Cybersecurity in seaports: NIS2 and the Cyber Resilience Act

Short answer: Seaports and port operators fall under NIS2 (Directive (EU) 2022/2555), which covers the transport sector and imposes risk-management measures, management accountability and an incident-reporting duty. The Cyber Resilience Act (Regulation (EU) 2024/2847) addresses the products: it sets cybersecurity requirements for hardware and software with digital elements, including many systems used across port chains.

NIS2: the port as an entity

NIS2 (Directive (EU) 2022/2555) replaced the original NIS Directive and widened the scope to a large number of sectors, including transport. That covers water transport and the associated infrastructure, such as seaports and port facilities. Entities are classified as essential or important, with different supervision and enforcement regimes.

For a port falling under NIS2, the obligations include risk-management measures (Art. 21) — such as risk analysis, incident handling, supply-chain security and continuity management — and explicit management accountability (Art. 20): the management body must approve the measures and oversee their implementation. A phased reporting duty for significant incidents also applies. Member States had to transpose NIS2 into national law by 17 October 2024; the precise implementation and the designation of the competent authority differ per Member State.

The Cyber Resilience Act: the products in the chain

Where NIS2 targets organisations, the Cyber Resilience Act (Regulation (EU) 2024/2847) targets products with digital elements — hardware and software that can be connected to a network or another device. The regulation places security requirements on manufacturers, importers and distributors across the product lifecycle, including vulnerability handling.

In a port environment these include, for example, sensors, lock and quay measurement systems, terminal-operating software and industrial control systems used in operational technology. The CRA applies in a phased manner; full application is set for 11 December 2027, with earlier dates for certain obligations. For ports this means that the selection and procurement of digital equipment will increasingly be shaped by the CRA conformity of suppliers.

How NIS2 and the CRA come together

NIS2 and the CRA complement each other: NIS2 obliges the port as an organisation to secure itself — including supply-chain security — while the CRA governs the security of procured products at the source. A port that falls under NIS2 can use suppliers' CRA conformity as a building block for its own risk-management measures. Both frameworks are now adopted; the exact obligations depend on the entity's classification, the national transposition of NIS2 and the phased timeline of the CRA.

Read more: Transport & Logistics. Take the scan.