Plant audit: NIS2 compliance and waste analysis from one site visit
Manufacturers within the scope of NIS2 have to walk the same plant twice: once for the cybersecurity risk assessment and once for process improvement. Most of the data behind the two assessments is the same. We capture it once and deliver two results from it.
Who it is for
Annex II of the NIS2 Directive lists six manufacturing sectors. If the company operates in one of them and is at least a medium-sized enterprise, it is likely to be in scope.
Medical devices · Computer, electronic and optical products · Electrical equipment · Machinery and equipment n.e.c. · Motor vehicles, trailers and semi-trailers · Other transport equipment
What the two assessments share
The information flow of a value stream map and the basis of the NIS2 risk assessment rest on the same questions: which machines and systems exist, who has access to what, and what happens when an element fails.
| Data captured | Lean use | NIS2 use |
|---|---|---|
| Machines and systems per step | VSM process boxes, cycle time, availability | OT asset inventory, system list |
| Data flow | VSM information flow | Data flow map, network segmentation |
| Stoppages and their causes | Waiting, TPM | Business impact analysis, recovery targets |
| Supplier access | Supplier relations, maintenance contracts | Supply chain security, remote access |
| Manual data entry | Overprocessing, duplicate entry | Integrity risk, logging |
| Key people, cover | Unused talent, training | HR security, access management |
When two separate teams run the two assessments, plant managers answer the same questions twice, and the two results do not refer to each other.
What you get
NIS2 sideDerivation of the security class, a first version of the OT asset inventory and data flow map, and a prioritised gap list across the twelve audit areas.
Lean sideA current-state map of one product family with takt time, lead time and PCE, the estimated annual cost of the eight wastes and a ranked improvement list.
Joint summaryThe compliance gap list and the waste list side by side, highlighting items that move both forward, such as tidying up remote access for maintenance contractors.
How it works
Online preparationCompleting the Lean diagnosis and a short scoping call on NIS2. This shows which product family and which systems are worth walking.
Site visitAlong the value stream of one product family, with the plant manager and the IT/OT lead. Production does not need to stop.
Results and reviewHandover of both results and the joint summary, reviewed with management.
Your data stays in the browser
The online preparation tools run entirely in the browser: nothing you type reaches a server. The email you use to request a proposal contains only the inputs you entered, and you send it yourself.
Hungarian and Slovak sites
The two countries transposed NIS2 in separate laws with different audit regimes. If the company has sites in both, the two compliance tracks can share one data capture. Deliverables are provided in English, Slovak and Hungarian.
Arrange a plant audit
The scope depends on the number of sites, product families and systems. Write to us, or start with the preparation tools.
info@just-b-ltd.comFrequently asked questions
- Can we book only the NIS2 or only the Lean part?
- Yes. The joint visit pays off when both topics are on the agenda. Separately, the offers on the Lean page apply.
- We do not know whether NIS2 applies to us.
- Scope depends on sector and company size. We review the classification with you in the first call.
- Does production need to stop?
- No. The visit is based on observing normal operation and short interviews with the people responsible.