Who it’s for
Monday, 7:40 a.m.
A customer questionnaire asks: who can reach your production through remote maintenance? The answer sits in three spreadsheets and the head of a colleague on vacation.
With Complass it is on one page, with the approval. Your coffee is still warm.
NIS2 for the company, the CRA and Machinery Regulation for the products, IEC 62443 for the plants. Each framework brings its own evidence and owners.
Controllers from several decades, remote maintenance by vendors and integrators, firmware without support: many plants lack a complete OT inventory.
Security questionnaires from customers arrive ever more often, and the answers are scattered across spreadsheets, folders and people’s heads.
Machine building is listed in Annex 2 of the German BSI Act. From medium size onwards you are therefore an important entity under NIS2, with these obligations:
Frameworks: NIS2 · IEC 62443 · ISO 27001 · Machinery Regulation · CRA · TISAX
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Every plant is a project of its own: zone model and remote maintenance per customer plant, plus your own works under NIS2.
Product families with a shared SBOM and vulnerability handling throughout the support period.
Chemicals, food and plastics with process control systems: asset inventory, zones and business continuity for production outages.
ISO 27001 as the basis for customer evidence, plus preparation for the TISAX assessment along the VDA ISA.
OT inventory
Capture controllers, drives, operator panels and network components from network captures in the browser, with vendor, firmware and end of support.
Zones and conduits
Divide production into zones, document connections and remote access as conduits and set security levels.
Vulnerabilities
Find known vulnerabilities of your components and rank them by whether they are actively exploited and how exposed the plant is.
You answer your customers’ questionnaires from what you already have and invite your suppliers to a self-assessment.
Two industry templates cover the typical tasks in machine building: one for your own production, one for your own products. They can be combined. For automotive suppliers, TISAX can be added as a framework of its own.
available
from €546 per month plus VAT in the Start package, size S, annual payment
available
from €447 per month plus VAT in the Start package, size S, annual payment
available
from €199 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 6 November 2026. Enterprise and groups of companies on request.
If you manufacture machinery and are at least medium-sized, usually yes, as an important entity. What counts is your main activity, the number of employees and turnover and balance sheet total. The applicability check tests this in a few minutes.
ISO 27001 is the usual framework for office IT and the management system, IEC 62443 for production and plants. Many industrial companies use both. In Complass you link the requirements so that you document a measure only once.
Yes. Your measures, evidence and documents are kept in one place and can be prepared for customers as Excel or PDF. This way you answer recurring questions from what you already have.
White papers: NIS2 for companies in every sector: directly in scope or via your customers Cyber Resilience Act for manufacturers of hardware and software Your customer's security questionnaire: NIS2 for suppliers and service providers
Other sectors and roles: Manufacturers Operators Medical technology All audiences at a glance
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
