In brief
For a food company there are three regulations to keep an eye on. NIS2 requires security measures and incident notification from companies engaged in industrial production and processing and in wholesale distribution. Legislative Decree 134/2024 adds resilience obligations for those designated as critical entities. The Machinery Regulation, from 2027, brings cybersecurity requirements to new or modified lines.
Who falls within NIS2
Legislative Decree 138/2024 lists the production, processing and distribution of food among the sectors in Annex II. It concerns food businesses engaged in wholesale distribution or industrial production and processing, when they exceed the small enterprise thresholds: in practice, medium-sized enterprises and above. They are important entities, unless ACN classifies them as essential. A company designated as a critical entity under Legislative Decree 134/2024, on the other hand, is a NIS2 essential entity regardless of its size.
For those entering the NIS list in 2026, ACN Determination 127434/2026 sets notification of significant incidents from 1 January 2027 and baseline security measures by 31 July 2027. The CSIRT contact person must be designated by 31 December of the year of inclusion (ACN Determination 127437/2026). For those already on the list in 2025, the deadlines run from the communication of inclusion: 9 months for notification and 18 for the measures.
Critical entities: resilience beyond the digital
Legislative Decree 134/2024 transposes the CER directive and also covers the production, processing and distribution of food, with the Ministry of Agriculture, Food Sovereignty and Forests as the sector authority. Critical entities are identified by the sector authorities; the list is adopted by Prime Ministerial Decree (DPCM), with a deadline of 17 July 2026, and designation comes with a notification from the single point of contact.
Those designated must carry out a risk assessment within nine months of the notification, adopt technical and organisational measures (physical protection, business continuity, personnel, crisis management) and notify within 24 hours any incidents that significantly disrupt the essential service. The decree looks mainly at physical events: cyber incidents remain within the scope of NIS2. It is not just cybersecurity: it is the ability to keep supplying food whatever happens.
Machinery Regulation: new lines from 2027
Regulation (EU) 2023/1230 replaces the Machinery Directive and applies from January 2027. For the first time, the essential safety requirements include protection against tampering, including remote tampering, and the reliability of control systems against malicious actions.
It concerns manufacturers first of all, but it also matters to buyers: new lines will arrive with these requirements, and now is the time to ask for them in specifications. Anyone who substantially modifies a machine is considered its manufacturer. In March 2026 the Omnibus IV simplification proposal did not provide for an additional transition period for machinery; the sector has asked for the cybersecurity requirements to be postponed, and the outcome needs to be checked.
Food defense and cybersecurity
Food safety certification schemes already require the product to be protected against intentional attacks. The FSSC 22000 version 6 food defense guidance, for example, refers to every form of malicious attack and includes IT in the working group, but does not explicitly address cyber threats. It is worth closing the gap: an attack that alters recipes, process parameters or temperature records is in every respect a risk to product safety.
The picture in one table
| Regulation | Who it applies to | From when |
|---|---|---|
| NIS2 (Legislative Decree 138/2024) | Industrial production and processing and wholesale distribution of food, at least medium-sized enterprises | For new 2026 entities: notification from 1 January 2027, baseline measures by 31 July 2027 |
| Critical entities (Legislative Decree 134/2024) | Companies identified by the sector authority and included in the list | Risk assessment within 9 months and obligations within 10 months of the designation notification |
| Machinery Regulation 2023/1230 | Machinery manufacturers and those who substantially modify machines | From January 2027 |
| Cyber Resilience Act | Manufacturers of products with digital elements, such as sensors and connected devices | Reporting from 11 September 2026; the rest from December 2027 |
Not just theory: six cases, three of them Italian
- 2017, Mondelez. The NotPetya malware, which got in through a compromised Ukrainian accounting software package, paralysed the group’s logistics, with damage estimated at over $100 million.
- 2020, Campari. A ransomware attack claimed by Ragnar Locker forced the group to temporarily suspend its IT services; the attackers demanded $15 million and claimed to have stolen about 2 TB of data.
- 2021, JBS. The world’s largest meat producer paid the equivalent of $11 million after a ransomware attack that hit its slaughtering plants.
- 2021, San Carlo. The Conti gang claimed a ransomware attack against the snack maker, threatening to publish the stolen documents; according to the press, the company did not intend to pay.
- 2023, Dole. A ransomware attack led to the temporary closure of some North American plants and to shortages of packaged salads in supermarkets.
- 2024, Caseificio Alta Valsesia. The Meow group claimed the attack on the Piedmontese dairy cooperative, stating that it had stolen data.
Size offers no protection: the victims include multinationals and local cooperatives.
Where to start
- Check whether the company falls within NIS2 and whether it has received communications as a critical entity.
- List the systems that production, quality and deliveries depend on, lines included.
- Separate the plant network from the office network and control maintenance contractors’ remote access.
- Include cyber scenarios in the food defense plan and in the withdrawal procedures.
- Put cybersecurity requirements into the specifications for the next machines.
How we can help
We support food companies with NIS2 compliance, the security of production lines and the cold chain, and the link with food defense and crisis management.
Our service for the food industry →Sources
Legislative Decree 138/2024, Annex II; ACN Determinations No 127434 and No 127437 of 13 April 2026; Legislative Decree 134/2024 (CER directive); Regulation (EU) 2023/1230; Regulation (EU) 2024/2847 (Cyber Resilience Act); FSSC 22000 V6, Guidance Document Food Defense; ICT Security Magazine on the CER directive (January 2026); eComercio Agrario on Omnibus IV and the Machinery Regulation (March 2026); CMS on the 2026 ACN determinations; for the cases: BleepingComputer (Campari, 2020), Xtalks (JBS, Dole), Cybersecurity360 (San Carlo, 2021), ransomware.live (Caseificio Alta Valsesia, 2024), Leading Law, “Direttiva NIS 2 – Settore agroalimentare” (Mondelez, 2017); AESSE Soluzioni, “Cybersecurity nel Food & Beverage” (July 2026). Sources consulted on 3 November 2026. This article is for information only and does not replace reading the legal texts.