NIS2 Annex.II.2: Postal and Courier Services Cybersecurity Requirements
What This Control Requires
Annex II identifies postal and courier services including providers of postal services as defined in Directive 97/67/EC, including providers of courier services.
In Plain Language
The parcel you ordered last night was tracked, routed, sorted, and delivered through a chain of interconnected digital systems. Postal and courier services have been transformed by technology, and NIS2 recognises their importance to the digital economy by classifying them as important entities under Annex II. A cyber incident hitting a major courier operator can stall supply chains, delay time-sensitive deliveries (including medical supplies), expose personal data of millions of senders and recipients, and erode trust in e-commerce. The combination of a massive physical distribution network with deeply integrated digital systems creates a broad attack surface. Beyond traditional IT, postal and courier entities run significant operational technology in sorting centres, fleet management platforms, and parcel tracking infrastructure. The growing use of IoT - smart lockers, automated vehicles, RFID and barcode systems - expands that digital footprint further. Security strategies need to cover all of it, not just the corporate network.
How to Implement
Secure the operational technology that keeps logistics running: automated sorting systems in distribution centres, fleet management and route optimisation platforms, parcel tracking and tracing, and automated locker networks. Segment these operational systems from corporate IT. Protect customer data across the entire delivery lifecycle. Postal services handle large volumes of personal information - names, addresses, delivery preferences, customs declarations. Encrypt customer data at rest and in transit, enforce access controls so only authorised personnel can see it, set retention policies to minimise how long you store delivery data, and securely dispose of both physical and digital records. Lock down mobile and IoT devices used in delivery operations. Drivers carry mobile devices for route guidance, signature capture, and delivery confirmation. Deploy mobile device management (MDM), enforce app security controls, encrypt communications with central systems, and enable remote wipe for lost or stolen devices. Apply strong access controls to logistics management systems. These systems manage routes, scheduling, and resource allocation - compromising them could enable targeted theft, surveillance of specific shipments, or operational disruption. Use role-based access, require MFA for administrative functions, and log all activity. Build incident response procedures around postal operations. Think through the impact of system outages on delivery commitments, communication with e-commerce partners and customers, fallback procedures for manual sorting and routing, and coordination with law enforcement when incidents involve parcel theft or surveillance. Assess cybersecurity risks from your technology supply chain. Postal services rely on specialised logistics technology providers, e-commerce platform integrations, and customs systems. Each of these dependencies is a potential attack vector.
Evidence Your Auditor Will Request
- Operational technology security assessment for sorting and logistics systems
- Customer data protection measures documentation
- Mobile device management and IoT security programme
- Logistics-specific incident response procedures
- Supply chain risk assessment for technology providers
Common Mistakes
- Parcel tracking data transmitted without encryption over public networks
- Mobile devices used by delivery personnel lack adequate security controls
- Legacy sorting and logistics systems with known vulnerabilities
- No specific incident response for logistics disruption scenarios
- Customer data retained beyond operational need without proper controls
Related Controls Across Frameworks
Frequently Asked Questions
Are small courier companies in scope for NIS2?
How should cross-border postal services handle NIS2 compliance?
Track NIS2 compliance in one place
AuditFront helps you manage every NIS2 control, collect evidence, and stay audit-ready.
Start Free Assessment