NIS2 increases pressure on the food supply chain

Cybersecurity is taking on a different role within the food supply chain. With the introduction of NIS2, responsibilities for companies are changing. NIS2 is a European directive on digital security that requires organizations to better protect their systems and processes. As a result, it affects not only ICT, but also security of supply and international trade.

Changing threat landscape

According to Richard van Buuren, program manager at the NVWA, the level of risk has increased. “Disruption of society can just as easily occur through the food supply chain as through energy or telecom. The disruptor looks for the weakest link.”

The impact of cyberattacks can be significant. Van Buuren points to an attack in 2025 at Jaguar Land Rover. Factories were shut down for months and losses reached nearly £2 billion. International production chains were also affected, with consequences across multiple countries.

Supervision through existing structures

In the Netherlands, supervision is assigned to sector-specific regulators. For the food supply chain, this means a role for the NVWA. This requires new specialist knowledge and cooperation with other regulators. Companies may fall under multiple supervisory authorities.

For companies themselves, the biggest challenge lies in supply chain responsibility. They must not only secure their own systems, but also gain insight into the security of their suppliers. This also applies to partners outside Europe.

Differences in supervision and approach

Within NIS2, a distinction is made between ‘important’ and ‘essential’ companies. Important companies mainly face reactive supervision. Essential companies are actively monitored and must comply with requirements within ten months.

Registration with the NCSC is a first step, but does not mean companies are immediately compliant. Insight into systems and risks is necessary. Existing standards can help, but offer no guarantee. “In principle, you can certify anything. But if your process is poor, you certify a poor process.”

According to Van Buuren, many risks are found in older systems. Installations from the past often prove vulnerable and can serve as entry points for cyberattacks.

Mvoketenorganisatie.nl

Source: MVO Magazine no. 2 2026