NIS2 for Logistics: Cybersecurity Obligations for Supply Chain Operators in 2026

The NIS2 Directive (EU 2022/2555) entered into force in January 2023 and Member States were required to transpose it into national law by 17 October 2024. For the logistics and supply chain sector, this directive represents the most demanding cybersecurity obligation the industry has faced to date. Transport operators, warehousing companies, logistics infrastructure managers and information system providers for supply chains are now within the European cybersecurity regulatory perimeter. This article examines in detail what NIS2 means for the logistics sector, what specific obligations must be met, what penalties apply for non-compliance, and how IgeraRegTech helps compliance teams navigate this regulatory complexity.

Why logistics is within the scope of NIS2

NIS2 significantly expanded the scope of its predecessor (the NIS Directive, 2016) by including new sectors considered critical to the functioning of European economies and societies. Transport and logistics are explicitly listed in Annex I (essential entities) and Annex II (important entities) of the directive.

The regulatory rationale is clear: a disruption of road, rail, air or maritime freight transport, or a cyberattack that paralyses the warehouse management systems (WMS) or transport management systems (TMS) of a mid-sized logistics operator, can have cascading effects across entire supply chains, shortages of essential goods and economic losses that far exceed the direct damage to the affected operator.

Who is in scope?

The directive distinguishes between two categories with different levels of obligations:

• Essential entities: transport operators (road, rail, air, maritime) with more than 250 employees or more than €50 million annual turnover. Subject to active supervision by competent authorities.
• Important entities: logistics operators, courier companies, warehouse managers and supply chain operators with between 50 and 250 employees or between €10 million and €50 million in turnover. Subject to reactive supervision (authorities act if they receive evidence of non-compliance).

Micro-enterprises (fewer than 10 employees) and small enterprises (fewer than 50 employees and less than €10 million turnover) are generally outside the mandatory scope of NIS2, although they may be indirectly affected as suppliers to essential or important entities.

The 10 mandatory security measures

Article 21 of NIS2 requires entities to adopt «appropriate and proportionate technical, operational and organisational measures» to manage the risks to the security of their network and information systems. The directive identifies ten minimum areas these measures must cover:

Incident reporting: the deadlines that allow no margin

NIS2 establishes a three-stage notification regime for significant incidents with strict deadlines:

• Early warning (24 hours): initial notification to the national CSIRT or competent authority when the entity becomes aware that a significant incident has occurred. Must include a preliminary description and, where possible, an indication of whether the incident is of malicious origin.
• Incident notification (72 hours): update with an initial assessment of the incident, its severity and indicators of compromise. This notification must state whether the incident has been resolved.
• Final report (1 month): detailed description of the incident, type of threat, root cause, mitigation measures adopted and, where relevant, cross-border impact.

For a logistics operator, a ransomware attack that paralyses the WMS for more than 4 hours during a high-load operational day (Black Friday, for example) would very likely meet the definition of a significant incident and trigger the 24-hour notification obligation.

OT/IT convergence: logistics-specific attack surface

The logistics sector has a characteristic that distinguishes it from other sectors regulated by NIS2: the convergence between operational technology (OT) and information technology (IT). In a modern warehouse, automated material handling systems (MHS), stacker cranes, conveyor belts, automatic picking systems and autonomous mobile robots (AGV/AMR) are managed by PLCs and SCADA systems that historically operated on isolated networks but are now connected to WMS and corporate networks to improve operational efficiency.

This connectivity creates previously non-existent attack vectors. A ransomware attack entering through a phishing email to an office employee can, if the network is not properly segmented, propagate to the PLCs controlling the stacker cranes, completely paralysing the warehouse. For this reason, NIS2 explicitly requires OT system risk management as part of the directive's scope.

Furthermore, IoT devices proliferate in logistics: barcode and QR scanners, RFID readers, verification cameras, cold chain temperature sensors, GPS on vehicles, wearable devices for warehouse operatives. All these devices, if not managed within a formal inventory and vulnerability management programme, represent blind spots in the organisation's security posture.

ICT supply chain obligations

One of the most significant innovations of NIS2 compared to NIS1 is the obligation to manage risks arising from the technology supply chain. For logistics operators, this means:

• Due diligence on ICT suppliers: assessing the security practices of WMS, TMS, EDI platform, cloud, OT system maintenance and any other provider with access to critical systems.
• Contractual security requirements: including security clauses in contracts with ICT providers specifying their obligations regarding vulnerability management, incident notification, security audits and the client's right of access for verification.
• Third-party access management: external providers connecting remotely to systems (for maintenance, technical support, updates) must do so via controlled, audited access with strong authentication.

Penalties: what is at stake

NIS2 establishes a sanctions regime unprecedented in European cybersecurity regulation:

• Essential entities: up to €10 million or 2% of total global annual turnover for the preceding financial year, whichever is higher.
• Important entities: up to €7 million or 1.4% of total global annual turnover, whichever is higher.
• Personal liability of management: NIS2 allows competent authorities to temporarily suspend the exercise of managerial functions by individuals responsible for repeated serious non-compliance. This is a significant innovation compared to NIS1.

Beyond formal sanctions, NIS2 non-compliance can lead to severe reputational consequences, loss of contracts with corporate clients who require their logistics providers to demonstrate compliance, and difficulties in obtaining cyber insurance coverage at reasonable prices.

NIS2 compliance checklist for logistics operators

How IgeraRegTech accelerates NIS2 compliance for logistics operators

Compliance teams at logistics operators face a growing volume of regulation: NIS2, DORA (for financial entities in their chain), GDPR, ADR regulations for dangerous goods transport, port security regulations (ISPS Code) and many more. Maintaining up-to-date knowledge of all these regulations and answering specific questions — what is the deadline for notifying an incident? what clause should I include in the contract with my WMS provider? — requires time and expertise that is rarely available on demand.

IgeraRegTech indexes all the regulatory documentation that the compliance team needs: directive texts, implementing regulations, ENISA guidelines, ISO 27001/27002 standards, internal policies, incident management procedures and contracts with ICT providers. From this knowledge base, it answers queries in natural language with precision, citing the exact source.

For more information and a reference guide about this vertical, visit our Igera pillar page.

Frequently asked questions: NIS2 for logistics operators

How do I know if my logistics company is obligated under NIS2?

If your company operates in the freight transport sector (road, rail, air or maritime), warehouse management or courier services, and exceeds the thresholds of 50 employees or €10 million in turnover, you are very likely within the scope of NIS2 as an important entity. If you exceed 250 employees or €50 million in turnover and operate critical transport infrastructure, you may be an essential entity. Consult your country's national transposition for the definitive list of entities in scope.

Does NIS2 require ISO 27001 certification?

NIS2 does not explicitly require ISO 27001 certification, but adopting this standard is the most recognised way to demonstrate that the security measures required by Article 21 have been implemented. Many competent authorities will accept a current ISO 27001 certification as prima facie evidence of technical and organisational compliance.

Do company directors have personal liability?

Yes. NIS2 (Article 20) explicitly states that the management bodies of essential and important entities must approve cybersecurity risk management measures, oversee their implementation and may incur personal liability in cases of non-compliance. In cases of serious infringements, the competent authority may temporarily prohibit the exercise of management functions.

How does NIS2 affect my transport subcontractors?

If you use transport subcontractors as part of your service supply chain, NIS2 requires you to assess the cybersecurity risks they introduce into your network. This means you must include security clauses in your contracts with them, assess their security practices and, if they have access to your systems (for example, through EDI integrations or access to your TMS), manage that access in a controlled manner.

What happens if I suffer an incident and fail to report it within 24 hours?

Failure to meet the notification deadline is itself an infringement of NIS2, regardless of whether the incident caused material damage. Competent authorities may impose specific sanctions for failure to notify in a timely manner, which add to the potential sanctions for the security deficiencies that allowed the incident to occur.