IEC 62443 SL-3 & EU NIS2: Streaming Shop-Floor Telemetry Without Exposing PLCs

The New Regulatory Reality: Management Accountability under NIS2

For years, industrial cybersecurity was treated as an operational afterthought. When IT asked to patch supervisory servers, plant managers pushed back: “Don’t touch the line if it’s running.”

The Network and Information Security Directive 2 (NIS2) has been in force since January 2023; 17 October 2024 was the deadline for EU member states to transpose it into national law. Not every state met it: in July 2026 the Commission referred four of them to the Court of Justice, so the national law that binds a given plant still varies. NIS2 covers manufacturing of computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment and medical devices, as well as chemicals and food, mostly as important entities; large pharmaceutical manufacturers can be essential entities under the health sector.

NIS2 is more than a corporate fine. It makes management accountable:

• Management bodies must approve and oversee the cybersecurity risk-management measures, follow training, and can be held liable for infringements (Art. 20).
• Maximum fines of at least €10M or 2% of worldwide turnover for essential entities and at least €7M or 1.4% for important entities, where most manufacturers sit (Art. 34).
• For essential entities, authorities can temporarily prohibit a manager from exercising managerial functions when earlier enforcement measures have not worked (Art. 32(5)).
• For a significant incident: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month (Art. 23).

This creates an acute operational dilemma:

• The Operational Demand: Operations leadership needs machine states, energy and condition data, joined in context with production records, for analytics and AI: the basis for target gains such as +3 to +7 OEE points at the constraint.
• The Cyber-Physical Threat: Blindly punching firewall holes to connect the shop floor directly to the cloud allows corporate ransomware and IT intrusions to reach safety-critical PLCs.

The challenge facing every VP of Manufacturing and Industrial CIO is clear: How do you feed shop-floor data to analytics and AI without opening new paths into safety-critical PLCs?

Why Traditional IT Security Fails on the Factory Floor

Standard corporate IT security relies on perimeter firewalls, active vulnerability scanners, and endpoint detection and response (EDR) agents.

When applied blindly to the Operational Technology (OT) domain, these practices can stop production:

1. Active Port Scanning Can Crash PLCs: Running tools like Nessus or Nmap across a legacy Profinet or Modbus subnet can send unexpected TCP packets to an older controller. A legacy TCP/IP stack may freeze and stop the line.
2. Dual-Homed PCs Bypass Segmentation: To get data out, plants often install a standard PC with two Ethernet cards—one in the machine network, one on the corporate LAN. If malware compromises the corporate network, attackers can use the dual-homed PC as a pivot into the control network.
3. Inbound VPNs Create Standing Backdoors: Third-party machine builders ask for remote VPN access for maintenance. If the OEM’s credentials are breached, the factory floor becomes reachable to adversaries.

The Defensive Foundation: IEC 62443 Zones and Conduits

IEC 62443 is the international series on security for industrial automation and control systems. Rather than treating the plant as a single flat network, its risk assessment for system design (Part 3-2) partitions the system into Zones (groupings of cyber assets sharing common security requirements) connected through Conduits (controlled communication paths), and sets a target security level (SL-T) for each.

As illustrated in the interactive architecture blueprint above, many deployments add an Industrial DMZ between the control network and corporate IT, often labelled “Level 3.5” in Purdue-based reference architectures (the term comes from those architectures, not from IEC 62443). Communication across it is limited to authenticated flows that the plant side initiates, with no direct routing between enterprise networks and plant PLCs.

Security Levels (SL) Defined by IEC 62443

• SL 1: Protection against casual or coincidental violation.
• SL 2: Protection against intentional violation using simple means with low resources.
• SL 3: Protection against intentional violation using sophisticated means with moderate resources (often chosen for critical production zones).
• SL 4: Protection against intentional violation using sophisticated means with extended resources.

Zero Inbound Ports: The Outbound-Only Telemetry Pattern

To help critical zones meet an SL-3 target while still feeding analytics, AVANTIA applies the Outbound-Only Architectural Pattern:

1. Zero Open Inbound Ports on OT Firewalls: The firewall separating the Industrial DMZ from the control network allows no inbound connections. No external system—not the cloud, not corporate IT, not the analytics server—can initiate a TCP connection into the plant.
2. Reverse Connection Initiation: Edge gateways inside the control zone initiate outbound TLS sessions (MQTT over TLS, port 8883) toward the Unified Namespace broker in the DMZ.
3. Hardware Data Diodes for Critical Assets — an alternative conduit, not an extra step: On high-consequence lines (pharmaceutical API synthesis, active chemical reactors), an optical data diode can replace the TLS session on that conduit. A data diode has a transmitter on the OT side and a receiver on the IT side with no return fibre, which removes the network path back into the plant. Because MQTT and TLS need a two-way session, a proxy on each side ends the connection and the IT-side proxy re-publishes the data to the broker; Sparkplug session state is re-established on the IT side. A diode does not address removable media, insiders or the supply chain.

Outbound-only is not impervious: the broker becomes the attack surface to harden, and any commands or configuration changes still need their own controlled path. NIST SP 800-82r3 recommends treating outbound rules as strictly as inbound ones.

Auditing and Compliance Verification

Meeting European obligations requires evidence during audits and supervisory reviews. AVANTIA prepares the evidence checklist with you:

Action Plan for Operations Leadership

Securing industrial operations without stalling AI modernization requires three decisive executive steps:

1. Isolate First: Eliminate all direct IT-to-PLC subnet routing. Move all supervisory connectivity into a formal Industrial DMZ.
2. Adopt Outbound-Only Streaming: Feed analytics through edge gateways that publish outbound to the DMZ broker (MQTT, Sparkplug 3.0), instead of opening new inbound connections.
3. Institute Real-Time Blast Radius Control: Ensure that in the event of an IT corporate ransomware event, physical plant production lines can continue operating autonomously in “island mode.”

[!CAUTION] Regulatory Warning: Under NIS2, management bodies must approve and oversee cybersecurity risk-management measures and follow training (Art. 20). Not knowing the shop-floor vulnerabilities is no defence; national law sets how often the risk assessment must be reviewed.

Industrial Standards & Acronym Reference

For complete executive definitions of industrial cybersecurity and regulatory standards referenced in this briefing—including IEC 62443, NIS2, IDMZ (Industrial Demilitarized Zone), SIL (Safety Integrity Level), mTLS, and the EU Cyber Resilience Act (CRA)—consult our centralized Master Industrial AI & Standards Glossary.

Authored by AVANTIA’s Managing Partners. To schedule an on-site IEC 62443 and NIS2 gap analysis for your production facilities, contact contact@avantia.solutions.