NIS2: the guide to cybersecurity and management duties

Short answer: NIS2 (Directive (EU) 2022/2555) raises cybersecurity to board level for "essential" and "important" entities in designated sectors — transport and logistics are expressly included. You face risk-management measures, a staged reporting duty, a registration duty, supply-chain obligations and personal management liability. This guide brings the separate files together.

What it comes down to

NIS2 replaces the old NIS Directive and broadens its scope considerably. The core: organisations above certain thresholds in designated sectors must demonstrably have their digital resilience in order — and the board is responsible, with personal liability for serious negligence. The precise scope and dates follow from the national implementing law.

The files at a glance

• Does my transport or logistics company fall under NIS2? — the scope question: sector, size, essential versus important.
• NIS2 and the transport sector — why transport is an essential sector and what that means.
• Which measures must I take at minimum? — the minimum risk-management measures, as a checklist.
• The reporting duty (24/72 hours) — the staged deadlines for a significant incident.
• Registration duty — whether and how to register your organisation.
• Management liability — what the board must do and when it is personally liable.
• My customer asks me for measures — the supply-chain obligations that reach you via your customers.
• DORA or NIS2? — which applies to you if you sit in the financial sphere.

Where to start

First determine whether you fall under NIS2 (sector + size), and if so: essential or important. Then map your current measures against the checklist, arrange the reporting chain and assign responsibility to the board. The free Transport & Logistics scan covers NIS2 alongside the other regimes that affect you — every result traceable to its source.