Transportation and logistics: service continuity across IT, OT and the supply chain

A sector of high criticality

The NIS2 Directive lists air, rail, water and road transport among the sectors of high criticality. In Italy it is implemented by Legislative Decree 138/2024: proportionate risk-management measures, notification of significant incidents and direct accountability of management bodies, which must approve the measures and receive training.

Where the risk concentrates

• Operations, signalling systems and control rooms, where IT and OT coexist.
• Ticketing, payments and passenger information, directly exposed to the public.
• Connected fleets and on-board telematics, with remote updates and access.
• Ports, inland terminals and warehouses, with logistics systems integrated with customers and partners.
• Suppliers and maintainers with system access, the first attack vector in the supply chain.

Priorities

1. Map essential services and the dependencies between IT, OT and suppliers.
2. Segment operational, on-board and office networks.
3. Control and log remote access by suppliers and maintainers.
4. Monitor systems 24/7, with procedures ready for the early warning within 24 hours and the notification within 72 hours required by NIS2.
5. Run joint exercises with the control room, operations staff and passenger communication.