, the NIS 2 Directive or the new Machinery Regulation, and if so to what extent. Because legislators have also recognised that Security is highly relevant. An initial risk analysis is essential: what is worth protecting? What could happen? Which measures are appropriate? And: What to do in an emergency?
CRA, NIS 2 and MR: What awaits machine manufacturers and operators?
Simon, how does the subject of cybersecurity present itself when you are talking to customers in the field?
Simon Nutz: Most people know that they need to act, but many are unsure about what exactly is required. We do a lot of educational work and explain to customers what to expect: what needs to be implemented? What really affects the company? We start with the basics: what should be protected? What happens if a plant or OT in general is attacked? On this basis we build appropriate protection concepts.
What is the best possible way for machine manufacturers to prepare under the current conditions?
Kuczera: Companies actually have a vested interest in protecting themselves against cyber attacks. The EU guidelines are merely intended to ensure that all companies are adequately prepared.
The CRA affects all products with digital elements. From December 2027, these must meet a defined Security level. Anyone who purchases new machinery or IT infrastructure must act in accordance with CRA. Manufacturers who place their own products on the market must comply with the relevant processes. At Pilz, for example, we have a development process certified in accordance with IEC 62443–4‑1, thereby ensuring that secure product development lifecycle requirements are met.
Nutz: Anyone who follows IEC 62443 is already doing a lot of things right. Even if not all of the standards are fully available yet, it is a solid foundation.
What does the NIS 2 Directive require?
Nutz: NIS 2 is about enabling companies to prepare for a cyber threat scenario. The NIS 2 Directive applies to companies with over 50 employees or an annual turnover of more than 10 million Euro. These companies must identify risks and take appropriate measures: risk management, backup management and vulnerability management. In future, attacks must be reported. This allows other companies to quickly check whether they are also affected.
“There’s no Safety without Security – that’s the core message of the Machinery Regulation. Any Safety function can be compromised and must be protected.”
Matthias Kuczera, Standards Group at Pilz
Kuczera: An information security management system in accordance with ISO 27001 is an elegant way to meet the requirements. Alternatively there are information security management systems such as TISAX (Trusted Information Security Assessment Exchange). Each company must decide whether to go down this route or implement other measures.
Security starts in the machine
The new Machinery Regulation stipulates that Security aspects must now also be taken into account when assessing Machinery Safety. What is the best approach for a machine manufacturer or operator?
Kuczera: There’s no Safety without Security – that’s the core message of the Machinery Regulation. It is now necessary to check whether a Safety function can be compromised and must therefore be protected accordingly. Even though the MR does not take effect until 2027, it makes sense to implement it now. Security gaps actually exist within the machine, i.e. in the OT. I need to know what my machine does and what the worst-case scenario is if an unauthorised person is in control of it. Is the data confidential? Is availability crucial? Then I analyse how an attacker might proceed and how to secure the control system. Because this controls the plant and must not be exposed on the Internet without protection. Misuse due to operating errors also need to be considered. Close communication between manufacturer and operator is important. Only the operator knows the actual risk in their application.
Pilz Podcast #43 || OT Security is coming – but how do I deal with it?
Industrial Security Consulting from Pilz
How does Pilz work with its customers to create an appropriate Safety concept, including Security?
Nutz: We start with a protection requirements analysis: is it about availability, functional safety or expertise? This is followed by a detailed risk assessment. We analyse all the assets, run through attack scenarios and develop protective measures. Then we evaluate their effectiveness. The process is cyclical: what is secure today might be obsolete tomorrow. Our advantage: we know the plants thanks to our safety expertise and we are involved in developing the relevant standards, e.g. IEC 62443.
“We know the plant’s weak points and work with our customers to develop effective protection concepts.”
Simon Nutz, Industrial Security at Pilz
Kuczera: Exactly.Pilz actively brings its experience to standards committees. EN 50742 is currently in development – a standard for protection against machine corruption. We are expecting the first draft at the end of the year.
Training for greater competence
Is there also training on Industrial Security?
Nutz: Yes, our entire training portfolio has been adapted to the Machinery Regulation. Security is a component of every course. We also offer two specialist training courses:
- Fundamentals of Industrial Security
- CESA – Certified Expert for Security in Automation
The basic training course delivers theoretical knowledge and practical examples. In the CESA training, we delve deeper into IEC 62443 and delegates qualify as security experts for industrial automation systems.
6 steps to Industrial Security – what companies should do now
1. Carry out a risk analysis
Which assets are worth protecting? What is the worst case?
2. Integrate Security into the Safety strategy
Safety functions must be protected from manipulation.
3. Increase communication with operators
Only they know the specific application scenario and risk.
4. Set up a firewall and access protection
Basic measures such as network separation and access control are essential.
5. Comply with standards and laws
CRA, NIS 2 and MR define clear requirements.
6. Evaluate Security cyclically
A one-off risk assessment is not enough – threats change.
Discover Pilz’s Industrial Security training courses: Industrial Security training in accordance with IEC 62443
This interview was conducted by Johannes Gillar and appeared in KEM Konstruktion|Automation, 06/2025 issue.
Loading...
