%20rotate(-45)'/%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
The NIS2 Act
Applies to companies covered by the law. Their security measures must cover the supply chain and the relationship with direct suppliers – so as a supplier you may face security requirements.
CYBERSECURITY · FOR MACHINE BUILDERS
Cybersecurity becomes part of CE marking.
For machines placed on the market from 20 January 2027, the Machinery Regulation requires protection against tampering where it could lead to hazardous situations. Here is the overview – and how to secure a Unitronics-controlled machine in practice.
THE REQUIREMENTS1 July 2025 11 Sep 2026 20 Jan 2027
Three sets of rules machine builders need to know
Cyber Resilience Act
Applies to manufacturers of products with digital elements – this can include networked machines; whether your machine is covered depends on the product. From this date, actively exploited vulnerabilities and severe incidents must be reported. Most other requirements apply from 11 December 2027.
The Machinery Regulation
Replaces the Machinery Directive for machines placed on the market from this date. Annex III 1.1.9: hardware and software critical to safety must be protected against intentional and unintentional corruption, and interventions must be traceable. 1.2.1: control systems must withstand reasonably foreseeable malicious attempts from third parties. The requirements are risk-based.
IN PRACTICE
Security in three layers
The controller
- Change default passwords – attacks on PLCs with default passwords have been seen in practice
- UniStream: users and rights on HMI screens, web server, VNC and FTP
- Vision/Samba: access levels on the PCOM protocol and multi-factor login
- Update software and firmware – Unitronics recommends UniStream 1.35.227 or later and VisiLogic 9.9 with security improvements
The network
- No PLC directly on the internet – no port forwarding
- The PLC should be a client that connects out itself
- Separate the machine network from the office network (OT/IT)
- Industrial router with firewall and VPN, e.g. Unitronics UCR
Remote access
- UniCloud: ISO 27001 and ISO 27017 certified
- Encrypted transport and storage, certificate login for PLCs
- Roles, 2-factor login and a log of all remote access
- Access can be switched on and off centrally per machine
IN PRACTICE
Secure remote access in real installations
Pumps & irrigation · OEM
Pump controllers as a serviceable fleet
- Remote access via UniCloud: the technician sees the customer’s HMI screen (VNC) without a fixed IP address
- Program updates and tag changes go through an encrypted VPN tunnel
- Unitronics UCR routers add an extra layer of security to the whole communication chain
UniStream C with UniCloud, VFD and 4G routerSee case and products used
Agriculture · slurry
Monitoring slurry handling
- All communication from PLC to cloud goes through Unitronics UCR routers
- Troubleshooting and updating PLC programs via UniCloud’s secure VPN
- Access is managed in UniCloud with users, roles and 2-factor login
Unitronics PLC, UniCloud and 4G routersSee case and products used
FROM THE MANUFACTURER
What you can refer to
As a machine builder you must keep an eye on vulnerabilities in the components you build in. Unitronics provides what you need.
- Public vulnerability policy and security advisories from Unitronics
- Release notes for every version, which may contain security information
- Free download of UniLogic, VisiLogic and U90 Ladder
BEFORE DELIVERY
Checklist per machine
Go through the points at commissioning and put the completed list in the machine’s technical file. It also provides answers when the customer’s IT department asks.
Secure remote service with UniCloud- Default passwords changed and stored securely
- Unused services disabled (FTP, web server, VNC)
- Users and rights set up on HMI and web server
- Firmware and software on the latest version – versions noted
- No port forwarding; remote access only via VPN or UniCloud
- Backup of program and parameters stored separately from the machine
- Setup described in the technical documentation
NEXT STEP
Shall we look at your setup?
We help you choose controller, router and remote access that meet the requirements.
This page is an overview – not legal advice. Whether and how the requirements apply depends on the machine, the application and your role. Always check the applicable rules and guidance.