Air, rail, water and road transport now depend on digital systems that coordinate movement in real time: air traffic management, electronic interlocking and rail signalling, vessel traffic services in ports, intelligent road transport systems. Unlike other sectors, a disruption here does not only mean financial loss. It can mean halting traffic along entire corridors or, in extreme cases, putting passenger safety at risk. Interdependency with energy and communications amplifies the effect of any incident.
Directive (EU) 2022/2555 (NIS 2) lists transport in Annex I as a sector of high criticality and sets a common cybersecurity framework for infrastructure managers and for the entities providing traffic services. The obligations cover risk analysis, technical and organisational measures, incident reporting and continuity planning, including for operational systems and not only for administrative networks.
Legal framework
At European level:
- Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex
At national level (Romania):
- GEO no. 155/2024: Official Gazette no. 1332/2024
- Law no. 124/2025: Official Gazette no. 638/2025
- DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
- Order on disruption criteria and risk assessment: Official Gazette no. 776/2025
The Transport sector
Essential entities:
Air, rail, water and road transport undertakings, including airlines, airport managing bodies, air traffic management service providers, infrastructure managers, railway undertakings, port authorities, vessel traffic service operators and road authorities responsible for traffic management control.
- Airlines, airport managing bodies and air traffic management service providers
- Railway infrastructure managers and railway undertakings
- Port managing bodies and vessel traffic service operators
- Road authorities responsible for traffic management control
- Operators of intelligent transport systems
Sector-specific cyber threats
- Unauthorised access to traffic management and signalling systems
- Disruption of positioning and timing services used for navigation
- Ransomware affecting booking, freight or port community systems
- Attacks on the communications links between control centres and vehicles or vessels
- Manipulation of passenger and cargo information systems
- Compromise of remote diagnostics interfaces on rolling stock and vehicles
NIS 2 requirements for the transport sector
Mandatory measures:
- Inventory and classification of critical IT and OT assets
- Security policies approved at management level, with explicit responsibilities
- Network segmentation and separation of OT and IT communication channels
- Traffic monitoring and anomaly detection (IDS/IPS)
- Access control and multi-factor authentication, including for remote supplier access
- Incident response and business continuity plans, tested annually
- Cybersecurity training for operations and maintenance teams
- External security audits and attack simulations
- Monitoring of equipment and IT service suppliers
Critical interdependencies
- Total dependency on electricity supply for signalling, lighting and control systems
- Reliance on satellite positioning and time synchronisation
- Chain effects between modes, where a port stoppage propagates to rail and road
- Dependency on a small number of specialised signalling and traffic software suppliers
Securing transport systems protects not only continuity of service but physical safety. NIS 2 requires a proactive approach to cyber risk, and in a sector where operational systems and passenger safety are inseparable, degraded manual operation must remain a tested capability rather than a theoretical one.
The other sectors in this series
The NIS 2 Directive covers eleven sectors of high criticality. Each has its own essential entities, specific threats and mandatory measures.