Discuss your project

TOOLBOX · COMPLIANCE & NIS2

Maturity Check Industry.

Check office IT and production together: 13 questions based on NISG 2026, Implementing Regulation (EU) 2024/2690 and the BSI modules for industrial IT, with an immediate maturity level, measures and sources.

13 Questions for Industry

0 of 13 answered

Stays in your browser: your answers are neither sent nor stored. They are gone when you close the page; print the report or save it as a PDF.

Answer Yes, Partially or No for each measure. Below each question it says what “Yes” means. If you do not know, choose No: a measure that nobody can confirm does not count as implemented.

  1. Question 1: Have you checked whether your company counts as an essential or important entity under NISG 2026 and, if so, registered?

    OrganizationFoundation

    Yes means: the classification has been checked and documented, and if your company is covered, it is registered with the cybersecurity authority. Checked but not yet registered: Partially.

  2. Question 2: Does management steer the security measures for office IT and production, has it appointed a person responsible for OT, and has it attended cybersecurity training itself?

    OrganizationFoundation

    Yes means: management has adopted the measures and receives regular reports, a person with overall responsibility for OT security is appointed and known, and management has been trained.

  3. Question 3: Is there an up-to-date inventory of all IT and OT systems, including controllers and operator PCs, with their external connections?

    OrganizationFoundation

    Yes means: the inventory lists components, versions and those responsible, and a network plan shows zones, transitions and external interfaces.

  4. Question 4: Are the office network and the production network separated, with controlled transitions, so that a disruption in the office does not reach production?

    Systems and NetworkKey measure

    Yes means: controllers and operator PCs are not in the office network, production is divided into zones, and a firewall at the transitions only lets permitted connections through.

  5. Question 5: Do machine and plant manufacturers access only through a central, controlled access point that your employees release for each session?

    Service ProvidersKey measure

    Yes means: a policy governs remote maintenance, all access runs through a security component under your responsibility, each session is released, and remote maintenance of one machine does not give anyone access to other systems.

  6. Question 6: Is multifactor authentication set up for remote access, email, cloud services and administrator accounts?

    Accounts and AccessKey measure

    Yes means: besides the password, all of this access requires a second factor, especially accounts with administrator rights.

  7. Question 7: Are server data and controller programs and configurations backed up regularly and before and after every change, stored outside the network of the systems backed up, and is recovery tested?

    Data and BackupKey measure

    Yes means: backups also cover controller programs and configurations, are created before and after every system change, are not in the same network as the system, and recovery is tested regularly, most recently successfully.

  8. Question 8: Are security updates for office IT and plants assessed and installed according to a fixed process, with defined compensating measures for systems that cannot be updated?

    Systems and NetworkKey measure

    Yes means: vulnerability notices from vendors and CERTs are tracked, updates are tested and installed, and where that is not possible, additional protective measures are defined and documented.

  9. Question 9: May USB sticks and laptops of service technicians be used in production only after approval and a malware check?

    Systems and NetworkImportant measure

    Yes means: there are rules and an approval process for external media and devices, data are checked before use, and interfaces that are not needed are disabled.

  10. Question 10: Do you set security requirements for suppliers and service providers with access to your systems, and do you check them?

    Service ProvidersImportant measure

    Yes means: selection criteria are defined, the requirements are in the contracts, and you check them, for example with a questionnaire.

  11. Question 11: Is there a process for security incidents with those responsible and contacts that also covers the early warning within 24 hours under NISG 2026?

    Incidents and EmergenciesImportant measure

    Yes means: definition, those responsible and current contacts are established, and the reporting channels under NISG 2026 and the GDPR are described. If your company is not covered by NISG 2026, the internal process including the notification of data breaches counts.

  12. Question 12: Is there a practiced plan for how production and IT restart after a cyberattack or outage?

    Incidents and EmergenciesImportant measure

    Yes means: an emergency manual with roles, immediate measures and restart plans exists, is accessible even in an emergency and has been practiced.

  13. Question 13: Are employees in the office and in production trained regularly in cybersecurity, for example on phishing and the secure handling of plants?

    PeopleImportant measure

    Yes means: everyone is introduced and trained regularly, including on handling controllers and mobile devices in production.

0 of 13 answered

HOW THE CHECK CALCULATES

Traceable
Instead of Gut Feeling.

13 questions, at most 28 points. The measures are based on the sources named, and individual implementation examples are recommendations by TOMORIS; weights and levels are an assessment by TOMORIS based on the effect of a measure.

  • 01

    Answers Become Points

    Yes counts 1, Partially 0.5 and No 0 points, each multiplied by the weight of the question. If you do not know, choose No.

  • 02

    Weight by Effect

    Key measure (3, here 5×): Directly protects against the most serious consequences of an attack or outage: data loss, standstill or the takeover of accounts and access. Important measure (2, here 5×): Makes an incident less likely or limits its extent and duration. Foundation (1, here 3×): Organizational prerequisite that works through the other measures, such as responsibility, overview or documentation.

  • 03

    Percentage and Level

    Points reached divided by possible points, rounded down to whole percent. Level 1 Getting Started: 0 to 39 percent. Level 2 Foundations: 40 to 69 percent. Level 3 Advanced: 70 to 89 percent. Level 4 Established: from 90 percent.

  • 04

    Key Measures Set a Limit

    If a key measure is answered with No, the maturity level stays at level 2 at most, even if the percentage is higher. The report lists the open measures sorted by weight.

BASIS

What the
Questions Are Based On.

NISG 2026 has applied since 1 October 2026. Whether your company counts as an essential or important entity depends on sector and size (Sections 24 and 25). In manufacturing, Annex 2 lists medical devices, electronic products, equipment of NACE division 27 (electrical equipment), machinery and vehicle manufacturing; manufacturers and distributors of chemicals as well as food businesses in wholesale and industrial production are added as separate sectors. Entities of this kind are covered as important entities from medium enterprise size; partner and linked enterprises generally count as well. Other branches of industry, such as the pharmaceutical industry, are listed in Annex 1.

Covered entities implement risk management measures under Section 32 NISG 2026. The details are set out in the Annex to Implementing Regulation (EU) 2024/2690; Section 2 NISV 2026 extends it to all essential and important entities.

For production and plants, the modules on industrial IT (IND) from the BSI IT-Grundschutz Compendium, Edition 2023, serve as a model. They come from a framework of the German Federal Office for Information Security (BSI) and are not a legal obligation in Austria. Even if your company is not covered by NISG 2026, the questions describe sensible protective measures.

More on the Industry & manufacturing industry · NIS2 Applicability Check (German) · All Downloads

QUESTIONS

Good to Know.

How is the maturity level calculated?

Each answer gives points: Yes 1, Partially 0.5, No 0, multiplied by the weight of the question (key measure 3, important measure 2, foundation 1). This checklist has 13 questions and at most 28 points. The points reached give a percentage, rounded down, which determines the level: level 1 Getting Started 0 to 39 percent, level 2 Foundations 40 to 69 percent, level 3 Advanced 70 to 89 percent, level 4 Established from 90 percent. If a key measure is answered with No, the maturity level stays at level 2 at most.

Where do the questions come from?

From NISG 2026, the Annex to Implementing Regulation (EU) 2024/2690, which Section 2 NISV 2026 extends to all essential and important entities, the GDPR and the BSI IT-Grundschutz Compendium, Edition 2023, above all its modules on industrial IT. The Compendium is a framework of the German Federal Office for Information Security (BSI) and not a legal obligation in Austria; it serves as a model for production and plants. Every question names its citation.

Does NIS2 apply to my company?

That depends on activity and size. In manufacturing, Annex 2 of NISG 2026 lists medical devices, electronic products, equipment of NACE division 27 (electrical equipment), machinery and vehicle manufacturing, plus chemicals and food as separate sectors; such entities are covered from medium enterprise size, that is from 50 employees or with an annual turnover and annual balance sheet total of more than EUR 10 million, with partner and linked enterprises generally counted as well (Sections 24 and 25). Other industries, such as the pharmaceutical industry, are listed in Annex 1. In exceptional cases, the cybersecurity authority also classifies smaller entities by decision (Section 26). The NIS2 applicability check examines this with citations.

Is the result proof or legal advice?

No. The check is a self-assessment based on your answers. It does not replace an audit or legal advice and does not prove that legal or professional requirements are met. The weights and levels are an assessment by TOMORIS; the measures are based on the sources named, and individual implementation examples are recommendations by TOMORIS.

Are my answers transmitted or stored?

No. The questionnaire and evaluation run entirely in your browser; your answers are neither transmitted to TOMORIS nor to third parties and are not stored, not even on your device. Only when you choose “Discuss the Result” does the contact form take over industry and maturity level as the topic, not your individual answers.

How do I save the report as a PDF?

In the report, choose “Print or Save as PDF” and select “Save as PDF” or “Microsoft Print to PDF” as the printer in the print dialog. Only the report is printed, in light colors even in dark mode.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result