CSAFI Cyber Resilience
An independent, food-specific assessment of how a food business manages cyber risk — from the boardroom to the plant floor — against requirements aligned with the EU NIS2 Directive.
Assessed against
- NIS2 — Articles 20, 21 and 23
- ENISA implementation guidance
- ISO/IEC 27001 · NIST CSF 2.0
- IEC 62443 for the plant floor
- requirements in 15 domains
- 72
- requirements in 15 domains
- fundamental requirements that can never be waived
- 12
- fundamental requirements that can never be waived
- certificate, with yearly surveillance
- 3 years
- certificate, with yearly surveillance
- early-warning reporting clock that must be tested
- 24h
- early-warning reporting clock that must be tested
Food businesses NIS2 reaches — and their suppliers
- EU food manufacturers, processors and wholesalers above the NIS2 size test — usually 50 or more staff, or more than €10m turnover and balance sheet. National laws decide the details.
- Their suppliers, who feel NIS2 through the security clauses in their customers’ contracts.
- Any food business outside the EU that wants an independent, food-specific baseline. CSAFI membership is not required.
- One certificate covers one site. Shared group services (identity, monitoring, backup, cloud) count through inheritance, assessed once for the whole group.
The plant floor is the heart of it
Operational technology is always assessed. Corporate systems that cannot affect production are left out.
| What | How it is treated |
|---|---|
| Operational technology — PLCs, HMIs, SCADA, historians, engineering workstations, industrial networks, packaging and processing machines, building and utility controls that affect production | Always in scope — the core of the assessment |
| Plant IT that supports production — MES, batch and recipe systems, LIMS, warehouse and traceability systems, plant servers and remote-access paths | Always in scope |
| Shared or group services the site relies on — identity and email, central monitoring, backup, cloud platforms, a group security team | In scope by inheritance |
| Third parties with access — machine OEMs, system integrators, managed service providers | In scope through the supply-chain domain |
| Corporate functions with no effect on the plant — group finance, HR, marketing | Out of scope |
Four things no certificate is issued without
These are the NIS2 additions on top of ISO/IEC 27001 that matter most — and the evidence a supervisor is most likely to ask for.
Board approval and training
The board has approved the cyber measures, oversees them and has been trained — with records (NIS2 Article 20).
A tested reporting clock
An incident-reporting process that has been tested against the 24-hour early warning, 72-hour notification and one-month final report (Article 23).
Supplier security clauses
Security requirements written into the contracts of suppliers and service providers (Article 21).
Multi-factor authentication
MFA where it matters, including remote access to the plant (Article 21).
The CSAFI Food Plant Cyber Baseline
From governance and knowing what you have, through protection, to detection, response and recovery. Every requirement traces to NIS2, PAS 96 or Australia’s SOCI Act. A fundamental requirement that fails is a critical finding, and can never be declared not applicable.
- GOV
Governance and accountability
5 requirements
- AST
Asset and system inventory
5 requirements · 1 fundamental
- RSK
Threat, vulnerability and risk assessment
6 requirements · 1 fundamental
- IAM
Identity and access control
6 requirements · 2 fundamental
- NET
Network architecture, segmentation and remote access
6 requirements · 2 fundamental
- CFG
Secure configuration and component protection
7 requirements · 2 fundamental
- DAT
Data protection and cryptography
4 requirements
- DET
Logging, monitoring and detection
4 requirements · 1 fundamental
- IR
Incident response and reporting
4 requirements · 1 fundamental
- BCP
Continuity, backup and recovery
4 requirements · 1 fundamental
- SUP
Supply chain and third parties
4 requirements
- PPL
People, awareness and insider risk
5 requirements · 1 fundamental
- PHY
Physical security of control systems
4 requirements
- ENG
Secure engineering, acquisition and change
4 requirements
- ASR
Assurance, review and improvement
4 requirements
Three tiers, from a desk review to the plant floor
Start at the tier that fits. Existing ISO/IEC 27001, IEC 62443 or similar results can be reused to cut duplicate work.
Foundation
A verified self-assessment, desk-reviewed by an approved partner firm. Renewed every year.
Verified
A remote audit by an approved partner firm, typically one to two days. Three years, with yearly surveillance.
Advanced OT
An on-site assessment with technical testing, three days or more. Passive-first: no active scanning of live controllers, written approval for anything that touches machine networks, and the plant may stop the work at any time.
Sized to the site, never sold short
Minimum assessment time is published and set by the site’s complexity — people on site, production lines, how connected the OT is, and reliance on shared services — so a partner firm can never win work by cutting depth.
| Assessor-days, at least | Small site | Medium site | Large site |
|---|---|---|---|
| Phase 1 — documentation review (remote) | 1 | 1.5 | 2 |
| Phase 2 — on-site assessment | 2 | 3 | 5 |
| Each yearly surveillance | 1 | 1 | 2 |
Medium and Large sites, and any site with vendor remote access, always have an OT technical assessor on the team.
From application to certificate
Steps 1 to 10 are the first certification; steps 11 and 12 keep it alive through its three-year life.
Self-assessment (optional)
Site
Complete the questionnaire at any time before applying.
Application
Site
Describe the site, its OT estate and connectivity, shared services and existing certifications.
Review and conflict screen
CSAFI
Scope, minimum duration and an approved partner firm confirmed within 10 working days.
Agreement and planning
Site, CSAFI, partner firm
The certification agreement is signed and the assessment plan issued.
Phase 1 — readiness review
Partner firm
A remote review of documents and readiness.
Phase 2 — on-site assessment
Partner firm
Interviews, a plant-floor walkthrough and technical checks; every finding graded.
Corrective action
Site
A plan within 28 days; major findings closed within 90.
Final report
Partner firm
The report and evidence pack go to CSAFI.
Quality review
CSAFI reviewer
Somebody with no part in the audit checks the whole file.
Certification decision
Independent panel
Five members decide; the reviewer does not vote.
Issuance
CSAFI
The certificate and its entry in the public register.
Surveillance
Partner firm
A yearly check in years one and two.
Recertification
Everyone, as steps 4 to 10
A new certificate before the three years run out.
Where the CSAFI mark may — and may not — appear
- On the site’s documents, website, tenders and correspondence, with the certificate number and scope beside it.
- Never on food, packaging, labels or anything a consumer could read as a statement about the food.
- Listed in the public register with its status. A suspended, withdrawn or expired certificate stays visible for twelve months, so a buyer who saw the old entry is not misled.
What this certificate can — and cannot — say
It can say
- An independent, criteria-based assessment of cyber risk-management measures against NIS2 Articles 20, 21 and 23.
- Criteria informed by ENISA guidance and mapped to ISO/IEC 27001, NIST CSF 2.0 and IEC 62443.
- Suitable as supporting evidence when a supervisor asks for audit results.
- A supply-chain assurance signal for customers that NIS2 reaches.
It never says
- “NIS2 certified”, a “NIS2 compliant certificate” or “officially recognised”.
- That it guarantees regulator approval or protects against fines.
- That it is an EU cybersecurity certification under the Cybersecurity Act.
- That it covers national-law details that were not assessed.
Join the Cyber Resilience pilot
Register interest and the CSAFI team will talk you through readiness, the tiers and how the first sites will be assessed.
CSAFI certifications are independent industry assessments. They are not regulatory approvals, do not replace a company’s legal obligations, and are not EU conformity assessments or CE marking. CSAFI is not a notified body, and CSAFI certificates are not accredited. PAS 96 is published by BSI; CSAFI is not affiliated with BSI.