NIS2 in Transport and Logistics: Public Transit, Rail, Freight

Main article: NIS2 implementation in Germany — covering scope, measures under Section 30 BSIG, management liability under Section 38 BSIG, reporting obligations and fines in detail.

1. Who is affected?

Only those who meet two conditions at the same time are affected (§ 28(2) no. 3 BSIG): allocation to an entity type specified in Annex 1 or Annex 2 BSIG and reaching the size thresholds. Company size alone does not trigger coverage.

Annex 1 no. 2 BSIG (transport sector) names the following entity types in column D: air transport — air carriers under Art. 3 no. 4 of Regulation (EC) No 300/2008, airport managing bodies and airports under Directive 2009/12/EC including operators of ancillary installations, ATM/ANS providers; rail transport — infrastructure managers under § 2(6) and (6a) AEG, railway undertakings under § 2(3) AEG including operators of a service facility; water transport — passenger and freight transport companies in inland, maritime and coastal shipping, managing bodies of ports including their port facilities, operators of an installation or system for the safe operation of a waterway; road transport — operators of installations or systems for traffic management as well as operators of intelligent transport systems under § 2 no. 1 IVSG.

Freight forwarders and logistics service providers are not named in this list. They are only covered if they themselves meet one of the entity types named — for instance as a freight transport company in inland, maritime or coastal shipping, or as a railway undertaking — or if they qualify as an important entity via Annex 2 no. 1 BSIG (postal and courier services: providers of postal services under § 3 no. 15 of the German Postal Act (PostG) including providers of courier services). Having logistics IT in place is not a statutory criterion. Likewise, pure bus operations in public transit are not an entity type of their own; public transit operators are covered through rail transport insofar as they operate railway infrastructure or are railway undertakings under § 2(3) AEG.

Important: once the conditions of the entity type are met, the size criteria are alternatives, not cumulative (§ 28(2) no. 3(a) and (b) BSIG). Covered is anyone who employs at least 50 people or has an annual turnover and an annual balance sheet total each exceeding EUR 10 million. A railway undertaking with 60 employees and EUR 5 million turnover is therefore covered — the turnover threshold does not additionally have to be reached. Operators of critical installations in the transport sector (KRITIS) qualify as particularly important entities irrespective of this.

2. Which sub-sector applies to your company?

What matters is the specific statutory connection, not the industry label: the transport sector consists of four sub-sectors, and each refers to its own sector-specific legal definitions. The allocation is no formality — § 33(1) BSIG requires the relevant sector under Annex 1 or 2 to be stated on registration.

The difference is not cosmetic: only Annex 1 types can move up into the 'particularly important' category via § 28(1) no. 4 BSIG; that provision does not cover Annex 2 types. Anyone combining several activities — rail operations, port handling and parcel delivery within the same group — assesses the allocation per entity, not per group.

3. Particularly important or important — the classification

The classification determines the intensity of supervision and the range of fines, and in the transport sector it follows three routes: one independent of size and two dependent on size. Further size-independent special cases under § 28(1) BSIG — qualified trust service providers, top-level domain name registries, DNS service providers and certain providers of telecommunications networks and services — lie outside this sector.

Two pitfalls occur particularly often in transport and logistics. First, turnover alone is never sufficient: § 28(1) no. 4(b) BSIG requires turnover above EUR 50 million and in addition a balance sheet total above EUR 43 million; only the employee figure of 250 or more works as a standalone criterion. Second, there is no upper employee limit for important entities — a parcel service provider with several thousand employees that can only be allocated to the Annex 2 type of postal and courier services remains an important entity and does indeed fall within the scope. For calculating employee numbers, turnover and balance sheet total, Recommendation 2003/361/EC applies with the exception of Art. 3(4) of its Annex (§ 28(4) BSIG); group affiliation may bring linked enterprises into the calculation — the decisive check point for municipal transport operations within municipal utility structures.

4. OT/IT convergence

Bringing operational technology and IT together is not a separate statutory obligation under the BSIG; it works through several areas of the general catalogue of measures — the control layer must be expressly considered within it.

Transport control systems (ETCS, interlockings, signals) were historically separated from IT. Convergence has turned them into a cyber risk — IEC 62443 standard.

§ 30(1) BSIG requires appropriate, proportionate and effective technical and organisational measures to avoid disruptions to the availability, integrity and confidentiality of IT systems; compliance must be documented. The catalogue in § 30(2) BSIG names ten areas: (1) policies on risk analysis and information system security, (2) incident handling, (3) business continuity with backup management, disaster recovery and crisis management, (4) supply chain security, (5) security in acquisition, development and maintenance, (6) assessment of the effectiveness of the measures, (7) basic training and awareness measures, (8) cryptography and encryption, (9) personnel security and access control, (10) multi-factor authentication, continuous authentication and secured communication. Practitioner recommendation: in operations with control and signalling technology, areas 1, 3, 9 and 10 in particular are answered separately for the control layer, because different restart times apply there than in office IT; the depth of implementation remains risk-based under § 30(1) BSIG.

Practitioner recommendation: under § 30(2) sentence 1 BSIG the measures are to reflect the state of the art and take into account the relevant European and international standards; the provision does not name any specific family of standards. A sector-specific standard such as IEC 62443 is therefore one way of justifying appropriateness, not a legally prescribed form of evidence. The term 'cyber hygiene', incidentally, does not come from the BSIG but from Art. 21(2)(g) of the NIS2 Directive (Directive (EU) 2022/2555).

5. Incidents: when the reporting obligation applies

Typical scenarios in transport are a software fault in interlocking technology or a phishing attack on a port operator's IT.

Whether such an event is subject to reporting is decided solely by the statutory threshold. What must be reported is the significant security incident under § 2 no. 11 BSIG: a security incident that has caused or can cause serious operational disruption to services or financial losses for the entity, or that has affected or can affect other natural or legal persons through considerable material or non-material damage. Each of the two alternatives is sufficient in itself, and both also cover the mere possibility of causation — damage that was averted therefore does not automatically exclude the reporting obligation.

Important for transport operations: EU Implementing Regulation 2024/2690 does specify this threshold with quantitative criteria (including the number of users affected, financial impact, duration), but only for certain digital entity types such as DNS service providers, TLD name registries, cloud and data centre services, CDN, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers (cf. § 30(3) BSIG). For entities in the transport sector, the definition in § 2 no. 11 BSIG applies until a statutory instrument is issued under § 56(5) BSIG — a numerical threshold on which the reporting decision could be based does not currently exist for this sector.

Practitioner recommendation: because the threshold is formulated qualitatively, the assessment logic belongs in the incident response playbook in advance — with triggers drawn from your own operations and a named person who makes the reporting decision. Anyone who only starts discussing interpretation once an incident occurs uses up the 24-hour deadline.

6. Supply chain audit

Supply chain security is a separate area of obligation (§ 30(2) no. 4 BSIG) — in transport it mainly concerns manufacturers and maintenance service providers for control and signalling technology.

OEMs (Siemens Mobility, Alstom, Bombardier) plus IT service providers. Specific requirements because of safety criticality.

The obligation falls on the entity itself, not on the supplier: you must control the security of your supply chain even if the manufacturer is not itself subject to the BSIG. In practical experience, area 4 is a frequent weak point — typically because cybersecurity clauses are missing from contracts. Four building blocks have become established in practice (a practitioner recommendation, not a statutory list):

• Supplier assessment with risk classification — separating critical from non-critical suppliers.
• Cybersecurity clauses in the standard contract framework instead of in individual negotiations.
• Right to audit for critical suppliers.
• Contractual incident notification by the supplier, usually within 24 hours — so that your own 24-hour deadline under § 32(1) no. 1 BSIG remains achievable.

For transport operations there is the added difficulty that manufacturers' maintenance access reaches into the control layer — this access is both supply chain (§ 30(2) no. 4 BSIG) and access control (§ 30(2) no. 9 BSIG) at the same time.

7. Incident reporting routes

In Germany, a significant security incident triggers a staged reporting chain to the joint reporting office of the BSI and the BBK — 24 hours, 72 hours, one month (§ 32(1) BSIG); the stages concern the same incident and are not alternatives.

The BSIG does not provide for a parallel reporting route to the Federal Railway Authority (Eisenbahn-Bundesamt, EBA) or the Federal Ministry of Transport; whether sector-specific reporting obligations towards transport authorities exist alongside it must be checked separately.

The 24-hour clock runs from becoming aware, not from the start of the incident — and it also runs at night and at weekends. Practitioner recommendation: round-the-clock availability through internal on-call duty or an external SOC service provider is the usual way of meeting this deadline organisationally; the law does not prescribe any particular operating model.

8. Registration with the BSI and evidence of implementation

Registration is a standalone obligation and not part of risk management: particularly important and important entities register no later than three months after they first or again qualify as such, using a registration facility set up jointly by the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK) (§ 33(1) BSIG). The BSI points out that the statutory registration deadline has already expired; anyone who has missed it registers subsequently — the obligation continues to apply.

What has to be submitted is the name including legal form and, where applicable, commercial register number, the address and current contact details including email address, public IP address ranges and telephone numbers, the relevant sector under Annex 1 or 2 — this is where the sub-sector allocation from section 2 pays off — the list of EU Member States in which services are provided, and the competent federal and state supervisory authorities. Changes must be submitted without undue delay, at the latest two weeks after becoming aware of them (§ 33(5) BSIG). Operators of critical installations register by way of derogation under § 8 of the German KRITIS Umbrella Act (KRITIS-Dachgesetz) (§ 33(2) BSIG); if an entity fails to comply with its registration obligation, the BSI may carry out the registration itself (§ 33(3) BSIG).

Registration must be kept strictly separate from ongoing evidence. Under § 39(1) BSIG, the periodic obligation to provide evidence through security audits, reviews or certifications applies only to operators of critical installations: at a point in time set by the BSI, at the earliest three years after they first qualify as the operator of a critical installation, and every three years thereafter; the results including any security deficiencies identified must be submitted. Particularly important and important entities without a critical installation instead owe documentation under § 30(1) BSIG: what must be documented is compliance with the measures, not merely their existence.

9. Management and the range of fines

Responsibility for the risk management measures lies with the management itself and cannot be delegated: § 38(1) BSIG obliges management to implement the measures under § 30 and to supervise their implementation — both, not just one of the two. In addition there is the obligation to take part in training regularly (§ 38(3) BSIG); the law says 'regularly', and the specific frequency is a practical decision, not a statutory deadline.

Liability under § 38(2) BSIG follows the rules of the company law applicable to the legal form; under the BSIG itself, management is liable only subsidiarily, namely where the relevant company law contains no such liability rule (§ 38(2) sentence 2 BSIG). Unlike the Directive, the BSIG has no blanket 'whichever is higher' rule: the turnover variant applies only from a total turnover of more than EUR 500 million and only for the breaches designated in § 65(6) and (7) BSIG; total turnover is the sum of all worldwide revenues of the undertaking to which the entity belongs in the financial year preceding the authority's decision (§ 65(8) BSIG). If a data protection supervisory authority has already imposed a GDPR fine for the same conduct, an additional fine under the BSIG is excluded (§ 65(11) BSIG) — relevant, for example, where an incident also affects passenger data.

10. Austria: NIS2 in transport under the NISG 2026

This article describes the German implementation (BSIG, BSI, KRITIS thresholds under the KRITIS Regulation (KritisV)). In Austria, NIS2 applies in the transport sector through the NISG 2026 (BGBl. I Nr. 94/2025). Timing: the NISG 2026 was promulgated on 23 December 2025 but only becomes applicable on 1 October 2026 — nine months after promulgation, on the first day of the following month (§ 51(1) and (2) NISG 2026). As at the date of this article, Austrian rail, public transit and logistics companies therefore have no effective obligations under the NISG 2026; the references below describe what applies from 1 October 2026. The obligations are largely the same in substance, but the references and authorities differ:

• Supervision: the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) instead of the BSI — the Federal Office for Cybersecurity, an authority directly subordinate to the Federal Minister of the Interior with nationwide competence and its seat in Vienna (§ 3a(1) and (2), § 3b(3) NISG 2026); supervision and enforcement under §§ 38 and 39 NISG 2026.
• Entity types covered: Annex 1 NISG 2026 corresponds to Annex I of the NIS2 Directive, Annex 2 to Annex II (§ 2 nos. 1 to 18; transport = no. 2, postal and courier services = no. 12). There, too, the freight forwarder is not an entity type of its own — allocation to an Annex 1 or Annex 2 type is, under § 24 NISG 2026, a precondition for classification as an essential or important entity.
• Classification: large undertakings within the Annex 1 types are essential entities (§ 24(1) no. 3); Annex 1 and Annex 2 types operating a large or medium-sized undertaking are important entities (§ 24(2) no. 1).
• Risk management measures: § 32 NISG 2026 (the counterpart to Section 30 BSIG) — the same catalogue in the same order, § 32(4)(a) to (j) ((d) = supply chain security, (g) = cyber hygiene and training).
• Reporting: a three-stage scheme of 24 h / 72 h / 1 month to the competent CSIRT under § 34 NISG 2026 — competence lies with the sector-specific CSIRT or, in the absence of one, with the national CSIRT (§ 34(1)); from there the report is forwarded to the Cybersecurity Authority. In Austria, sectoral differentiation exists only at CSIRT level (§ 8(3)), not in supervision.
• Registration: within three months with the Cybersecurity Authority under § 29 NISG 2026 — not through the joint BSI/BBK registration. Measured from entry into force on 1 October 2026, the deadline ends at the end of 2026 (§ 29(2) and (3)); changes to the core data must be notified within two weeks (§ 29(4)).
• Size thresholds: § 25(2) and (3) NISG 2026 — the same alternative criteria as in Germany (medium-sized undertaking: at least 50 employees or annual turnover above EUR 10 million and annual balance sheet total above EUR 10 million).
• Evidence of implementation: self-declaration within twelve months after the registration obligation arises; upon request, implementation must be demonstrated through an independent body (§ 33 NISG 2026), and the first request may be made at the earliest two years after entry into force. Essential entities must demonstrate operational and organisational implementation within two months of the request. In Germany, by contrast, the three-year evidence requirement under § 39(1) BSIG applies only to operators of critical installations.
• Management: § 31 NISG 2026 obliges the management bodies to ensure and supervise compliance with the risk management measures and prescribes participation in cybersecurity training — the NISG 2026 contains no express internal liability rule analogous to § 38(2) BSIG.
• Administrative fines: up to EUR 10 million or 2 % of worldwide annual turnover for essential entities (§ 45(2)), up to EUR 7 million or 1.4 % for important entities (§ 45(3)) — whichever amount is higher; other infringements up to EUR 50,000, and up to EUR 100,000 in the event of repetition (§ 45(4)). They are imposed by the district administrative authority (Bezirksverwaltungsbehörde) (§ 44(1)); supervision remains with the Cybersecurity Authority.

Purely German-specific are the BSI registration and the KRITIS thresholds under the KritisV. The three-stage reporting scheme of 24 h / 72 h / 1 month applies equally in both countries; with the range of fines the difference is finer than it looks: Austria adopts the EU maxima including the 'whichever amount is higher' rule (§ 45(2) and (3) NISG 2026), whereas the German turnover variant only applies from a total turnover of more than EUR 500 million and only for certain breaches (§ 65(6) and (7) BSIG). For groups with German and Austrian transport or logistics subsidiaries this means: separate registration in both countries, separate reporting routes (BSI/BBK as against the CSIRT), but a risk management system that can be used jointly.

11. Practical roadmap

The following sequence is a practitioner recommendation, not a statutory chain of deadlines — the only deadlines fixed by law are those named in sections 7, 8 and 10. It reflects the order in which the obligations can be worked through, because each step provides the basis for the next.