Who it’s for
You manufacture chemical substances or produce and process food on an industrial scale. Both sectors are NIS2 sectors, and in both production depends on process control and automation systems. Complass combines information security for the company with OT security for your plants.
Batches, reactors and cold chains do not tolerate unplanned interruptions. A cyber attack on control systems quickly becomes a safety and quality problem.
Process control systems, controllers and operator stations of different generations, often with remote maintenance by vendors.
Buyers from industry and retail check their supply chain and expect evidence on information security and contingency planning.
Chemicals and food are listed in Annex 2 of the German BSI Act. From medium size onwards you are therefore an important entity under NIS2, with these obligations:
Frameworks: NIS2 · IEC 62443 · ISO 27001 · KRITIS Umbrella Act
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Manufacturers and importers of substances and mixtures subject to registration, from basic to speciality chemicals.
Industrial production and processing, such as dairies, meat and bakery products or beverages, with cold chain and traceability.
Wholesale and logistics for food; retail is not named in Annex 2.
Companies not covered by NIS2 themselves often supply customers that are, and need evidence for their supply chain.
Capture process control systems, controllers and network components from network captures, with vendor, firmware and end of support.
More about this featureDivide your plants into zones per IEC 62443-3-2, document connections and remote access as conduits and set security levels.
More about this featureRehearse production outages, set recovery times and maintain contingency plans for control systems and IT.
More about this featureFind known vulnerabilities of your components and rank them by whether they are actively exploited and how exposed the plant is.
More about this feature
The industry template preselects IEC 62443, asset management for IT and OT and MITRE ATT&CK for ICS. You add NIS2 as a framework.
available
from €526 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
No. Covered are manufacturers and importers of chemical substances and mixtures whose activity belongs to NACE division 20 and who are subject to registration under REACH, from medium company size onwards. Distributors and mere users are not named in this entity type.
Both sectors are listed in Annex 2 of the BSI Act, have the same NIS2 obligations and similar process control systems. The differences lie mainly in which companies are covered; they are listed above under the obligations.
NIS2 does not prescribe a specific standard but requires state-of-the-art measures, including for production plants. For control systems IEC 62443 is the widely used framework. In Complass you link both so that you document a measure only once.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
