Transport is in Annex 1 to OUG 155/2024, among the sectors of high criticality. The standard risk score is 85 points for a small organisation, 170 for a medium-sized one and 255 for a large one. For road transport, the law targets the authorities that manage traffic and the operators of intelligent transport systems, not road haulage companies.
Who is covered by NIS2 in transport
The list in Annex 1 comes from the NIS2 Directive and covers four modes of transport:
- air transport: air carriers used for commercial purposes, airport managing bodies and entities operating ancillary installations within airports, and air traffic control service providers;
- rail transport: infrastructure managers and railway undertakings, including operators of service facilities;
- water transport: inland, sea and coastal passenger and freight water transport companies, port managing bodies, including their port facilities, and operators of vessel traffic services;
- road transport: road authorities responsible for traffic management control and operators of intelligent transport systems.
Size is set under Law No. 346/2004: as a rule, 50–249 employees for a medium-sized company and 250 or more for a large one. Small and micro companies are covered only in the special cases set out in the law.
Which assurance level applies
| Organisation size | Entity type | Standard risk score | Assurance level | At self-assessment |
|---|---|---|---|---|
| Small or micro | outside NIS2, except for the cases in the law | 85 | basic | 34 controls, threshold 2.5 |
| Medium | important | 170 | important | 133 controls, threshold 3 |
| Large | essential | 255 | essential | 218 controls, threshold 3.5 and at least 3 in every category |
The standard score is the DNSC value for the sector, multiplied by 1, 2 or 3 according to size. If you operate in several sectors, the highest score applies.
Find your level and maturity score in a few minutes. The calculator opens with the “Transport” sector already selected; you choose the size and answer 12 questions.
Calculate the level for transportWhich systems are usually assessed
The assessment and the audit cover the networks and information systems the transport service depends on. Depending on the subsector, they usually include:
- dispatch, trip planning and fleet tracking;
- ticket sales, bookings and passenger apps;
- traffic control, signalling and operational communication systems;
- airport and port systems: check-in, baggage, terminal and cargo management;
- industrial and automation equipment, treated separately from the office network;
- remote access by suppliers and maintenance teams.
Road haulage: covered or not?
The question comes up often from transport and logistics companies. Annex 1 does not include road haulage companies as such: for road transport, it covers only the authorities responsible for traffic management control and the operators of intelligent transport systems.
A transport or logistics company can still fall under NIS2 another way: as a postal and courier service provider, in Annex 2, if it provides courier services, or if DNSC designates it.
And if it works for an essential or important entity, that entity will require security measures through the contract. Supply-chain security is one of the minimum measures in art. 13 of OUG 155/2024.
What comes next
- notification to DNSC, within 30 days from the date OUG 155/2024 becomes applicable to the organisation; the first DNSC fine sanctioned exactly this deadline;
- the risk-level assessment, within 60 days of the DNSC decision;
- the self-assessment, within the following 60 days, on the controls of your level;
- the audit, carried out by a DNSC-certified auditor.
How TRU helps
In transport, an outage stops trips and strands goods and passengers. We usually start with:
- PenTest, external and internal, for the IT network, with reports within 48 hours of the scan being completed; OT environments are discussed separately;
- SOC 24/7/365, for detection and response at night as well, when many operations run;
- Proton Workspace, for communication with partners and for transport documents, encrypted in transit and at rest.
Through CIO-as-a-Service we coordinate the inventory, the relationship with suppliers and the remediation plan. The audit is carried out by DNSC-certified auditors who are TRU partners.
Frequently asked questions
Is a courier company covered under transport?
No. Courier services belong to the postal and courier services sector, in Annex 2. A medium-sized or large courier company is an important entity, with a standard score of 100 or 150, so the important level.
What are intelligent transport systems?
Systems that use information and communication technology in road transport: traffic management, traveller information or electronic tolling, for example. Their operators are in Annex 1.
Is industrial equipment part of the assessment?
Yes, if it supports the transport service. You add it to the inventory and separate it from the office network. Testing is planned separately, with the operator, so that it does not affect operations.
Sources
OUG 155/2024 (in Romanian) · Directive (EU) 2022/2555 · DNSC risk-level methodology (in Romanian).