Cybersecurity for the food industry
Automated lines, cold rooms, traceability, labelling and logistics are now digital systems. If they stop, deliveries stop; if they are tampered with, product safety is at stake. We help companies that produce, process and distribute food wholesale comply with NIS2 and the related regulations without stopping their plants.
From field to shelf, everything goes through a system
An attack on a food company is not just an IT problem. Temperature and traceability data are needed to demonstrate product safety, and recipes and line parameters determine what leaves the plant. A shutdown of a few days can mean lost perishable goods and large retail customers left without deliveries.
That is why the production, processing and distribution of food are among the sectors covered by NIS2 and by the directive on the resilience of critical entities.
- IT and factory systems: ERP and MES, orders from large retailers, EDI, email, supplier portals
- Lines and plants: production and packaging PLCs and SCADA, dosing, pasteurisation and sterilisation
- Cold chain and quality: cold rooms, temperature recording, batch traceability, labelling
- Logistics: automated warehouses, fleet management, carriers’ systems
What we do
We start from what is already there. A certified food company has HACCP plans, food defense procedures, traceability and crisis management: cybersecurity hooks into these tools instead of creating parallel ones.
On production lines we work with the people who run them every day, because a security measure that stops a plant does not get applied.
- NIS2 applicability check, registration, baseline measures and notifications
- Security of production lines and the cold chain (IEC 62443): segmentation, maintenance contractors’ remote access, configuration backups
- Linking cybersecurity, food defense and recall management
- Cyber requirements in specifications for new machines and for line modifications, in view of the Machinery Regulation
- Support with the obligations of Legislative Decree 134/2024 for those designated as critical entities
- Qualification of ICT suppliers, maintenance contractors and logistics providers, with rules for remote assistance
- Protection of the personal data of employees, customers and consumers, including through the Data Protection Officer (DPO) role
- War Room exercise on a realistic scenario: cold rooms out of control during a ransomware attack
One incident, several assessments
Beyond the notifications, an incident at a food company raises one more question: are the products shipped in the meantime safe? If the temperature or traceability data are not reliable, the quality team must know at once what happened and since when.
That is why, alongside the CISO and the CSIRT contact person, we include the quality manager and whoever handles withdrawals in the incident management flow.
- NIS2 (CSIRT Italia): early warning within 24 hours, notification within 72 hours, final report within one month
- Critical entities (Legislative Decree 134/2024): if the incident significantly disrupts the essential service, notification to the sector authority and the single point of contact within 24 hours and, where appropriate, a detailed report within 30 days
- Italian Data Protection Authority (Garante): within 72 hours, if the personal data breach poses a risk to data subjects
- Product quality and safety: assessment of the batches produced during the incident
How we work
The work is carried out by the 823 Consulting staff, coordinated by Giacomo Pesce, CISO at a NIS2 essential entity included in the National Cyber Security Perimeter and ISO/IEC 27001 Lead Auditor, with the same logic as the management systems food companies already know: risk, controls, evidence and continual improvement.
- Survey: plants, lines, systems, suppliers and NIS2 classification
- Risk analysis: what happens if each system stops or is tampered with
- Plan: baseline measures, priorities for the plants, owners and deadlines
- Exercise: a scenario with production, quality and management
- Review: after incidents, certification audits and customer audits
Before a line stops
Tell us how your plants are set up and what customers and certification bodies ask of you. We will tell you which regulations apply to you and where to start.