Solutions · Industry and manufacturing
In machinery manufacturing, requirements usually come from customers: quality management under ISO 9001, an information security questionnaire, a clause in the framework agreement. On top of that comes NIS2 for medium-sized and large manufacturers. Sightadel organises this in one platform, distributes tasks across quality, IT and production and records what is evidenced.
Starting point
Many mid-sized manufacturers have held an ISO 9001 certificate for years. Quality management is well established, the manual is maintained, the surveillance audit is routine. Information security, by contrast, long ran alongside. The IT department takes care of firewall, backups and user accounts, production of its control systems. A shared overview is rare.
This is now changing from three directions. Large customers, especially from the automotive industry, require evidence of information security from their suppliers and send extensive questionnaires. Since December 2025, the German NIS2 Implementation Act (NIS2UmsuCG) has also covered manufacturers of machinery, vehicle parts and electronics from medium size upwards. And the Cyber Resilience Act adds obligations for products with digital elements, that is, for connected machines and their software.
The good news: a company with quality management that is actually practised already has the foundations. Document control, internal audit, management review and corrective actions work the same way for information security. If you manage both in one system, you maintain these processes only once.
Why now
An OEM or large supplier sends an information security questionnaire or requires an assessment under an industry standard. The answers must be backed by evidence, and the deadline is usually already set.
Machinery, vehicle manufacturing and electronics belong to manufacturing in Annex 2 of the German BSI Act (BSIG). From 50 employees or more than €10 million in annual turnover and balance sheet total, manufacturers are usually important entities. Registration, risk management and reporting obligations follow from this.
Malware shuts down engineering workstations or the control room, and production stops. Afterwards, insurers, customers and management ask which measures were in place and why the office and production networks were not separated.
A new edition of ISO 9001 was published in September 2026. For certified companies, a transition period is running. This is a good moment to declutter quality management and include information security at the same time.
Machines with remote maintenance, apps or cloud connection count as products with digital elements. The Cyber Resilience Act sets its own requirements for their manufacturers. The first reporting obligations already apply.
Buyers and banks now also review information security and supply chain risks at family businesses. Orderly evidence avoids follow-up questions and price reductions.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
Not required by law, but in industry usually a prerequisite for framework agreements and supplier approvals. The new 2026 edition keeps the familiar structure. Existing certificates remain valid during the transition period; the transition takes place as part of an audit by the certification body.
View framework →The internationally recognised certificate for information security. Many customers accept it as proof or as a basis. Industry-specific assessments, such as those automotive manufacturers require from suppliers, build on ISO 27001 in content. An ISMS under ISO 27001 creates a solid basis for this, but does not replace such an assessment.
View framework →Manufacturers of machinery, vehicles, vehicle parts, electrical equipment and electronics are listed in Annex 2 of the BSIG. From medium company size upwards, they count as important entities. What matters is the actual activity, not the entry in the commercial register. Smaller manufacturers are often reached by the requirements anyway, because affected customers have to assess their supply chain.
View framework →Applies to every company, even if the focus is on technical data. Personnel data, customer contacts, access control and video surveillance at the plant are the typical topics. The technical measures can be proven with the same evidence as in the ISMS.
View framework →For manufacturers with customers or a parent company in the USA, a common language for describing cybersecurity maturity. Not a certificate, but a useful framework for reporting to management.
View framework →Recommended order
First, you check whether your company falls under NIS2 based on activity and size. In parallel, you collect what your most important customers require contractually. This shows which goal comes first and by when.
Sites, plants, production networks, engineering, sales and service: what belongs in the scope of the ISMS? With existing quality management, you take over context, interested parties and process map and add the information security perspective.
IT knows the servers, workstations and cloud services. Control systems, operator stations, remote maintenance access and older systems without updates are often known only to production. Both lists belong together; otherwise the largest attack surface remains unassessed.
The controls are answered and backed with evidence. Open items become measures with a deadline and owners. Typical big items are network segmentation, remote maintenance, restore tests and vendor assessment.
You combine internal audit and management review with quality management. Under NIS2, management also formally approves the implementation of the measures with a date, monitors it and undergoes training.
The certification audit is carried out by an accredited body of your choice. After that, surveillance audits, training and tests run as recurring cycles, so that your status is still correct for the next customer questionnaire.
Focus
Three topics set machinery manufacturing apart from other industries. They deserve their own place in the system from the start.
Control systems and operator stations often run for many years, some with operating systems no longer supported by the manufacturer. Replacing them is rarely possible straight away. An ISMS then does not demand new purchases, but a deliberate assessment: network segmentation, restricted access, documented exceptions with justification and expiry date.
Many installations are maintained remotely, by your own service team or by the supplier of a component. Who may access when, and how is access approved and logged? These questions appear in almost every customer questionnaire and in the measures under NIS2.
You assess your own vendors, for example for software, cloud services, electronic components and contract manufacturing. At the same time, your customers assess you. A well-maintained vendor register and a Trust Center answer both sides with the same data.
Regulation (EU) 2024/2847 concerns manufacturers of products with digital elements. Since 11 September 2026, reporting obligations have applied to actively exploited vulnerabilities and severe incidents; most other obligations apply from 11 December 2027. Sightadel does not include a dedicated module for this. But the requirements can be mapped as a custom framework, and much from the ISMS carries over, such as vulnerability management and reporting channels.
How Sightadel helps
ISO 9001, ISO 27001 and NIS2 are worked through control by control. Where requirements are similar, for example for document control, internal audit and management review, one piece of evidence counts for several frameworks.
Learn more →Gaps become tasks with a deadline and owners. Quality, IT and production see their part. External service providers, such as whoever looks after the production networks, work directly as Contributors.
Learn more →Software vendors, cloud services, contract manufacturers and remote maintenance partners are managed with criticality, questionnaire and evidence including validity date. Expired certificates stand out before the customer asks.
Learn more →Your customers see certificates, approved policies and security measures on a dedicated page. Many questions from supplier questionnaires are answered before they are asked.
Learn more →You map customer-specific requirement catalogues, internal plant standards or the requirements of the Cyber Resilience Act as a custom framework, also via import from Excel or Word.
Learn more →Sightadel checks the externally visible attack surface of your domains, such as website, mail server and customer portal. What every attacker sees, you see first.
Learn more →The view from outside
OEM questionnaires increasingly ask about vulnerability scans and how findings are handled. Together with veyrisk, we check your externally reachable systems, such as remote maintenance access, VPN and customer portals. You store the results as evidence in Sightadel and use them to answer the matching questions in the questionnaire.
Mid-sized manufacturers with remote maintenance, customer portals or NIS2 obligations
For separating office and production networks, we also offer hardware firewalls from Valar. We will clarify what fits in a short conversation.
Request consultationEffort and duration
The ranges are based on experience, not a commitment. The biggest factors are the number of sites, the state of the production networks and how much time IT and production can spare alongside day-to-day business.
What you license · typically Professional
A typical mid-sized company manages ISO 9001 and ISO 27001 together in the Professional edition. It includes ten users, 25 vendors and three custom frameworks, enough for quality, IT, production and a customer catalogue. ISO 9001 and ISO 27001 themselves stay at list price. If you add NIS2 as needed, it comes with a permanent discount.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
Questions and answers
More in our FAQ or directly via our contact form.
No. Sightadel does not carry out automotive industry assessments and does not prepare specifically for them. But an ISMS under ISO 27001 covers many of the topics such assessments ask about and thus creates a good basis. Which audit your customer requires exactly is something you clarify directly with them.
No. Both standards share the same basic structure. You manage context, leadership, document control, internal audit, management review and improvement together. In Sightadel, one piece of evidence is linked to both frameworks. What is new is mainly the information security risk analysis and the controls from Annex A.
If you manufacture machinery, vehicles, vehicle parts, electrical equipment or electronics and have at least 50 employees or more than €10 million in annual turnover and balance sheet total, it is very likely. You would then be an important entity. With groups of companies and several activities, it gets detailed. The final classification is a legal question for your advisers.
Document them honestly. No framework requires you to replace working installations immediately. What is expected is that you know, assess and limit the risk, for example through network segmentation and restricted access. In Sightadel, you record such exceptions with justification, owner and expiry date.
Your certificate remains valid during the transition period. Your certification body checks the transition, usually together with a surveillance or recertification audit. You agree the exact dates with them. It pays not to wait until the last year, because audit capacity will then be scarce.
No, not at present. You can set up the requirements as a custom framework and work with controls, owners and evidence as with any other framework. Whether and how your products fall under the regulation is something you clarify with your legal advisers.
Yes. Sightadel has six roles. Employees from production or a service provider for the production networks work on their tasks as Contributors, management follows along as Viewer, and your auditor gets their own role that can never delete anything. The activity log shows who did what and when.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
