Overview of the European NIS2 Directive

NIS2 is a new EU directive you need to pay attention to.

While there's no denying that digitalization has made for more efficient internal and external processes, easing the movement of goods and minimizing costs, it's this very reliance on interconnected digital systems that has left manufacturers—and their value chains—vulnerable to an unprecedented level of cybersecurity threats as cybercriminals increasingly target vulnerabilities within the supply chain. 

The European Union has once again addressed this area of deep concern through the Network and Information Security Directive NIS2, taking legal measures to bolster cybersecurity defenses across a broader range of sectors, introduce executive accountability, make companies responsible for their supply chains, and implement significant financial penalties for non-compliance.

Let's explore how the NIS2 Directive sets new standards for cybersecurity and what it means for you and your business partners.

The Rising Threat Of Cybersecurity in the PCB Industry

As the capabilities of our adversaries mature, so must our response.

According to CrowdStrike's Global Threat Report 2024, in 2023, the technology sector was the most frequently targeted industry for interactive intrusion activity, and the telecommunications sector was the second most targeted industry.

As key components in almost all electronic devices, PCBs are crucial assets in these and many other vital industries such as aerospace, automotive, and healthcare; any disruption in PCB supply chains caused by cyber threats has the potential to ripple across entire sectors, causing costly delays and operational standstills. However, over the past decade, manufacturing has been transformed by what's been labeled as Industry 4.0 and digital innovations like digital twins, robotics, AI, cloud computing, and the Industrial Internet of Things (IIoT). While these advancements enhance growth and efficiency, they also increase the sector's exposure to cyber threats, offering new entry points for cybercriminals to exploit.

Other factors heightening cybersecurity risks in manufacturing include insufficient employee training, where a lack of awareness may lead to weak passwords or vulnerability to phishing attacks. Additionally, reliance on outdated systems without modern security features creates cyber risks, as do complex supply chains with numerous third-party partners that present multiple entry points for hackers. The highly competitive nature of the industry and its reliance on data-driven operations also increases the likelihood of intellectual property theft or data breaches.

Cyber threats can take many forms, including supply chain attacks, ransomware, intellectual property theft, and production sabotage, and introduce significant financial, strategic, and reputational risks.

Common Types of Cyber Attacks in Manufacturing

Common types of cyber attacks in manufacturing and how they work:

• Ransomware attacks: Malicious software ("malware") that restricts access to a computer system or files until a ransom is paid.
• Phishing attacks: Deceptive emails, websites, or messages designed to trick individuals into disclosing sensitive information.
• Whaling campaigns: Sophisticated phishing attacks targeting high-ranking individuals within an organization.

What does this look like in reality? Through a ransomware attack, bad actors may halt production entirely, with losses cascading both up and down the supply chain. The exposure of proprietary PCB designs through data breaches could lead to possible market losses and competitive disadvantages.

As a recent example of the very real threat cybersecurity poses to the industry, U.S.-based semiconductor supplier Microchip Technology has confirmed that a recent ransomware attack led to the theft of personal information and other data from its systems. The company reported the incident on August 20, notifying the U.S. SEC that some servers and business operations were affected. However, they managed to contain the attack by isolating the impacted systems.

Understanding The NIS2 Directive

An extension of the NIS Directive that was introduced in 2016, which primarily targeted sectors of critical infrastructure, like energy and transport, NIS2 widens the scope of the original regulatory framework, requiring organizations across a broader range of industries to adopt them, a response to the increased maturity and intensity of today's cybersecurity landscape.

Key aspects of the directive you need to be paying to include:

• Expanded Scope: Unlike its predecessor, the NIS2 Directive includes a broader array of sectors, expanding from core infrastructure industries to a range of manufacturing sectors, including PCB manufacturing, which is classified under the "essential" sector category. The goal is to protect entities that provide services critical to economic and social activities.
• Stricter Security Requirements: NIS2 enforces more robust cybersecurity measures by mandating that organizations implement procedures for detecting and handling cyber incidents while ensuring business continuity, including incident prevention, risk management, and incident response requirements.
• Enhanced Supply Chain Security: Regulated in Article 21(2)(d), one of the most important elements of the NIS2 Directive for manufacturers introduces standards for assessing the cybersecurity posture of suppliers. Under this provision, key and essential entities must implement appropriate and proportionate technical, operational, and organizational measures to safeguard supply chain security.
• Incident Reporting Obligations: Under NIS2, organizations are now required to report incidents to national authorities, imposing a 24-hour deadline for initial reporting and further updates within 72 hours.
• Accountability and Governance: Adding a new level of responsibility for company executives, under NIS2, organizations must appoint a designated officer or manager responsible for cybersecurity, and senior management can be held accountable for non-compliance. 
• Sanctions for Non-Compliance: The NIS2 Directive allows for significant financial penalties for non-compliance. These penalties vary but can reach up to €10 million or 2% of the company's global turnover, creating a compelling economic incentive to adhere to the standards.

What NIS2 Means For Your Supply Chain

By setting more stringent cybersecurity standards across integral industries, the NIS2 Directive presents both an opportunity and an obligation for PCB manufacturers to meet heightened cybersecurity standards and create more resilient supply chains while doing so.

Here are some specific impacts of the directive on PCB manufacturing supply chains:

Heightened Cybersecurity Standards

The NIS2 directive mandates that PCB manufacturers meet a rigorous set of cybersecurity requirements, including creating and maintaining strong security frameworks, from regular vulnerability assessments to implementing multi-factor authentication and encryption protocols.

Organizations will need to ensure they have mechanisms and budgets in place to continually identify, assess, and mitigate cyber risks, a commitment that may require hiring dedicated cybersecurity personnel, investing in advanced threat detection tools, and creating security operation centers (SOCs) to monitor network activity. For those who previously allocated limited resources to cybersecurity, it's a shift that must be carefully planned for.

Increased Supply Chain Visibility and Transparency

The directive's goal of increased supply chain security will require increased supplier and partner transparency and may require manufacturers to conduct security audits and assessments across the supply chain to ensure compliance with NIS2 requirements.

PCB manufacturers may need to have third-party vendors demonstrate their security practices, something that may cause friction with suppliers and lead to more strategic decision-making to ensure compliance, especially if suppliers are unwilling or unable to meet the directive's standards.

More Rigorous Incident Reporting Protocols

PCB manufacturers are required to report significant cybersecurity incidents to national authorities within 24 hours and provide further updates within 72 hours. As manufacturers well know, shortening time-to-action minimizes impacts. Although it may raise concerns about reputational damage, incident reporting is essential for limiting potential damages.

To meet these reporting requirements, manufacturers need robust incident detection, classification, and escalation processes. Having a streamlined incident response plan in place can prevent breaches from escalating and limit the impact on the overall supply chain.

Executive Accountability and Risk Management Culture

One of the NIS2 Directive's most impactful changes is the requirement for executive accountability in cybersecurity compliance. Top-level executives in PCB manufacturing firms must now be informed and involved in cybersecurity planning and response strategies.

This shift underscores the importance of embedding cybersecurity into the corporate governance structure. Executives need to be educated on cyber risks and encouraged to support cybersecurity initiatives. In turn, the directive emphasizes a "cybersecurity culture," where employees at all levels are trained in best practices, threat awareness, and safe digital behavior.

Penalties and the Cost of Non-Compliance

With penalties of up to €10 million or 2% of a company's global revenue, the financial repercussions of non-compliance with the NIS2 Directive are hefty, and for many PCB manufacturers, they pose a serious threat. Organizations can face severe consequences for failing to meet legal obligations. Companies should take a proactive stance that exploits the opportunity to differentiate and invest in compliance not only as a regulatory obligation but as a cost-saving, brand-enhancing measure.

Beyond the fines, reputational damage could be substantial, especially for manufacturers working with sensitive or high-profile clients. Non-compliance or significant cybersecurity breaches could result in a loss of consumer and partner trust and, ultimately, risk your long-term viability and growth.

How to Comply with the NIS2 Directive

Compliance with the NIS2 Directive requires strategic planning and resource allocation. Here are a few steps PCB manufacturers should consider:

Conduct Cybersecurity Risk Assessments: To help create a targeted cybersecurity strategy and address high-risk areas first, start with a comprehensive cybersecurity risk assessment to identify potential vulnerabilities. 

Develop a Robust Supply Chain Security Strategy: Work closely with suppliers to evaluate their cybersecurity practices and set an action plan to address any concerns. Establish contractual obligations for compliance with cybersecurity standards and require regular reporting on security posture.

Implement Advanced Incident Detection and Response Systems: Invest in systems that provide real-time threat detection and response systems. Establish incident response protocols that allow for swift action and compliance with reporting requirements.

Train Executives and Employees on Cybersecurity Best Practices: Implement a robust training program that involves not only technical staff but also executives and all employees. Building a "cyber-aware" culture can reduce human errors and bolster overall cybersecurity. If you're looking for more help in this area, The World Economic Forum offers a playbook for building a culture of cyber resilience in manufacturing.

Establish Clear Governance and Accountability: Appoint a cybersecurity officer or establish a cross-functional team responsible for cybersecurity compliance. This team should regularly report to the executive board, providing updates on compliance, risks, and incident management.

A More Resilient, Secure PCB Supply Chain

Although compliance may be a hurdle that requires substantial commitment, investment, and adaptation, the upside is a more transparent, secure, and resilient PCB supply chain.

To help put the effort and costs into perspective, Applied Material's 2023 supply chain incident was estimated to have cost the company $250 million.

The importance of cybersecurity in modern times is not undermined by customers and clients and shouldn't be jeopardized by your supply chain. By proactively addressing their vulnerability points and ensuring compliance with the NIS2, companies can not only mitigate the risks of disruption but differentiate themselves as reliable, trusted partners that are doing their part in ensuring the stability and security of the global PCB supply chain.