FireSight OT · NIS2
Remote access to machines, the way NIS2 expects it
The EU's NIS2 Directive asks essential and important entities, including many manufacturers, to control who reaches their systems, to secure their suppliers' access, and to use multi-factor authentication. Remote access to machines touches all three. Here's how FireSight OT helps with the technical side.
Scope
Manufacturers are in scope
NIS2 (Directive (EU) 2022/2555) covers medium and large organisations in the sectors listed in its annexes. Alongside energy, transport, water and health, its "other critical sectors" include manufacturing.
- Manufacture of machinery and equipment, motor vehicles and other transport equipment.
- Electrical equipment, and computer, electronic and optical products.
- Medical devices and chemicals.
- Food production, processing and distribution.
Whether your organisation is in scope depends on its sector, size and the national law of each country you operate in. Check with your national authority or adviser.
Article 21
The measures remote access touches, and how FireSight OT helps
Article 21(2) lists the cybersecurity risk-management measures each entity must take. These are the ones remote access to machines bears on directly.
| Article 21(2) | What it asks | How FireSight OT helps |
|---|---|---|
| (d) Supply chain security | Security in the relationships with direct suppliers and service providers. | Machine builders and integrators get vendor accounts: only the machines they're granted, two-factor sign-in, working hours and an end date. Open sessions close when time is up. |
| (i) Access control | Access control policies and asset management. | Nothing is visible until it's granted. Access is per machine or per Cloud Connector, to divisions, vendors or single people. Every machine and Cloud Connector is listed with its site and addresses. |
| (j) Multi-factor authentication | Multi-factor or continuous authentication, where appropriate. | Two-factor sign-in (TOTP) can be required for everyone, and is always required for vendor accounts. Single sign-on is supported too. |
| (h) Cryptography | Policies on the use of cryptography and encryption. | Every tunnel uses mutual TLS, TLS 1.3 only by default, with a certificate per Cloud Connector from the Hub's own authority, renewed automatically. |
| (b) Incident handling | Detecting and responding to incidents. | A full audit log of sign-ins, sessions, grants, file transfers and remote commands, exportable as CSV. End a session, disable a person or revoke a device at once. |
| (e) Secure maintenance | Security in acquisition, development and maintenance, including vulnerability handling. | Signed software updates for Cloud Connectors, sent from the Hub. A device refuses anything unsigned. |
| (c) Business continuity | Backups, disaster recovery and crisis management. | The Hub's data lives in one folder you can back up, and Hub files can be collected by your own backup software over SFTP or S3. Remote management keeps working even if a license lapses. |
Measure wording summarised from Article 21(2) of Directive (EU) 2022/2555.
Italy
Where the Italian timeline stands
Italy put NIS2 into law with Legislative Decree 138/2024, in force since 16 October 2024. The national cybersecurity agency, ACN, runs registration and supervision.
- Early 2025: organisations registered on ACN's platform, and were told in April 2025 whether they're on the NIS list.
- From about January 2026: incident notification obligations apply.
- By about October 2026: the security measures are due, 18 months after the NIS list was published.
- If you're on the list, remote access to your machines and your suppliers' access is part of what you need in place now.
Being straight about it
What FireSight OT doesn't do for you
No product makes an organisation NIS2-compliant. NIS2 is about governance, risk management, incident reporting and training across the whole organisation. FireSight OT covers one important technical area: remote access to your machines and networks.
This page is general information, not legal advice.
A practical way to use this page: share it with whoever owns your NIS2 programme, and add FireSight OT's audit log, vendor accounts and two-factor settings to your evidence of the access-control and supply-chain measures.
Also of interest to machine builders: FireSight OT and the EU Machinery Regulation.
See it on a sample plant
Vendor accounts, per-machine access and the audit log, in a live demo Hub with sample plants and one real machine network.
