What is NIS2 and which companies does it affect?

NIS2 is the EU cybersecurity directive for entities in essential or important sectors. Applicability depends on sector, size and the exceptions in the directive and national transposition; legal scope should be confirmed before defining the technical plan.

What should I do if my company is hit by ransomware?

Isolate affected systems without destroying evidence, activate the response plan and contact specialists. If a personal-data breach is likely to risk people’s rights and freedoms, the controller must notify the authority without undue delay and, where feasible, within 72 hours of becoming aware. Response, recovery and reporting depend on the accepted scope.

What is the difference between IT and OT and why segment them?

IT covers corporate systems and OT industrial operations. Separating them with zones, rules and access controls reduces incident propagation and improves oversight; the design depends on plant assets and requirements.

What is reviewed before scoping an IT project for manufacturing and industry?

We review sites, users, inventory, applications, dependencies, vendors, access, incidents and change windows. For manufacturing and industry, we also document OT/IT dependencies, plant continuity and controlled change. Scope and objectives are confirmed from that evidence.

Industrial OT/IT cybersecurity and NIS2

Production plants, assembly lines, process factories, logistics centers: the industrial sector in Spain and Portugal operates under a particular pressure — the IT systems sustaining production cannot stop. A network outage in an office costs hours of productivity; in a plant it costs entire shifts, and if it affects industrial control systems (PLCs, SCADAs) it costs operational safety.

We approach manufacturing and industry projects from the actual environment, its dependencies and the priorities agreed with the client. Scope is confirmed after reviewing locations, systems, access, risks and owners.

Typical challenges in manufacturing

Industrial groups that hire us usually arrive with several of these problems at once:

OT and IT on the same network: PLCs hanging off the same switch as office printers, no segmentation. Office ransomware can jump to the line.
SCADAs on obsolete Windows: Windows XP, 7 or Server 2008 impossible to update due to factory-equipment compatibility. No security patches for years.
Nonexistent or untested backup: the "backup" is a shared folder on a NAS without offsite replica. When ransomware hits, the backup is encrypted too.
NIS2 scope to be validated: applicability, category, obligations and dates are checked against current official rules based on activity, size, country and supply-chain role; the legal or compliance team owns the legal determination.
Defined coverage and escalation: service hours, priorities, response targets and third-party escalation are agreed per engagement; permanent availability or a fixed nationwide response is not assumed.

How we tackle it at Impulso

How to prepare an IT decision in manufacturing and industry

A useful assessment starts with an operational map: sites, users, applications, equipment, vendors, change windows and owners. In manufacturing and industry, the priority is to understand OT/IT dependencies, plant continuity and controlled change; a product list without that context cannot support a comparable option or a realistic scope.

Inventory and dependencies before scope is defined.

The plant map connects cells, PLCs, SCADA, engineering stations, servers, the corporate network and vendor access. Each flow records an owner, protocol and operational consequence so a generic rule does not interrupt production or maintenance.

Technical validation with documented acceptance criteria.

A pilot runs in a representative zone with production stakeholders informed. Normal communications are captured, controls are tested, operational effects are observed and rollback remains available before configuration expands to further lines.

Coordination and evidence handed over to the accountable team.

Useful evidence includes the OT/IT diagram, approved rules, verified backups, restoration results and the change record. Recovery objectives are set after dependencies and capacity have been measured, not before.

Documentation remains useful through a visible date, version and owner. Assumptions that have not yet been verified stay marked as assumptions and do not become commercial commitments.

Handover records results, exceptions, relevant configuration, tests and subsequent controls. This lets the internal team distinguish a completed improvement from an outstanding dependency and measure the service against data agreed for its environment.

Our proposition for industrial environments is structured in three blocks that can be hired separately or as a package:

OT/IT segmentation with Fortinet: FortiGate deployment in the plant to create zones following the Purdue model. Explicit rules per industrial protocol (Modbus, Profinet, OPC-UA), FortiAnalyzer monitoring, deny-by-default. Adaptable to single plant or multi-site.
Case-by-case on-site coverage: our own team is based in Madrid and, elsewhere in Spain and Portugal, the suitable local resource or nearest available partner is assigned after location, resource, timing, scope and access are confirmed for each request.
Secure modernization of legacy systems: when a Windows XP SCADA can't be replaced short-term, we isolate it in an industrial DMZ with strict whitelisting, specific antivirus (Sophos OT) and passive traffic monitoring.

NIS2 and industrial compliance in Spain and Portugal

Why Impulso for industry

Technology matched to the environment: vendors, licences, integrations and capabilities are validated during design; any certification or contractual requirement is confirmed before it enters a proposal.
Zero production stoppages during intervention: every plan is coordinated with production.

Manufacturing & Industry