NIS2 in logistics: 5 steps from gate readers to compliance evidence

Guidance on NIS2 in logistics often starts with IT systems: TMS platforms, APIs and cloud contracts. The gate gets less attention. These five steps turn gate, yard and dock access into evidence you can show an auditor.

1. Confirm whether NIS2 applies to your logistics site

Yes, if your organisation carries out a transport activity that NIS2 lists and meets its size criteria. Warehousing alone may not be a listed activity. Each member state transposes NIS2 into national law, and some national readings are narrower than others. Check your national law, or ask your legal adviser, before you decide.

Your classification as an essential or important entity then decides which obligations and audit expectations apply. Confirm it first. Every later step scales with it.

NIS2 is the EU directive that sets cybersecurity risk management and incident reporting duties for essential and important entities. Primion’s NIS2 overview covers the wider picture.

2. Turn gate readers into NIS2 compliance evidence

A reader that logs entries does not automatically produce compliance evidence. The difference is retrieval. Can you show, on request, who entered, when and on what authorisation, without rebuilding it by hand?

A gate log is evidence when you can show who, when and on what authorisation within minutes. Use that as your test for NIS2 audit evidence from access logs.

Until you can retrieve the answer in minutes, not days, a gate reader is only a data source. Every later step depends on this.

You can also combine access control and visitor management to keep one overview of who is on site.

3. Extend NIS2 access oversight to subcontractors and carriers

NIS2 asks entities to manage supply chain security risk. For logistics, that includes physical access for hauliers, subcontracted drivers and third-party carriers, not only your own staff. How far it reaches depends on your risk assessment and national law.

A subcontractor with unmonitored gate access is a compliance gap in a high-vis vest. Give carrier and subcontractor access the same visibility and review cadence as your own workforce.

4. Make yard and dock access retrievable on demand

Gate access is only the first boundary. What happens once a trailer reaches the yard, the loading dock (ramp) or a specific bay should meet the same standard.

If answering “who was at Dock 3 last Tuesday?” takes a day, you will only find that gap when an auditor asks. Hold yard and dock data to the same on-demand standard as the gate.

See how Primion for logistics and distribution approaches gates, yards and ramps.

5. Connect physical incidents to your NIS2 reporting clock

Under Article 23 of Directive (EU) 2022/2555, the reporting clock starts when you become aware of a significant incident. It does not wait for the write-up. The staged deadlines are:

• Early warning: without undue delay, and in any event within 24 hours of becoming aware.
• Incident notification: within 72 hours of becoming aware.
• Final report: within one month of the incident notification.

A forced entry or a tailgated vehicle at the gate or in the yard can feed the same clock as a cyber incident. That applies when it affects your network and information systems or services. Your national law sets which authority receives the report.

Two separate reporting tracks, one physical and one cyber, can cost you time you do not have. Converged physical and cyber security unifies physical, OT and IT security. It is one way to bring both tracks into a single view.

Where to start

These steps do not start with new gate hardware. They start with treating what your gate already captures as evidence, not as a log nobody checks until something goes wrong.

Start with step two, this week. Pull last week’s gate log and time how long it takes to answer: who entered on Tuesday at 3pm?

If it takes minutes, you are most of the way there with NIS2 in logistics. If it takes a phone call and a spreadsheet, you have found your starting point.

Protect what matters at the gate, in the yard and on the ramp.

Explore Primion for logistics and distribution

Discover our solutions

Frequently asked questions

Does NIS2 apply to logistics and warehouse companies?

It depends on your activity, your size and your national law. NIS2 lists certain transport activities, and warehousing alone may not be listed. Each member state transposes NIS2 itself, and some national readings are narrower. Check step one, then confirm with your legal adviser.

Does NIS2 cover physical gate access, or just IT systems?

Partly yes. Article 21 of Directive (EU) 2022/2555 asks for risk management measures based on an all-hazards approach. That approach protects network and information systems and their physical environment. Gate, yard and dock access belongs in scope where it protects those systems. Read more on what NIS2 means for physical access control.

Do subcontractors and carriers need the same access oversight as our own staff?

Plan for it. NIS2 asks entities to manage supply chain security risk, and carriers with physical access are part of that risk. The exact reach depends on your risk assessment and national law. Give carrier and subcontractor credentials the same visibility and review cycle as your own workforce.

Do we need new gate hardware to meet these requirements?

Usually not. Your readers and logs often already capture the data. The gap is typically retrieval: producing a specific access record on demand.