Software Lantern

For factory and plant operators

As an operator, NIS2 is the organizational rule most likely to reach you, if your sector and size put you in scope. If it does, one of its ten minimum measures is supply-chain security, which covers the machine builders, integrators, and service providers who have remote access into your systems.

● in force · ○ upcoming · checked against the sources above on 19 October 2026.

Is your organization in scope?

NIS2 covers 18 sectors; this site doesn't attempt to classify every one of them (your country's official self-evaluation tool, linked from the checker, does that). Size is generally the first gate: a company under roughly 50 staff and €10m in turnover or balance sheet total is generally outside NIS2's scope entirely, regardless of sector.

If you are in scope: vetting remote access into your systems

Article 21(2)(d) requires assessing the security practices of your direct suppliers, including anyone with remote access to your machines for servicing. This is an organizational requirement on you as the operator, not a product requirement on your suppliers directly, though it will likely affect what you ask of them.

Check your situation →