Discussing cybersecurity can be daunting as it touches upon areas often unfamiliar to those outside the field. Given its novelty, complexity, and technical nature, the issues it presents don't always come with clear-cut answers, making it challenging for companies to make informed and secure decisions.
This risk is especially pertinent in the manufacturing environment, where strategic investments are made with at least a three-year outlook. It's crucial to have a clear understanding of any external factors that could impact both products and corporate infrastructure: cybersecurity is undoubtedly one of these critical external factors.
The Journey of Cybersecurity within the Industrial Sector
Until the so-called third industrial age, or Industry 3.0, cybersecurity had minimal impact on manufacturing. Industrial machinery wasn't necessarily connected to the internet or each other, making external risks unlikely. However, with the dawn of Industry 4.0, smart machinery and smart factories have become vital for the smooth operation of production departments, placing cybersecurity at the forefront of concern.
What is meant by Industrial Cybersecurity?
Cybersecurity involves protecting systems, networks, and programs from digital attacks. These attacks typically aim to access, alter, or destroy sensitive information, extort money from users, or disrupt normal business operations. In an increasingly digital world, cybersecurity is essential not only to safeguard corporate information but also to protect individuals' privacy, critical infrastructure security, and ensure business continuity.
Given the critical nature of the topic and the attention it demands, companies are embarking on paths to elevate their awareness of cyberattacks, adopting internal policies, or even pursuing specific certifications in cybersecurity. Concurrently, national and international legislators have introduced new legislative measures imposing new obligations on certain entities in relation to cybersecurity.
New Legislative Measures on Cybersecurity: What the Manufacturing Industry Needs to Know for Compliance and Security
Let's now consider the most recent legislative measures on cybersecurity and the related certifications that manufacturing industries must take into account, depending on the activities carried out by the various entities.
Certifications provide a guarantee of product and company security. The main certifications currently considered include:
- ISO/IEC 27001 (2022): This certification represents the international standard describing best practices for an enterprise-level information security management system (ISMS). It helps organizations understand how to protect information through the implementation of an ISMS. ISO 27001 covers various aspects, including security policy, human resource security, physical and environmental security, communications management, and regulatory compliance.
- IEC 62443: This series of international standards is renowned for enhancing the security of industrial control systems, setting forth fundamental prerequisites to shield industrial systems from cyber threats. Of particular significance to component manufacturers are two key sections:
a. IEC 62443-4-2: Outlines the essential security prerequisites for components within industrial systems.
b. IEC 62443-4-1: Outlines the processes involved in manufacturing components.
Other standards in the IEC 62443 series mainly address other industrial sector actors and only occasionally component manufacturers.
There are then several laws and regulations that address under various profiles the issue of cybersecurity among them it is worth noting:
1. Italian Cybersecurity Law (June 28th, 2024 No. 90): [https://www.gazzettaufficiale.it/atto/stampa/serie_generale/originario]
This Italian law pertains to national cybersecurity and applies to both public and private entities whose services are deemed critical, such as territorial entities, transportation services, or in-house companies providing digital services. It mandates the implementation of security measures to protect critical digital infrastructures and sensitive information, including specific obligations to notify the Cybersecurity Agency of any cyber incidents.
2. Cyber Resilient Act (CRA):
While still pending final approval by the European Institutions, this initiative will mandate manufacturers and entities introducing digital products into the market after a specified date (likely in 2027) to uphold stringent cybersecurity standards. This requirement aims to ensure that all products entering the market are devoid of known cyber vulnerabilities, fortifying them against potential cyber threats. The Cyber Resilient Act seeks to enhance the resilience of the European digital market by ensuring that connected devices and digital services are equipped to withstand cyberattacks effectively.
3. NIS Directive 2:
This directive outlines essential criteria that companies must adhere to in order to maintain a robust level of cybersecurity. These criteria encompass the implementation of risk analysis strategies, fortification of information system security, and effective incident management protocols. It is imperative for EU Member States to transpose this directive by October 2024, with enforcement timelines specified in the respective national transposition acts.
4. New Machinery Regulation No. 1230/2023:
This regulation will replace the Machinery Directive No. 2006/42/EC, focusing on the overall safety of machinery and semi-machinery and it will become effective in 2027. It emphasizes the essential integration of cybersecurity into the design and manufacturing processes of machinery, recognizing the potential risks that cyber vulnerabilities pose to physical safety.
Implications for the Manufacturing Sector
Manufacturing companies must carefully consider the regulations mentioned above, along with those that are specific to their industry, as these rules will have a significant impact on the cybersecurity measures of their digital products. Staying up-to-date with regulatory changes and customizing cybersecurity investment strategies is crucial to protect critical infrastructure and maintain the trust of clients and business partners. Taking swift and strategic actions is key to remaining competitive and secure, while avoiding the pitfalls of misinformation that may circulate within the industry.
Conclusion
In the era of Industry 4.0, cybersecurity emerges as an urgent necessity. Manufacturing companies are compelled to adopt a proactive stance, instituting policies, best practices, and behavioral standards that elevate their systems' security in compliance with laws and regulations. This approach alone can safeguard critical infrastructures, ensure operational continuity, and preserve the trust of clients and partners.
Implementing robust security measures and staying updated on current regulations are key to successfully navigating today's digital landscape. Entrepreneurs must seek informed advice and accurate information, avoiding unnecessary alarmism. Despite the complexity and opacity of the topic, there are firm and tangible bases for crafting a long-term winning strategy.
Preparing today for tomorrow's challenges is essential for ensuring the long-term survival and competitiveness of a business. Overlooking the importance of a holistic and integrated view of the laws and certifications at play would be a critical mistake. With the right preparation and a clear understanding of regulations, companies can build an effective defense against cybersecurity threats, securing a safe and prosperous future.
