Cybersecurity is becoming a legal obligation, and you no longer need to be attacked to be penalised

For most of the last twenty years, industrial cybersecurity was a matter of good practice. Standards existed, auditors liked to see them followed, and if you did not follow them, nothing much happened. The firewall project slipped to next year’s budget, and the plant kept running.

That has changed in most of the countries where an international manufacturer operates. One feature of the change deserves to be said plainly: you no longer have to suffer an attack to be sanctioned. Failing the obligation is itself the exposure.

Europe: NIS2

The NIS2 Directive entered into force in January 2023, and Member States had until 17 October 2024 to transpose it. Several are late, but the direction is fixed. For pharmaceutical manufacturing, which the Directive lists by name in its health sector, the points that matter are these.

• Essential entity status for large manufacturers, with the stricter supervisory regime: inspections and audits can come before any incident, not only after one. Medium-sized manufacturers are important entities, supervised after the fact.
• An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within a month.
• Supply chain security is part of the risk-management measures the entity itself must take. Your suppliers’ weaknesses are your obligation.
• Management bodies approve the measures, oversee them and can be held liable. In boardrooms, that is the provision that actually changes behaviour.
• Fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher, for essential entities.

Europe: GMP Annex 11

The revision of Annex 11 on computerised systems went out for public consultation in July 2025, and the consultation closed on 7 October. The draft moves security from an implicit expectation to an explicit one, with security requirements, supplier oversight and data integrity controls written out instead of read into the general clauses of the 2011 text. It is a draft, and the final wording may change. The direction is unlikely to.

For a GxP site, this is the one to watch. It turns a cybersecurity gap into a GMP finding, and a GMP finding travels through a very different, and far less comfortable, channel than an IT audit: an inspection report, a CAPA with a deadline, and a quality head who now has a personal interest in your firewall rules.

Switzerland, China, Japan

Switzerland. Since 1 April 2025, operators of critical infrastructure must report cyberattacks to the federal cybersecurity office within 24 hours of discovery. Fines have applied since 1 October 2025; under the Information Security Act they can reach CHF 100,000 for an operator that fails to report.

China. In September 2025 a draft amendment to the Cybersecurity Law, the first since it came into force in 2017, went to the Standing Committee of the National People’s Congress. It raises penalties sharply, up to 10 million yuan for operators of critical information infrastructure whose failures have serious consequences. Data localisation requirements for operations in the country stay in place.

Japan. The Active Cyber Defence law was enacted in May 2025 and phases in until 2027. Operators of critical infrastructure will have to report cyberattacks to the government and declare the important IT systems they bring in.

The United States: a correction worth making

In pharmaceutical presentations, the US position is often summed up as “FDA now requires an SBOM”. True, but it concerns medical devices, not drug products.

Section 524B of the FD&C Act requires a software bill of materials and a plan to monitor and address vulnerabilities in premarket submissions for cyber devices. The FDA guidance implementing it was finalised in June 2025. None of this applies to a new drug application.

The distinction matters on a combination-product or device-adjacent site, where both regimes can apply to different parts of the portfolio. It also matters in the meeting room, where someone will know.

Where to start when the scope looks impossible

The usual reaction on a mid-sized site is paralysis: the scope reads as enormous and the deadline as someone else’s problem. In France alone, ANSSI expects several thousand entities across eighteen sectors to be covered, medium-sized companies among them. In practice the first three moves are small, and they are the same every time.

Establish in writing whether you are in scope. Sector, size, role in the supply chain. A dated note answering that question is the first document an authority will ask for, and the national authority’s online eligibility test is a good place to begin.

Inventory the installed base. It does not need to be perfect, it needs to be real: what is connected, what runs on it, who supports it. Every later decision depends on it.

Name someone. The directive puts responsibility on management. Until one person is accountable for OT security on the site, nothing that follows will hold.

And one argument worth making internally, because it survives whatever the transposition date turns out to be: the controls the directive asks for — knowing what is installed, segmenting the network, controlling who connects remotely, being able to restore — are the same ones that shorten an unplanned outage. A site that can restore a controller after an attack can restore it after a disk failure. The compliance budget and the availability budget buy the same thing.

The direction, not the list

Any table of regulations is out of date within a year, so learning it by heart is pointless. Three things hold across all of them, and will keep holding.

1. Reporting windows are short and getting shorter. Twenty-four hours is now typical. Treat it as an operational capability rather than a compliance deadline: detection, internal escalation, someone with authority to decide, and a notification template must all exist before the incident. Twenty-four hours is not enough to invent them, especially if the incident starts on a Saturday night and the person who knows the DCS is on holiday.
2. Liability is moving towards named individuals. The compliance conversation changes tone once a director is personally exposed.
3. Supplier security is your obligation. You will be asked about your integrators, your equipment vendors and your remote-support providers, and “that is their responsibility” no longer works as an answer.

For an OT team, the practical consequence is modest and concrete: know which of your sites fall in scope, write down who decides and who reports when something happens on the plant floor, and check that your contracts with integrators say what they owe you when they find a problem.

What used to be good practice is becoming a legal requirement, audited and sanctioned. The obligation is now certain everywhere an international manufacturer operates; only the date it bites varies by country.

References

• Directive (EU) 2022/2555 (NIS2), Articles 20, 21, 23, 32 and 34, Annex I.
• ANSSI, NIS 2 in France: scope, entity categories and the online eligibility test.
• Federal Office for Cybersecurity (Switzerland), *Reporting cyberattacks on critical infrastructure mandatory from 1 April 2025*; Information Security Act.
• FDA, *Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions* (final guidance, June 2025).