NIS2

Is your port ready for NIS2?

The EU NIS2 directive (2022/2555) covers ports and the firms inside them. What it asks, in plain words.

What NIS2 asks of a port

Four obligations, straight from the text of the directive.

Who is covered

Annex I, transport, water transport: port managing bodies, port facilities, entities operating works and equipment within ports, and vessel traffic services.

Ten risk measures

Article 21 lists ten measures, including risk analysis, incident handling, business continuity and backups, supply chain security, cyber hygiene and training, encryption, access control and multi-factor authentication.

24 h, 72 h, one month

Article 23: early warning within 24 hours, incident notification within 72 hours, final report within one month.

Management is responsible

Article 20: management bodies approve and oversee the measures, can be held liable for infringements, and must follow training.

The fines

Article 34 sets the floor of the maximum fine; each country sets the exact amount in its own law.

Essential entities

A maximum of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher.

Important entities

A maximum of at least EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher.

Transposition

Countries had to transpose the directive by 17 October 2024 (Article 41). Check the law and the authority of your own country.

Source: Directive (EU) 2022/2555 on EUR-Lex.

How we can help

Help, not fear: start with a free test, then talk to an engineer about your own systems.

Engineer self-test

Twelve questions on access, network, detection and recovery. About two minutes, answers kept in your browser. Take the test.

Team self-test

For whoever leads IT or a terminal: people, visibility, exercises and the logistics chain. Test your team.

Launch offer

Ten one-hour video calls and two site visits a year for every member. See the launch offer.

Open-source tools

The packages we build to test cyber security at ports and terminals. See the packages.

NIS2: questions

A question about NIS2 at your port? Ask us, in confidence.

Talk to us

Very likely, if your port is in the EU. Annex I of the directive lists, under water transport, the managing bodies of ports, their port facilities, the entities operating works and equipment within ports, and vessel traffic services. Large entities are essential entities and medium-sized ones are important entities; small ones are generally out of scope unless their country designates them. Check your country's law, which transposes the directive.

Article 34: for essential entities, countries must set maximum fines of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher; for important entities, at least EUR 7 million or 1.4%. The exact amounts are set by each country's law.

Article 23, for a significant incident: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report within one month of the notification.

ISO 27001 covers much of the risk management that Article 21 asks for, but it does not by itself make you compliant: NIS2 also sets the reporting deadlines of Article 23 and the duties of management in Article 20.

Take one of our two free self-tests, about two minutes each, then talk to us about the results. With the launch offer, members get ten one-hour video calls and two site visits a year.

Let's talk about NIS2 at your port

Leave your e-mail: we answer within one working day, and what you share stays between us.

Contact us in confidence

Take the 2-minute test