NIS2 Annex.I.2: Transport Sector Cybersecurity Requirements
What This Control Requires
Annex I identifies the transport sector including air transport (air carriers, airport managing bodies, traffic management control operators), rail transport (infrastructure managers, railway undertakings), water transport (inland, sea and coastal passenger and freight transport companies, port managing bodies), and road transport (road authorities responsible for traffic management control, operators of intelligent transport systems).
In Plain Language
A cyber attack on a transport system can ground flights, halt trains, or paralyse a port - and in the worst case, endanger lives. That is why NIS2 classifies transport as highly critical under Annex I, subjecting qualifying entities to the strictest supervisory tier. Modern transport infrastructure is deeply digitalised. Air traffic management, railway signalling, port management platforms, intelligent transport systems (ITS), and fleet management all blend traditional IT with specialised operational technology. Each transport mode brings its own protocols, safety standards, and legacy constraints, making this one of the more complex sectors to secure. The defining tension in transport cybersecurity is that security controls must never compromise operational safety. You cannot deploy a patch that risks a signalling failure or a firewall rule that delays air traffic control data. Transport organisations also need to account for the physical security dimension, since physical access to control rooms, signalling cabinets, or communication infrastructure can enable cyber attacks just as effectively as a phishing email.
How to Implement
Classify every digital system in your transport operations into three tiers: safety-critical (failure could endanger lives), operational (failure disrupts services), and business (administrative and commercial). Apply security controls proportionate to each tier's criticality. Segment safety-critical systems from operational systems and corporate IT. Safety-critical networks should have no direct internet connectivity - use controlled, well-monitored interfaces. Layer your defences so the most critical systems sit behind multiple security boundaries. Build cybersecurity procedures specific to your transport mode. Aviation entities need to align with EASA cybersecurity regulations (including Part-IS). Railway entities should consider EN 50129 and emerging rail cybersecurity standards. Maritime entities need to address IMO maritime cybersecurity guidelines. Road transport entities should account for connected and autonomous vehicle security. Tighten access controls across both cyber and physical boundaries. Many transport systems can be compromised through physical access to control rooms, signalling equipment, or communication infrastructure. Run combined physical-cyber risk assessments rather than treating them as separate domains. Write incident response procedures that explicitly address safety implications. Define safe states for safety-critical systems, establish coordination channels with transport safety authorities, prepare public communication templates for service disruptions, and plan for coordination with interconnected transport operators. Review supply chain risks for transport-specific technology. Equipment manufacturers, system integrators, and maintenance providers often hold privileged access to your most critical systems - treat them as part of your threat surface. Join sector-specific information sharing groups such as A-ISAC (aviation), Rail-ISAC, or maritime cybersecurity forums. Threat intelligence from peers in your transport mode is invaluable.
Evidence Your Auditor Will Request
- Classification of digital systems by criticality (safety-critical, operational, business)
- Network architecture showing segmentation of safety-critical systems
- Sector-specific cybersecurity procedures aligned with relevant transport regulations
- Combined physical-cyber security risk assessment
- Incident response procedures addressing safety implications of cyber incidents
Common Mistakes
- Safety-critical systems connected to corporate networks without adequate segmentation
- Cybersecurity measures not integrated with transport safety management systems
- Legacy transport systems with known vulnerabilities and no remediation path
- Maintenance vendor access to critical systems unmonitored and poorly controlled
- Incident response does not account for safety implications in transport contexts
Related Controls Across Frameworks
Frequently Asked Questions
How does NIS2 relate to EASA aviation cybersecurity regulations?
Are all transport companies in scope regardless of size?
Track NIS2 compliance in one place
AuditFront helps you manage every NIS2 control, collect evidence, and stay audit-ready.
Start Free Assessment