NIS2 readiness for logistics and transport suppliers
You move, store or track goods for ports, airports, rail operators, large shippers or public bodies, or you supply the software and telematics they run on. Transport is a high-criticality sector in Annex I, so your bigger customers are essential entities with the strictest regime.
Logistics runs on shared systems: portals, EDI links, track-and-trace, access cards, driver apps. Every integration is a path into the customer, and essential entities are supervised proactively, so their questionnaires are the most detailed we see. Expect questions about integrations, not only about your office IT.
The five questions this sector gets
Each with what counts as evidence. A yes without an artefact scores nothing.
- Integrations and portal accountsWhich customer systems you connect to, with what credentials, who holds them, and how they are rotated and removed.
- Driver and warehouse devicesScanners, tablets and phones: how they are managed, updated and wiped, and what happens when one is lost.
- Availability and continuityWhat you do when your transport management system is down, how long you can run on paper, and when the customer is told.
- Email and invoice fraud controlsSPF, DKIM, DMARC and a verification step for changed bank details, because freight invoicing is a favourite fraud target.
- Sub-contracted carriersWhether you ask your own sub-contractors the same questions, and what you require of them in writing.
Four things to have before the next questionnaire
Cheap, mostly visible from outside, and present in nearly every questionnaire. The rest goes into a dated plan with an owner per item.
- An inventory of every customer integration and who holds the credentials
- MFA on portals, email and remote access
- Email authentication with DMARC at quarantine or reject
- A written continuity step: who calls the customer, and when
NIS2 supplier-readiness assessment
10 working days, fixed scope, written deliverables.
External reconnaissance, authenticated configuration review, email and domain authentication, cloud and hosting posture, and a staff phishing baseline. You receive a written report, a remediation plan ordered by risk, and an evidence pack mapped to the NIS2 themes your customer is asking about.
- External attack-surface report
- Email authentication
- Server and cloud hardening
- Web security headers
- Remediation plan
Asked before, answered here
Related problems: One incident from disaster, Your team drowns in manual work.
Our customer is a port operator. Why are they so detailed?
We use a cloud transport management system. Is that our vendor's problem?
How fast could we be ready?
Suppliers in other regulated chains
Manufacturing and industrial suppliers
Component makers, contract manufacturers, installers and maintenance firms
What this sector is askedIndustryIT and software suppliers
Managed service providers, software vendors, hosting and integration partners
What this sector is askedIndustryHealthcare suppliers
Medical device makers, health IT vendors, labs, care and facility suppliers
What this sector is askedIndustryProfessional services suppliers
Consultancies, accountants, law firms, engineering and recruitment firms
What this sector is asked