Services · In preparation
Food cybersecurity
The food chain is critical infrastructure. NIS2 already treats it as such.
The NIS2 Directive lists the production, processing and distribution of food among the critical sectors. Companies in the sector above the size thresholds are subject to risk management obligations, incident notification duties and, in particular, supply-chain security requirements. And the risk is not hypothetical: the 2021 attack on JBS shut down 47 plants, and the one suffered by INIA-CSIC in 2024 left 650 people without work for three months.
We assess the conformity of food operators, and of the suppliers they depend on (in particular their traceability systems), with the cybersecurity risk management measures required by NIS2, using ENISA’s technical guidance and its mapping to ISO/IEC 27001 and the Spanish National Security Framework (ENS) as references.
The outcome of the assessment can be represented as an electronic attestation of attributes in the operator’s business wallet, so it can be presented to retailers which, as obliged entities, must verify the cybersecurity of their suppliers. The operator not only knows its systems comply: it can prove it.
Scope
What we assess
The cybersecurity risk management measures of Article 21 of NIS2, applied to the reality of a plant, a farm or a cooperative.
- Information system security policies and risk analysis;
- Incident handling and notification to the competent authorities;
- Business continuity, backups and crisis management;
- Supply-chain security and supplier relationships;
- Security in the acquisition, development and maintenance of systems, including industrial control systems and connected devices;
- Assessment of the effectiveness of measures, training and basic cyber hygiene;
- Cryptography, human resources security, access control, asset management, multi-factor authentication and secure communications.
What sets us apart
We know the sector and we know the standard.
Certicar has audited farms and agri-food industries for years, and CerteIDAS takes part in European standardisation of digital trust. In our analysis of more than eighty agri-food traceability software solutions active in Spain and Europe, none publicly documented a cybersecurity certification. We know, therefore, where to look.
Where we stand
When the scheme exists, we will be accredited to apply it.
The Spanish transposition of NIS2 and the certification schemes developed under it will set the exact scope of third-party assessments. In the meantime we assess against the Directive, ENISA’s technical guidance and the reference standards.