NIS2 for chemical manufacturers and distributors
Chemical plants run on control systems that keep processes safe, and on supply chains that span ports, pipelines and road transport. NIS2 brings the manufacture, production and distribution of chemicals into scope for every medium-sized and large company.
In short: Companies that manufacture or distribute chemical substances or mixtures, or produce articles from them, are “other critical” entities under NIS2 when they are at least medium-sized, and usually important entities. Secrato maps NIS2, CyFun®, IEC 62443 and ISO/IEC 27001 to one control set, so plant OT, IT and supplier security share the same evidence.
Chemicals is a critical sector under NIS2
NIS2 Annex II covers undertakings that manufacture substances or distribute substances or mixtures, and undertakings that produce articles from substances or mixtures, using the REACH definitions. Group structure counts when sizing an entity, so a small site of a large group is usually treated as large. Check your scope →
Cybersecurity that respects process safety
Control systems on the same record as IT
Record distributed control systems, safety instrumented systems and the networks around them as assets, link them to zones, risks and controls, and keep evidence per plant.
Where cyber risk meets major-accident risk
Sites that handle dangerous substances already manage major-accident hazards under the Seveso rules. Link cyber risks to the processes they could affect, so safety and security teams look at the same risk picture.
Suppliers, logistics partners and customers
Keep a register of suppliers and logistics partners with questionnaires and follow-up, and answer your own customers’ security questions from one place.
BUILT FROM BELGIUM
What applies to chemical companies in Belgium and the Netherlands
Chemical companies in the Belgian port and industrial clusters register with the CCB via Safeonweb@Work and can use CyFun® or ISO/IEC 27001 to show the NIS2 measures. Dutch companies, from the Rotterdam port area to Chemelot, register with the NCSC via MijnNCSC under the Cyberbeveiligingswet. IEC 62443 is the common language for OT security in contracts and audits.
Secrato is built in Belgium and hosted in a Tier IV data centre in Antwerp. Start with the free supplier security questionnaire or the incident response playbook.
Common questions
Are chemical companies in scope of NIS2?
Yes. The manufacture, production and distribution of chemicals is an Annex II sector. Companies that are at least medium-sized (50 or more staff, or turnover and balance sheet both above €10 million) are generally important entities. Use the NIS2 scope checker for a first answer.
Are chemical distributors covered, or only manufacturers?
Both. Annex II covers undertakings that manufacture substances, that distribute substances or mixtures, and that produce articles from substances or mixtures, as defined in the REACH Regulation.
How does NIS2 relate to process safety and Seveso?
They are separate regimes, but they meet in the control systems: an attack on OT can create a safety incident. Secrato lets you link cyber risks to the processes and assets they affect and use IEC 62443 to show OT measures.
Can a chemical company be an essential entity?
Annex II entities are generally important. A company becomes essential if the authority designates it, for example when it is identified as a critical entity or as the sole provider of a service essential to society.
See how Secrato maps NIS2 to your plants
Show us your plants, control systems and frameworks, and we will map them to one control set in Secrato.
