Manufacturing & Machine Building · NIS2 & IEC 62443
If you manufacture machinery, electronics, electrical equipment, vehicles or medical devices, you fall under NIS2 as an important entity from 50 employees or more than 10 million EUR in both annual revenue and balance sheet total. In practice, the technical benchmark for that is usually IEC 62443, backed up by the BSI's ICS Security Compendium. We test exactly where IT meets production: PLCs and SCADA systems, remote-maintenance access, and the factory floor itself, without putting your production at risk in the process.
The question every plant manager asks first
We test without stopping the line. Active testing happens only inside windows you agreed to beforehand, and on OT-adjacent systems we read along instead of writing.
Four layers, two ways in. The second one bypasses everything the upper layer protects.
How common real incidents are
24%
Roughly one in four companies in mechanical and plant engineering reported a significant cybersecurity incident within the past two years.
That makes an incident an operating risk like a machine failure rather than an exception. Most plants still treat the two differently: the machine has a maintenance plan, the network behind it rarely has a test plan.
Source: VDMA study Industrial Security und Produktpiraterie 2024, Fraunhofer AISEC, 100 surveyed VDMA member companies
The core view
A plant can be cut open like a building. Office IT on top, with workstations, goods receiving, and the break room. Below it production control, with control systems and remote-maintenance access. Below that the control layer, with PLCs and fieldbuses. At the bottom, the machines themselves. Between the first and the second layer sits the point everything turns on.
Two ways in
Way in 1 · from above
This path arrives at the top, in office IT, and works its way down from there. On the way it runs into everything you have built: endpoint control, permissions, segmentation. Each of those costs an attacker time and leaves traces behind.
Way in 2 · from the side
The uncomfortable one. The machine vendor's access does not arrive at the top, it arrives from the side and directly below the fault line. It skips every measure on the upper layer, and it is reachable from outside without anyone inside the building clicking on anything.
Workstations, goods receiving, break room, Active Directory
A prepared USB stick in the break room, a phishing mail to shift planning, a door held open at goods receiving. Whoever lands here is standing in a network that, in many plants, is still connected to everything else.
Media dropping and phishing tailored to shift work and third-party contractors, plus entry attempts and the classic office IT inside the plant including Active Directory. On this layer we test actively.
See social engineeringControl systems, SCADA, remote-maintenance access
Machine builders and system integrators need remote access for service and maintenance. If that access sits on the network without multi-factor authentication or with overly broad permissions, it leads past everything secured above it.
Remote-maintenance access, control systems, and their permissions, scheduled around your production windows. Active steps run only inside time windows agreed beforehand.
See OT/ICS pentestPLCs, fieldbuses, engineering stations
PLCs, control systems, and fieldbuses are often built for uptime rather than security, and can run for years without a patch. Factory-default credentials on an industrial device are no rarity here.
We read along, we do not write. Reachability, firmware levels, and credentials are collected passively. No write access to a running controller takes place.
See infrastructure pentestMachines, sensors, industrial IoT
Sensors and networked machines widen the attack surface, frequently still on factory-default settings nobody ever changed. Whoever gets here is at the point where a mistake affects material and people.
We check field devices and industrial IoT for reachability, default credentials, and exposed services, as a rule passively and never without plant management at the table.
See custom pentestThe fault line
Exactly where classic office IT touches the production layer, the network segmentation that would otherwise stop the spread is often missing. That single property decides whether a compromised office workstation becomes an annoyance or a production standstill.
Without segmentation
Without a separation between office IT and the production network, PLCs, control systems, and the machine vendor's remote-maintenance access are all reachable from the compromised workstation. The way down is open, and nobody notices as long as nobody looks.
With segmentation
Once the boundary is drawn and enforced, the incident stays in office IT. The damage is then an IT problem with a recovery effort, not a manufacturing problem with idle lines and delivery dates at risk.
How it reads in the report
No network segmentation between office IT and the production network
How we test it
We take a foothold in office IT and try to move from there toward the production network. Whatever turns out to be reachable gets documented rather than exploited. The result is a list of the crossings that stand open, with an assessment of which one should be closed first.
A scenario from real assessments
Media dropping is an established social-engineering technique we run in a controlled form at Access Granted on a regular basis. Not a specific incident at a specific customer, just a typical sequence that shows how little it can take. Every step belongs to one of the four layers of the plant section.
Layer 01 · office IT
Placed unobtrusively, often carrying a company logo or a label designed to spark curiosity.
Layer 01 · office IT
Out of curiosity, a wish to be helpful (“maybe it belongs to someone”), or plain habit, with no bad intent at all.
Layer 01 · office IT
From there, the real assessment checks how far that access could be pushed toward the production network.
Fault line · layer 02 and below
Without segmentation between office IT and the production network, PLCs, control systems, and the machine vendor's remote-maintenance access are all reachable from the compromised workstation. We document that path rather than walking it to the end: on OT-adjacent systems we work passively, and actively only in pre-agreed time windows.
All four layers
Every finding rated by severity, exploitability, and potential impact on production, with a management summary for executive, IT, and plant leadership and a mapping to NIS2 and IEC 62443. This is what an excerpt can look like:
We measure how high the pickup rate actually is at your company, and whether missing segmentation turns that into more than a footnote.
The report assigns every finding to the layer it was found on and names the matching measure. Executive management reads the summary, IT leadership reads the technical part, plant management reads the part that affects the lines.
| Severity | Finding | Remediation area |
|---|---|---|
| Critical | USB-drop test: 3 out of 10 planted sticks were plugged in (example figure) | Awareness & endpoint control |
| Critical | No network segmentation between office IT and the production network | IT/OT segmentation |
| High | Remote-maintenance VPN for a machine vendor reachable without multi-factor authentication | Remote-maintenance access |
| High | PLC firmware left unpatched for years across multiple lines | Patch & firmware management |
| Medium | Tailgating: entry into the production hall possible without a badge check (example figure) | Physical access control |
| Low | Industrial device reachable with factory-default credentials | Credential hardening |
Illustrative example – no real customer data.
Are you in scope
Six manufacturing branches are listed in Annex 2 of the BSIG, including machinery, electronics and vehicles. Anyone active there who reaches the size thresholds counts as an important entity. The order in which that is checked is set out in § 28 BSIG, and it asks about the activity first and the size second.
Size thresholds
Employees
50 and above
The company is counted, not the individual site.
or
Annual revenue and balance sheet
10 million EUR, each more than
Revenue and balance sheet total must both be exceeded; alternatively, headcount alone is enough.
Result
Machine building, electronics, automotive parts, and medical devices are all listed entity types within manufacturing. The German NIS2 implementation act has been binding law since 6 December 2025. Not sure whether you cross the threshold? The free scope check walks you through the assessment in order.
Layer 01 · office IT
The requirement catalog under Article 21(2) asks for access control, personnel security, and training, among other things. A pentest on this layer demonstrates exactly that technically instead of asserting it.
Fault line
Segmentation between office IT and production is the point where risk management becomes measurable. Evidence for it comes from an attempt to defeat it, not from a policy document.
Layers 02 to 04
IEC 62443 is the practically recognised benchmark for what counts as appropriate in automation and control systems. Our reports map findings to it accordingly.
All layers
§ 32 BSIG requires staged reporting: an early warning within 24 hours and an incident report within 72 hours. Knowing in advance which layer is reachable how makes it far easier to say what happened when it counts.
Access Granted delivers the penetration test and the technical evidence. Registration with the BSI, the legal classification, and advice on either are not part of that and stay with you or your legal counsel.
Ground floor
The plant section does not start at a screen, it starts at the fence. Four stations on the site decide how easily somebody gets anywhere near layer 01 in the first place.
Station 01
Parcel deliveries, suppliers, truck drivers: unfamiliar people and unfamiliar objects come through here every day, often without anyone asking who actually belongs.
Station 02
Service technicians, cleaning staff, and temp workers move through the plant with their own laptops or their own badges. Their access and devices rarely go through the same controls as your own.
Station 03
Where colleagues are relaxed and happy to help, an orphaned USB stick or an offhand “I'm new here” is at its most convincing.
Station 04
A door held open, a smokers' exit, a badge check that only happens in the morning: the way into the production hall often bypasses technology entirely.
Physical testing runs on a written engagement with a named contact on file who can vouch for our people if it comes to that. Nobody on your team ends up in a situation they cannot resolve.
Our approach
Keeping production available matters more than test depth. Before we touch anything, we agree with IT and OT stakeholders which systems get actively tested, which are only analyzed passively, and which are excluded entirely. On PLCs, control systems, and other OT-adjacent systems we work passively as a rule: we read along, we don't write.
Where active testing is needed, it runs in pre-agreed production windows, with a defined emergency contact on both sides and a firm rule to stop immediately at any unexpected effect. Testing machines and lines never happens without plant management at the table, so no test step accidentally halts production.
You set the window, not us. With round-the-clock shift operation, active steps move to planned downtime, maintenance windows, or a test cell away from the line.
Test plan
The same structure that carries the plant section also decides what gets tested when. Going down, the approach gets more careful, because the possible consequences get larger.
| Layer | Module | Mode | Limit |
|---|---|---|---|
| Ground floor · premises | Physical pentest | Active | Written engagement, named contact on file, no confrontation. |
| Layer 01 · office IT | Social engineering & infrastructure | Active | No content from private mailboxes, no pressure on individuals. |
| Fault line · IT/OT | Network segmentation | Active | Reachability is demonstrated, the crossing is not walked to the end. |
| Layer 02 · production control | OT/ICS pentest | Active in the window | Only inside the agreed production window, emergency contact reachable. |
| Layers 03 & 04 · control and machines | OT/ICS pentest | Passive | No write access to running controllers, no restarts, no firmware changes. |
The assignment is the starting point, not the outcome. After the scoping workshop, the report states for every system which mode it was tested in.
Relevant modules
Where IT, OT, and the factory floor meet, one test isn't enough. These are the building blocks we work with.
Talk to us before someone else finds the gap first. A short call settles scope and NIS2 relevance, then you get a transparent fixed-price quote.
