Transport & mobility · NIS2

Transport & mobility — NIS2: the obligations of an essential sector

Transport is an essential sector under NIS2. Operators must secure their supervision and ticketing systems and notify incidents, aligning NIS2 with existing sector-specific security regimes. This guide details qualification, measures and notification.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: NIS2.
  • Transport operators, infrastructure managers and ticketing system operators above the thresholds are essential entities.
  • Applying the measures of Article 21.
  • Securing supervision and ticketing systems.
  • Notify incidents.
  • Up to €10M or 2% (essential entities), with prior supervision and executive liability.

Regulatory deadlines

The key dates of this regulation.

January 2023

Entry into force (EU directive)

In force

October 2024

Transposition deadline (EU)

In force

2026

French transposition (Resilience Act)

In force

What does NIS2 cover?

NIS2 classifies air, rail, road and maritime transport among the essential entities in Annex I. The measures set out in Article 21 apply to information systems used for supervision, ticketing and operations.

Sector-specific security regimes coexist and must be aligned with NIS2.

Is the 'Transport & mobility' sector concerned?

Transport operators, infrastructure managers and ticketing system operators above the thresholds are essential entities.

Technology providers in the sector are often indirectly affected, through the requirements of operators subject to NIS2.

Detailed obligations

Apply the measures of Article 21

Security policy, incident management, access control, encryption, continuity.

Secure supervision and ticketing systems.

Protect critical systems for the operation and trading of securities.

Notify incidents

Issue an early warning then reports according to deadlines.

Articulate with sectoral frameworks

Coordinating NIS2 and aviation/rail security frameworks.

Govern

Having senior management champion the programme.

Sanctions & risks

Up to €10M or 2% (essential entities), with ex ante supervision and executive liability. A disruption to systems immediately impacts mobility.

Application timeline

  • 1Directive. Adopted end of 2022.
  • 2France. Transposition in progress; essential regime to anticipate.

Common mistakes in the sector

  • 1Ticketing neglected. Underestimating the criticality of sales systems.
  • 2Sector-specific overlaps. Duplicating NIS2 and sectoral regimes.
  • 3Fragile continuity. Failing to test plans.
  • 4Absent leadership. Limiting security to technical measures.

Practical case

A transport operator suffers an attack that paralyses its ticketing system. As an essential entity, it notifies the relevant authority and demonstrates its measures. It strengthens the security of its sales and supervision systems, aligns its framework with the sectoral regime and tests its continuity.

Compliance roadmap

  1. 1

    Qualify. Confirm essential status.

  2. 2

    Map. Mapping supervision, ticketing and operations.

  3. 3

    Secure. Deploy measures and incident response plan.

  4. 4

    Articulate. Coordinate with sectoral regimes.

  5. 5

    Notify. Equip alerting and reporting.

Frequently asked questions

Yes: aviation, rail, road, maritime.

Back to the Transport & mobility guideTransport & mobility & AI Act Transport & mobility & Data Act Transport & mobility & GDPR

Take action on NIS2

Free assessment or a chat with an expert dedicated to transport & mobility.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the transport & mobility sector secured their compliance with DCO.

See testimonials