Display
NIS2, KRITIS umbrella law, new obligations: Why industrial security is now a top priority
For many industrial companies, security is finally no longer an issue that can be put off. With NIS2, significantly stricter requirements for risk management, reporting structures and responsibilities have applied in Germany since December 2025. At the same time, the KRITIS umbrella law sets new standards for the resilience and physical protection of critical infrastructures. Anyone affected must not only act, but also be able to prove that appropriate protective measures have been implemented. Violations can result in fines and further regulatory measures. At the same time, a worrying picture emerges in practice: Weeks after the registration deadline, a large proportion of the companies affected had still not made the required registration.
The problem is that many companies still think of firewalls, backups and network segments first when it comes to security. But holistic protection does not end at the server room. In industry in particular, risks arise at the interfaces between IT, OT and physical infrastructure: at factory gates, in sensitive production areas, in storage zones, technical rooms, laboratories or administrative areas with confidential data. If access is not properly regulated, authorizations cannot be flexibly controlled and events cannot be documented in a traceable manner, the security architecture will remain incomplete.
What's more: Industrial environments are rarely static. Locations grow, processes change, external companies are added, new critical areas emerge. This is precisely why traditional locking systems are increasingly reaching their limits. What is needed today are solutions that take a modern approach to physical security: with clear access concepts, time-limited authorizations, documented locking events and the ability to modernize existing infrastructures economically. After all, resilience not only means fending off attacks, but also making disruption, sabotage and unauthorized access more difficult from the outset.
Now is the right time for companies to critically examine their own security architecture: Where are there regulatory obligations? Which areas are particularly in need of protection? And is the existing door and locking technology still up to date with today's risks and requirements? If you ask these questions too late, you risk not only organizational effort, but possibly also security gaps with far-reaching consequences.
ASSA ABLOY's white paper "Security in industry" provides further orientation, concrete classification and practical approaches.










