NIS2 for Transport: Rail, Air, Water, Road

NIS2 applies to transport operators of a type listed in Annex I: air carriers, airports, air traffic control, railway infrastructure managers and undertakings, shipping companies, ports, vessel traffic services, road authorities and ITS operators. Large ones are essential entities, medium-sized ones important, and smaller ones usually out. Hauliers and bus companies are not listed.

This guide covers the entity types per subsector, what is not covered, essential or important status, the sector rules alongside NIS2, what compliance requires, supply chain and OT in practice, and a checklist.

Subsector	Entity types in Annex I	Defined in	Sector rules alongside NIS2
Air	Commercial air carriers; airport managing bodies, airports and entities operating ancillary installations in them; air traffic control operators	Reg. (EC) 300/2008, Dir. 2009/12/EC, Reg. (EC) 549/2004	EASA Part-IS; aviation security, Impl. Reg. (EU) 2015/1998 point 1.7
Rail	Infrastructure managers; railway undertakings, including operators of service facilities	Dir. 2012/34/EU	CLC/TS 50701 (a standard, not law)
Water	Inland, sea and coastal water transport companies (not individual vessels); port managing bodies, port facilities and operators of works and equipment in ports; vessel traffic services	Reg. (EC) 725/2004, Dir. 2005/65/EC, Dir. 2002/59/EC	Ship and port facility security (ISPS); IMO MSC.428(98)
Road	Road authorities responsible for traffic management control, except public entities for which it is a non-essential part of their general activity; ITS operators	Del. Reg. (EU) 2015/962, Dir. 2010/40/EU	ITS framework (not a cybersecurity law)

Which transport operators are in scope of NIS2?

Transport is one of the 11 sectors of high criticality in Annex I. The test is the type of entity, and most types are defined by reference to another EU act. Read that definition, not your own description of what you do.

Air

Air carriers used for commercial purposes, as defined in Regulation (EC) No 300/2008 on civil aviation security.
Airport managing bodies and airports as defined in Directive 2009/12/EC, including the core airports listed under Regulation (EU) No 1315/2013, and entities operating ancillary installations contained within airports.
Traffic management control operators providing air traffic control services, as defined in Regulation (EC) No 549/2004.

Only air traffic control is listed, not every air navigation service provider. Maintenance organisations, CAMOs and training organisations are not Annex I types either, although all of them are in EASA Part-IS.

Rail

Infrastructure managers as defined in Directive 2012/34/EU.
Railway undertakings as defined in the same directive, including operators of service facilities.

Water

Inland, sea and coastal passenger and freight water transport companies, as defined for maritime transport in Annex I to Regulation (EC) No 725/2004, not including the individual vessels they operate.
Managing bodies of ports as defined in Directive 2005/65/EC, including their port facilities, and entities operating works and equipment contained within ports.
Operators of vessel traffic services as defined in Directive 2002/59/EC.

Road

Road authorities, as defined in Delegated Regulation (EU) 2015/962, responsible for traffic management control, excluding public entities for which traffic management or the operation of intelligent transport systems is a non-essential part of their general activity.
Operators of intelligent transport systems as defined in Directive 2010/40/EU: ICT applied to road transport, including traffic and mobility management.

Motorway operators are in only if they fit one of these definitions, for example as ITS operators. The exclusion matters for municipalities and other public bodies that run traffic control alongside many other tasks. Check how your national law applies it.

What is not in the transport sector?

Road haulage, logistics and bus or coach operation are not Annex I types. Such a company can still be in scope through another type, such as courier services in Annex II.
Urban public transport is not listed. An operator comes in only if its Member State identifies it as a critical entity under the CER Directive (EU) 2022/2557, which covers public transport; identification was due by 17 July 2026. It is then essential, regardless of size (Articles 2(3) and 3(1)).
Makers of vehicles and transport equipment sit in Annex II manufacturing: motor vehicles, trailers and semi-trailers (NACE C29) and other transport equipment (C30), which covers ships, rolling stock and aircraft. If medium-sized or larger, they are normally important entities.

The NIS2 scope checker gives a first answer. The full method, including exclusions, is in the NIS2 scope guide.

Are transport operators essential or important entities?

For Annex I types, size decides, using Recommendation 2003/361/EC:

Large (250 or more staff, or turnover above €50 million and balance sheet above €43 million): essential.
Medium-sized (50 or more staff, or turnover and balance sheet both above €10 million): important.
Small or micro: out of scope, unless the Member State identifies the entity, for example as the sole provider of an essential service, or it is a CER critical entity.

Size includes linked and partner enterprises, so a small port subsidiary of a large group can count as large. All four transport subsectors, road included, were already in NIS1. If the Member State so provides, operators of essential services identified under NIS1 before 16 January 2023 are essential entities (Article 3(1)(g)).

Both categories carry the same obligations. Supervision and fines differ: maximum fines of at least €10 million or 2% of worldwide turnover for essential entities, and at least €7 million or 1.4% for important ones, whichever is higher. Details in essential vs important entities. Proposal COM(2026) 13 would make Annex I small mid-caps important as a main rule; it is not law.

How does NIS2 fit with aviation, rail, maritime and road rules?

Aviation: Part-IS and aviation security

EASA Part-IS requires an information security management system for risks with a potential impact on aviation safety. It has applied since 16 October 2025 to aerodromes and design and production organisations, and since 22 February 2026 to air operators, maintenance organisations and air navigation service providers.

EASA says Part-IS is not lex specialis under Article 4 of NIS2, so an airline or airport in both regimes follows both. Credit runs both ways but is not automatic. Article 5 of Implementing Regulation (EU) 2023/203 and Article 4 of Delegated Regulation (EU) 2022/1645 treat compliance with equivalent NIS security requirements, now read as NIS2 (Article 44), as Part-IS compliance. Under NIS2 recital 29, authorities “could” treat compliance with the security requirements of Regulations (EC) No 300/2008 and (EU) 2018/1139 as compliance with the corresponding NIS2 requirements.

Aviation security adds a third layer. Point 1.7 of Implementing Regulation (EU) 2015/1998, added in 2019, requires airport operators, air carriers and entities named in the national civil aviation security programme to identify and protect critical ICT systems and data from cyber-attacks that could affect civil aviation security.

One incident can therefore go to the NIS2 CSIRT or authority (24 and 72 hours) and to the aviation authority under Part-IS (within 72 hours). What Part-IS means for suppliers is in EASA Part-IS explained.

Rail: CLC/TS 50701 is a standard, not law

The rail-specific cybersecurity reference is CLC/TS 50701, a CENELEC technical specification first published in 2021. ENISA describes it as applying IEC 62443 to railway communications, signalling, processing, rolling stock and fixed installations. It is not law. NIS2 Article 21(1) only asks that measures take account of relevant European and international standards, where applicable.

Maritime: ISPS and IMO

Regulation (EC) No 725/2004 brings the IMO’s ISPS Code into EU law, and Directive 2005/65/EC covers port security. Regulation 725/2004 targets intentional unlawful acts in general and was not written as a cybersecurity law. Both matter here because Annex I uses them to define who is in scope.

On board, the IMO route applies. Resolution MSC.428(98) of June 2017 encourages administrations to ensure cyber risks are addressed in ISM Code safety management systems by the first annual verification of the company’s Document of Compliance after 1 January 2021. The current guidelines are MSC-FAL.1/Circ.3/Rev.3 of 4 April 2025.

Road: ITS and traffic control

Directive 2010/40/EU sets the framework for deploying intelligent transport systems. It is a deployment framework, not a cybersecurity law: the risk-management and reporting duties come from NIS2. In practice the assets are traffic control centres, tunnel and signal control, variable message signs and traffic data feeds.

What does NIS2 compliance for the transportation sector require?

The same as other sectors:

Governance (Article 20). The management body approves and oversees the measures, follows training and can be held liable.
Measures (Article 21). The ten minimum measures, on an all-hazards approach that covers the physical environment. A flooded signal room counts, as set out in the all-hazards approach.
Reporting (Article 23). Early warning within 24 hours of becoming aware of a significant incident, notification within 72 hours, final report within one month.
Registration (Article 3(4)). Contacts, IP ranges, sector and subsector, with changes within two weeks.

Obligations apply through national law, and on 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for not notifying transposition. Check what is in force where you operate. The programme view is on the NIS2 compliance page.

Supply chain, OT and contractor access: what NIS2 leaves open

Article 21(2)(d) and 21(3) require supply chain security that takes into account each direct supplier’s vulnerabilities, the quality of its products and cybersecurity practices, including secure development, and the results of EU coordinated risk assessments. They say nothing about signalling, ATC systems or port cranes, and the gap is widest there.

In practice, three things decide transport programmes:

OT runs for decades. Signalling, traffic control and terminal systems outlive their vendor’s patch cycle, and changes can need safety approval. Segmentation, monitoring and restricted access carry the load patching cannot.
Contractors hold the keys. Maintenance vendors connect remotely to OT, often through standing VPNs and shared accounts. Access control policies (Article 21(2)(i)) and MFA “where appropriate” (Article 21(2)(j)) are hard to argue against on that path.
The assessment is not the control. A questionnaire records a policy. It does not show who logged in to the signalling network last Tuesday.

A sensible approach is a register like this, reviewed every quarter. The method behind it is in NIS2 supply chain security.

TRANSPORT CONTRACTOR ACCESS REGISTER (one line per access path)

Contractor         : company, contract reference, criticality
System reached     : e.g. signalling, ATC, port terminal, traffic control
Zone               : IT or OT, network segment reached
Access method      : VPN, jump host, vendor portal, on-site laptop
Accounts           : named individuals only, no shared accounts
Authentication     : MFA yes / no, method
Access window      : standing / on request / time-limited (hours)
Approval           : who approves each session
Logging            : session recorded? where are the logs kept?
Incident clause    : contractor notifies you within [x] hours
Last review        : date, reviewer, result

Kept by hand, it is out of date the week after the review. Collected from the access gateway, identity provider and ticketing system, with a person reviewing exceptions, it stays current. That is how the CloudSoul platform works: automated, with human-in-the-loop expertise.

NIS2 transport checklist

Match each legal entity to an Annex I type using the definition in the referenced act.
Calculate size with linked and partner enterprises, and record the result.
Check whether you are a CER critical entity or were a NIS1 operator of essential services.
Register with your competent authority and keep the details current.
Map every reporting path for one incident: NIS2, Part-IS, aviation security and safety regulators.
List every contractor with remote access to OT, with MFA and logging on each path.
Put security and incident notification clauses in contracts with critical suppliers.
Test the restore and manual fallback for traffic, signalling or port operations.

Sources

Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23, 34 and 44, recital 29, Annexes I and II, EUR-Lex. Article text: Article 21, recitals 21 to 30.
Directive (EU) 2016/1148 (NIS1), Annex II, transport, legislation.gov.uk.
Directive (EU) 2022/2557 (CER Directive), Articles 2 and 6, EUR-Lex, and Commission Delegated Regulation (EU) 2023/2450 (list of essential services), EUR-Lex.
Commission Recommendation 2003/361/EC (SME definition), EUR-Lex.
Commission Delegated Regulation (EU) 2022/1645 (Part-IS), Articles 2, 4 and 8, EUR-Lex, and Implementing Regulation (EU) 2023/203, Articles 2, 5 and 16 and point IS.I.OR.230, EUR-Lex; EASA, Information security regulations and dates of application and FAQ 139289 on Part-IS and NIS2.
Commission Implementing Regulation (EU) 2019/1583 amending Implementing Regulation (EU) 2015/1998 as regards cybersecurity measures, point 1.7, EUR-Lex.
Regulation (EC) No 725/2004 on enhancing ship and port facility security, EUR-Lex.
Directive 2010/40/EU (intelligent transport systems), Article 4, EUR-Lex.
IMO, Maritime cyber risk: Resolution MSC.428(98), IMO, and Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3/Rev.3, 4 April 2025, IMO.
ENISA, Railway cybersecurity: good practices in cyber risk management, 25 November 2021, ENISA.
Proposal COM(2026) 13 amending Directive (EU) 2022/2555, 20 January 2026, European Commission.
Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice, 8 July 2026, European Commission.

Frequently asked questions

Does NIS2 apply to the transport sector?

Yes. Transport is one of the sectors of high criticality in Annex I, with four subsectors: air, rail, water and road. An entity of a listed type is in scope if it is at least medium-sized and active in the EU. Large ones are essential entities, medium-sized ones important.

Does NIS2 apply to rail?

Yes. Annex I lists railway infrastructure managers and railway undertakings as defined in Directive 2012/34/EU, including operators of service facilities. CLC/TS 50701, the railway cybersecurity technical specification, is a standard, not a legal requirement.

Are road hauliers and logistics companies covered by NIS2?

Not as transport entities. The road subsector covers road authorities responsible for traffic management control and operators of intelligent transport systems. A logistics company can still be in scope through another type, such as courier services in Annex II, and may be assessed as a supplier by customers that are in scope.

Does EASA Part-IS replace NIS2 for airlines and airports?

No. EASA says Part-IS is not lex specialis under Article 4 of NIS2, so organisations in both regimes follow both. Part-IS treats compliance with equivalent NIS security requirements as Part-IS compliance, and NIS2 recital 29 says authorities could treat compliance with aviation security requirements as NIS2 compliance, but neither happens automatically.

Are public transport operators in scope of NIS2?

Urban public transport is not an Annex I type. A public transport operator comes into NIS2 if its Member State identifies it as a critical entity under the CER Directive, which makes it an essential entity regardless of size. Member States had to identify critical entities by 17 July 2026.

NIS2 for transport: which air, rail, water and road operators are in scope and what applies