What Annex 1 names under “Road”
The transport sector in Annex 1 has the road subsector with two kinds of entities: road authorities responsible for traffic management, and operators of intelligent transport systems [1]. The Cyberbeveiligingsregeling IenW calls those operators ITS service providers, alongside providers of mobility data [4]. A road carrier that transports goods or persons is not listed there. On-board computers or telematics in your own fleet do not as a rule make you an ITS service provider.
When you are covered after all
If you are medium-sized or larger and also carry out one of these activities:
- you provide at least one step in the postal delivery chain (collecting, sorting, transporting or delivering postal items, such as addressed parcels): then you fall under Annex 2 as a postal or courier service; transport separate from those steps does not count [2]
- you supply ITS services or mobility data to others [1] [4]
- you are yourself a wholesaler of food, or you manufacture or distribute chemical substances or mixtures [5]; only transport or storage for another party is as a rule not covered there
- you supply managed IT or security services to other companies [6]
If you fall into one of those categories but are smaller, the Minister can designate you as an essential entity [3]. Without an activity from Annex 1 or 2 that is not possible. See the question about essential and important entities for size.
Even if you are not covered
Customers that are themselves covered by the Cbw must secure their supply chain. They can therefore impose security requirements on you by contract. See the question about customers who demand NIS2.