NIS2 and ENS in the cosmetics industry: do they apply to your company?

The cosmetics manufacturing industry relies on connected systems that can be affected by a cyberattack, putting production, product formulas, and commercial data at risk.

The NIS2 Directive and the National Security Framework (ENS) may establish cybersecurity requirements for certain companies depending on their activities and their relationship with public authorities. Not all cosmetics brands are required to comply, so it is important to identify which requirements actually apply to each organization.

Which cosmetics companies are affected by NIS2?

The NIS2 Directive includes certain chemical manufacturing activities among the sectors subject to cybersecurity requirements. However, not all cosmetics companies automatically fall within its scope. Their specific activities, size, and the applicable legal criteria must be assessed.

Even if a company is not directly subject to the directive, its customers may require it to implement security measures as part of their supply chain requirements.

When is ENS required for a cosmetics company?

The National Security Framework (ENS), regulated by Royal Decree 311/2022, may apply to private companies that provide services or supply solutions to public entities, depending on the contract and the systems involved.

ENS requirements in public sector contracts

If your company works with public sector organizations, review the tender documents and contract terms to determine which security requirements apply. Selling cosmetics to a public hospital does not, by itself, mean that every system used by the company must be certified.

Main cybersecurity risks in the cosmetics industry

Risks depend on the processes, systems, and data each company manages. These are three key areas worth reviewing.

Theft of product formulas and commercial data

Product formulations, testing data, and launch plans have commercial value. Unauthorized access can expose confidential information and undermine a brand's competitive advantage.

Cyberattacks on manufacturing and packaging systems

Systems that control production, storage, and packaging can be affected by ransomware or unauthorized access. If these systems are disrupted, companies may face order delays, supply chain issues, and operational losses.

Attacks targeting e-commerce and customer data

Online stores manage accounts, orders, and personal information. An insecure configuration, compromised credentials, or a vulnerability in the platform can enable unauthorized access and affect sales and customer trust.

What cybersecurity measures should a cosmetics company implement?

Specific measures should be based on a risk assessment and the obligations applicable to each organization. The following controls are worth evaluating.

1. Identify risks and assign responsibilities

The company should identify its critical systems, the data it needs to protect, and the potential consequences of an interruption. It should also define who makes cybersecurity decisions and how the response to an incident will be coordinated.

2. Monitor systems and detect incidents

Security monitoring helps identify unauthorized access, suspicious activity, and potential security issues. Depending on the company's needs, monitoring may cover corporate devices, servers, cloud services, and industrial systems.

3. Review supplier security and access controls

Limit permissions to what is necessary, use multifactor authentication, and review access granted to technology, maintenance, and logistics providers. Where feasible, separate corporate networks from industrial networks.

4. Protect backups and prepare for recovery

Backups should be protected against deletion, encryption, and unauthorized access. Companies should also regularly test whether data and systems can be restored and determine which processes need to be brought back online first.

5. Prepare an incident response plan

The company should establish procedures for detecting, reporting, and managing incidents. These procedures should identify responsible personnel, alternative communication channels, and the criteria for determining whether customers, authorities, or relevant regulatory bodies must be notified.

6. Train employees and review security controls

Training helps employees recognize fraudulent emails, protect credentials, and report incidents promptly. Technical and organizational measures should also be reviewed regularly to ensure they remain effective and appropriate.

What are the consequences of failing to comply with NIS2 and ENS?

The consequences depend on the applicable regulations and the circumstances of each case.

• NIS2: Entities within the directive's scope may face penalties for failing to meet risk management and incident reporting obligations, as well as supervisory measures.
• ENS: When the framework applies to a public sector contract or service, failure to demonstrate the required level of compliance may affect contract awards or service delivery.
• Customer and supplier requirements: Failure to meet agreed security requirements may lead to contractual issues and jeopardize ongoing business relationships.

The first step is to determine which obligations apply to the company and which measures it needs to implement.

How ESED can improve your cosmetics company's cybersecurity

Reducing cybersecurity risks requires assessing systems, reviewing existing safeguards, and preparing for potential incidents.

At ESED, we help companies identify vulnerabilities and strengthen their security through audits, vulnerability assessments, 24/7 monitoring, managed detection and response (MDR/XDR), and protection for corporate and cloud environments.

Our managed services come with a fixed monthly fee and no unexpected costs, making it easier to plan your cybersecurity budget while maintaining continuous protection. This allows your company to adapt security measures to its operations, reduce the risk of disruptions, and better manage its security obligations.