⚗️NIS2 for Chemical Industry — deadlines, obligations, fines

Networks controlling reactors, valves and dosing systems must be isolated from the corporate IT side through an industrial DMZ. IEC 62443-3-3 requires a minimum Security Level SL2 for Seveso lines and SL3 for high-hazard installations. Patch management cycle: <30 days on HMI/SCADA, <90 days on PLCs where downtime is technically justified. Annual audit by a notified body.

For each critical production line: maximum RTO (Recovery Time Objective) of 4-12 hours, maximum RPO (Recovery Point Objective) of 1 hour for process data. Scenarios must cover cyber, fire, flood and supply-chain disruption. Annual testing is mandatory, with a report to the DPO and to DNSC if results reveal critical deficiencies.

Suppliers of PLCs, DCSs, connected sensors and MES software must be audited against a cybersecurity baseline. An SBOM (Software Bill of Materials) becomes mandatory for new equipment from 2027 (CRA). Contracts must include clauses for supplier incident notification within 24 hours. Asset inventory must be complete, with firmware version tracking.

Industrial espionage is one of the principal threats in the chemicals sector — in 2019, Bayer and BASF publicly confirmed they had been compromised by the Winnti APT, with persistent access for months before detection. Sensitive data (compositions, optimisation parameters, key customer lists) must be encrypted at rest and in transit, with DLP on email and cloud storage, and exceptional-access monitoring (alerts on deviations >3 sigma from baseline). Access must be compartmentalised by operational need, NOT by generic role.

Preliminary notification within 24 hours (Art. 23(4)(a)) — even before root cause is known. Detailed update within 72 hours, including impact assessment and actions taken. Final report within one month. For critical chemicals, parallel notification to the joint Romanian Seveso authorities — ANPM (National Environmental Protection Agency) + IGSU (General Inspectorate for Emergency Situations) + GNM (National Environmental Guard) per Law 59/2016 Art. 7 — where Seveso substances are affected.

Type: LockerGoga ransomware

Impact: EUR 70-90 million in losses, 4-7 days of partial downtime, manual switch-over on critical lines

Lesson: Weak IT/OT network segmentation allowed the ransomware to propagate from corporate IT into OT. Manual fallback procedures preserved operational safety.

Type: Industrial espionage — Winnti APT

Impact: Persistent access in corporate networks for months, discovered accidentally through a third-party honeypot; both companies publicly confirmed in February 2019.

Lesson: Slow detection without EDR + UEBA + DLP on the baseline. Compartmentalisation by operational need plus exceptional-access monitoring would have reduced time-to-detection from months to days.

Type: DarkSide ransomware

Impact: Five-day shutdown of the largest pipeline on the US East Coast; ransom of approximately USD 4.4 million paid (partially recovered later by the FBI).

Lesson: A VPN with compromised credentials and no MFA was the initial vector. Hybrid MFA plus post-quantum for remote OT access covers this class of risk.

Seveso III (Directiva 2012/18/UE) · Law 59/2016 (Romania)

Dangerous substances classes I-II; overlap with BCP and incident reporting to ISU (the Romanian Emergency Situations Inspectorate) and the Ministry of Environment. NIS2 adds the cybersecurity layer on top of Seveso safety requirements.

REACH (Regulamentul 1907/2006) · Directly applicable + Law 349/2007 implementation (Romania)

Registration of chemical substances and submission of toxicological data to ECHA. REACH data is sensitive IP (formulas, manufacturing process) — NIS2 coverage is mandatory.

CRA — Cyber Resilience Act (Regulamentul (UE) 2024/2847) · Directly applicable from 11 December 2027

Mandatory SBOM and security-update support for products with digital elements — directly affects OT equipment marketed to chemical manufacturers.

EU AI Act (Regulamentul (UE) 2024/1689) · Directly applicable in tranches 2025-2027

Where chemical companies use AI for process control or safety anomaly detection, the systems fall under the high-risk regime (Annex III). Audit trail and transparency are mandatory.