NIS2: which measures must I take as a minimum?
Adopted 2026-06-14 · ≈ 1 min read · 
edited by Dirk Baaijen
NIS2 requires appropriate risk-management measures — from risk analysis, backups and supply-chain security to access control, training and encryption — plus board accountability. A practical checklist for transport and logistics.
NIS2 does not prescribe exact technology, but requires appropriate technical and organisational measures based on your risk. The directive names a base set; below, translated into a checklist.
The minimum measures (Art. 21)
- Risk analysis and security policy — documented and current.
- Incident handling — detection, response, and the reporting duty (24/72h).
- Business continuity — backups, recovery, crisis management.
- Supply-chain security — requirements for suppliers and service providers.
- Security in acquisition, development and maintenance — incl.
vulnerability handling.
- Policy to measure the effectiveness of your measures.
- Basic cyber hygiene and training — for staff and management.
- Encryption where appropriate.
- Access control — incl. multi-factor authentication and account
management.
Management accountability (Art. 20)
NIS2 places responsibility explicitly with the management body: they approve the measures, oversee compliance and must undergo training. Cybersecurity is a boardroom matter, not an IT detail — with management liability for negligence.
What to do
- Run a risk analysis and document your policy.
- Walk through the checklist above and close the gaps.
- Assign responsibility to the board and plan training.
Read the main file: NIS2: cybersecurity as a board responsibility. Or take the Transport & Logistics scan.
Sources
- https://eur-lex.europa.eu/eli/dir/2022/2555/oj
Directive (EU) 2022/2555 (NIS2): risk-management measures (Art. 21) and management accountability (Art. 20). - https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
European Commission — NIS2: management measures and governance.
Read next
Securing AI in critical infrastructure: where the AI Act, Cyber Resilience Act and NIS2 meet
A single AI system in a port often falls under three frameworks at once: the AI Act (Art. 15) secures the AI system itself, the Cyber Resilience Act the product, and NIS2 obliges the operator as an essential entity. This piece explains how they meet and who is responsible for what.
NIS2: the guide to cybersecurity and management duties
NIS2 makes cybersecurity a board-level responsibility for essential and important entities — including transport and logistics. This guide brings together who is in scope, which measures and reporting duties apply, management liability, and supply-chain obligations.
Does my ISO 27001 certification cover the NIS2 duty of care?
ISO 27001 covers much of the NIS2 risk-management measures, but is not automatic compliance. Incident reporting, management accountability, supply-chain risk and registration must be addressed separately.