With the NIS2 transposition deadline passed and enforcement beginning across EU member states, the NIS2 Directive is reshaping cybersecurity requirements for industrial facilities worldwide. For plants running legacy PLCs — platforms never designed with network security — the compliance implications are significant.

The EU's NIS2 Directive (Directive (EU) 2022/2555) expands cybersecurity regulation into manufacturing more directly than its predecessor. It brings thousands of facilities under mandatory cybersecurity obligations.

According to ENISA, enforcement varies by member state but generally includes regular audits, 24-hour incident reporting, and fines up to €10 million or 2 percent of global annual turnover. For plants running legacy automation, the PLCs keeping production running lack the built-in security features needed to meet modern compliance standards.

The Legacy PLC Exposure Gap

Industrial automation platforms from the 1980s through the early 2010s were engineered when controllers communicated over proprietary fieldbuses or serial links, not Ethernet-based protocols. That era is gone, but the hardware remains.

Consider the platforms still in wide deployment across European and global manufacturing:

· Allen-Bradley PLC-5 and SLC 500 — Rockwell's workhorses of the 1980s and 1990s. PLC-5 discontinued in 2017; SLC 500 in 2023. Neither supports encryption, authentication, or network-level access control. A single unsegmented Ethernet connection exposes the control program to anyone with knowledge of CIP.

· Siemens SIMATIC S7-300 and S7-400 — Among the most widely deployed PLC families in European manufacturing. The S7-300 (1994) and S7-400 both began end-of-life announcements in 2022. Neither supports modern authentication for S7 communication without third-party security overlays.

· Schneider Electric Modicon Quantum — A mainstay of process industries. End-of-life announced in 2022, last-time-buy windows largely closed. Quantum's Modbus TCP implementation offers no built-in security.

· Mitsubishi Electric MELSEC-A Series (A-Series) — Widely deployed across Asian and European manufacturing since the 1980s. Mitsubishi promotes the iQ-F and iQ-R as successors, but legacy A-series installations remain in food, packaging, and material handling where replacement costs are hard to justify.

· Omron C200H and CQM1 — Operating in countless packaging and machine control applications across Europe and North America. Omron shifted focus to its NJ/NX and Sysmac platforms, but the C200H installed base remains substantial in small to mid-size manufacturing.

"As a general rule, any PLC designed before approximately 2010 lacks the authentication, encryption, and logging capabilities NIS2 compliance now requires," wrote a control systems engineer on Control.com (control.com). "These controllers trust every message they receive. In a flat network with IT/OT convergence, that's a compliance violation waiting to be discovered during audit."

A report published by AutomationWorld (automationworld.com) in early 2024 noted that "the installed base of legacy controllers across Europe is measured in the hundreds of thousands, and many run mission-critical processes that cannot be shut down for a rip-and-replace migration without months of planning."

Three Paths Forward for Legacy PLC Owners

Industry analysts describe three strategies for addressing NIS2 compliance with legacy PLCs. Each carries different implications for spare parts demand.

Path 1: Air-Gap and Network Segmentation

The least disruptive approach involves isolating legacy PLC networks from corporate IT networks and the internet entirely, or deploying defense-in-depth segmentation using firewalls, unidirectional gateways, and industrial DMZs. The PLCs themselves remain unchanged — the security is applied at the network boundary.

This path allows companies to continue using existing hardware, but it requires careful engineering per the ISA/IEC 62443 standard and places significant stress on spare parts availability. If a legacy PLC module fails inside a segmented zone, the entire production cell could be down until a replacement is found. As segmentation projects accelerate, the need for serviceable spare modules for legacy platforms rises proportionally.

Path 2: Rip and Replace with Modern Hardware

The definitive solution — replacing legacy PLC-5, S7-300, Modicon Quantum, and similar controllers with modern equivalents that support encrypted communications, authentication, and audit logging — requires substantial capital investment and production downtime.

Siemens has positioned its S7-1500 platform as the migration path for S7-300/400 users, with security-integrated firmware and the CP 1543-1 for firewall and VPN capabilities. Rockwell Automation promotes its CompactLogix 5380/5480 and ControlLogix 5580 series with built-in CIP Security for SLC 500 and PLC-5 migrations. Schneider Electric's M580 and M340 platforms include embedded cybersecurity features for Modicon Quantum replacements.

However, ENISA's implementation monitoring indicates that many member states prioritize incident reporting and risk assessment documentation over immediate hardware replacement in the first enforcement phase (2025–2027). This creates a window in which companies must demonstrate compliance while still operating legacy hardware — a scenario demanding a reliable inventory of functional spare modules.

Path 3: Source Spares to Extend System Life During Transition

For organizations facing 12- to 36-month lead times for engineering, cabinet redesign, code conversion, and validation — typical of large-scale migration projects — maintaining the existing system in a compliant configuration requires access to replacement modules.

This third path is where the spare parts market has shifted significantly. Obsolete modules once available through standard distribution are now consolidating into specialized surplus networks. For companies operating S7-400 racks in German automotive plants, SLC 500 processors in French packaging lines, or Modicon Quantum CPUs in Italian water treatment facilities, sourcing a replacement module within 24 to 48 hours can determine whether a production line meets its quarterly targets.

The Spare Parts Reality: Demand Rises as Supply Contracts

The intersection of NIS2 compliance timelines and manufacturer end-of-life announcements creates a supply squeeze that will intensify through 2026 and beyond.

Rockwell's last-time-buy windows for SLC 500 modules closed in mid-2023. Siemens' S7-300 final orders wrapped up through 2023 into 2024, with service support ending on a rolling schedule. Schneider's Modicon Quantum last-time-buy programs concluded in 2022. Each discontinuation removes a formal supply channel, and remaining inventory is consumed for both new builds and maintenance replacement.

For companies pursuing Path 1 (segmentation) or Path 3 (transition extension), access to verified functional spare parts for legacy PLC platforms becomes a strategic priority — not merely a maintenance convenience. Parts meeting both CE and UL certification standards for EU-regulated facilities are particularly constrained.

Spare parts suppliers maintaining comprehensive inventories of legacy components — covering platforms on both 120V/60Hz and 230V/50Hz, and including backplanes, power supplies, CPU modules, and I/O cards — help manufacturers bridge the gap between current operations and full NIS2 compliance.

Looking Ahead

Manufacturers evaluating NIS2 compliance should inventory their legacy automation assets, assess each device against the ISA/IEC 62443 framework, and develop a migration timeline accounting for engineering, validation, and production constraints.

In the interim, the availability of verified spare parts for legacy platforms such as Allen-Bradley, Siemens, and other industrial automation controllers determines whether a plant can maintain operations while building toward a compliant architecture. As enforcement ramps up through 2026, factories with the most robust spare parts strategies — not just the most advanced cybersecurity tools — will be the ones that keep production running.

The NIS2 deadline has passed, but for legacy PLC users across Europe and the global supply chains that serve them, the real work of securing both compliance and continuity is just beginning.

------------------------------------------------------------------------------------------------------------------

🏢 About TZ Tech

TZ Tech is a leading supplier of industrial automation, electrical, instrumentation, and telecommunications components. We specialize in sourcing ready-to-ship distributor stock, allowing us to offer highly competitive pricing and short lead times. Thanks to our extensive inventory, we can even source rare and discontinued parts that are hard to find elsewhere.

🛡️ Our Quality Commitment

We understand that quality is your top priority. Every component undergoes a strict screening and inspection process so you can buy with absolute confidence. For legacy or discontinued parts, we believe in complete transparency and will always provide an honest, accurate report on the product's condition. Plus, all brand-new parts come backed by a full 1-year warranty.

✉️ Get in Touch

Have a project or a part you need? Send us your inquiry today! Our team is dedicated to providing a fast response within 6 hours (excluding weekends).