Cybersecurity Act
NIS2 has been Dutch law since 15 August: what does the Cybersecurity Act mean for transport and logistics?
Since 15 August 2026, the Dutch Cybersecurity Act (Cyberbeveiligingswet) has been in force in the Netherlands, transposing the European NIS2 Directive into Dutch law. As of that date, more than 8,000 organisations face new obligations in the area of digital resilience. The transport sector is explicitly within scope.
For transport and logistics companies, this is about much more than antivirus software, strong passwords or securing office computers.
If one link in the chain fails, it can have an immediate impact on operations. So the relevant question is not just: is our IT properly secured?
But above all: which digital systems and integrations do we need to keep our logistics operation running, and what happens if one of them fails?
Snelle navigatie:
- What changed on 15 August 2026?
- What obligations does the Cybersecurity Act bring?
- Start with the digital landscape of your logistics operation
- TMS and WMS: what happens when a core system goes down?
- EDI and API integrations deserve separate attention
- Don’t forget on-board computers, scanners and mobile devices
- Logistics software suppliers may also be indirectly affected by NIS2
- What can logistics organisations do now?
- Conclusion
Co-founder and director of Adaption, expert in logistics software and process digitalisation
What changed on 15 August 2026?
The Cybersecurity Act, abbreviated as Cbw, implements the European NIS2 Directive in the Netherlands and replaces the previous Network and Information Systems Security Act (Wbni). The Dutch Senate approved the act on 7 July 2026, and the new obligations have applied since 15 August 2026. Organisations must determine for themselves whether they fall within the scope of the Cbw. The act targets essential and important entities in eighteen sectors, one of which is transport.
Whether an individual transport or logistics company actually falls under the act depends on factors such as the type of activity and the size of the organisation. Simply being active in logistics is therefore not enough to determine whether the act applies. The Dutch National Cyber Security Centre (NCSC) offers a self-assessment for this purpose. For many organisations, that is the logical first step.
What obligations does the Cybersecurity Act bring?
At its core, organisations that fall under the Cbw face three obligations:
- a registration obligation;
- a duty of care;
- a reporting obligation for significant incidents.
In addition, compliance is subject to supervision.
For logistics companies, the duty of care is the most relevant. The act does not just require individual systems to be secured. Organisations must take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems.
That starts with understanding where the operational dependencies lie.
Start with the digital landscape of your logistics operation
For many logistics organisations, the IT landscape has grown steadily over the years. A transport company, for example, doesn’t just have a TMS. The TMS is connected to various other systems, such as:
- an ERP or financial system;
- a WMS;
- on-board computers;
- driver apps;
- customer portals;
- EDI connections;
- API integrations;
- route planning;
- telematics;
- document management;
- customs systems;
- systems of customers and carriers.
It is precisely the connections between these systems that matter.
If the TMS stays available but the EDI link through which hundreds of transport orders arrive each day goes down, the primary process can still be affected. For NIS2, simply listing the software in use is therefore too limited. You also need to map the digital dependencies between systems.
TMS and WMS: what happens when a core system goes down?
For many logistics organisations, a TMS or WMS is part of the primary business process. If a TMS goes down, this can mean, for example, that:
- planners cannot process transport orders;
- trips cannot be adjusted;
- drivers do not receive new orders;
- transport documents are unavailable;
- status updates are not passed on to customers.
With a WMS, an outage can mean that employees don’t know where goods are located, which batches are available or which orders need to be picked. The risk analysis required under the Cbw should therefore not only consider the likelihood of a cyber incident. The operational impact is at least as important. Ask questions such as:
- How long can we work without the TMS?
- Can orders be processed manually for a while?
- Is the information needed for that available outside the system?
- What happens to the warehouse if the link between ERP and WMS fails?
- How quickly can a backup be restored?
- Who decides which processes are restored first?
EDI and API integrations deserve separate attention
EDI and APIs make logistics processes more efficient, but they also increase the digital dependency between organisations. A shipper automatically sends a transport order. The TMS processes it. Transport statuses are then sent back, and the financial system receives data for invoicing. If such a connection is misused, an incident can also spread across organisations. That is why questions about access management and authentication are relevant:
- Which external parties are allowed to send data?
- Which API credentials exist?
- When were they last changed?
- Which integrations are still actually in use?
- Is unusual traffic detected?
- What happens if an external integration is compromised?
Legacy integrations deserve particular attention. In logistics environments, integrations sometimes remain in place for years because a customer or partner keeps using the same message structure.
A clear overview of interfaces and access rights is therefore part of sound risk management.
Don’t forget on-board computers, scanners and mobile devices
Network and information systems are not only found in a server room. In logistics, digital access points are everywhere in the operation, such as on-board computers in trucks, drivers’ smartphones, handheld scanners in the warehouse, tablets, terminals at loading and unloading locations, and mobile printers.
A lost scanner or phone may seem like a minor incident. But when a device has direct access to operational systems, access management becomes important.
So check, for example, whether employees only have access to the information they need, whether accounts are closed immediately when someone leaves the company, and whether devices can be blocked remotely.
In addition to system security, the Cbw also names access management, asset management and personnel security as part of the duty of care.
Logistics software suppliers may also be indirectly affected by NIS2
Not every IT company falls directly under the Cbw. Even so, NIS2 can also affect suppliers outside its direct scope. When a software supplier provides services to an organisation that does fall under the Cbw and has access to critical network or information systems, that customer may impose stricter security requirements.
The NCSC explicitly states that Cbw organisations may require cybersecurity measures from their direct suppliers and service providers. As a result, NIS2 can spread further through the logistics chain.
A carrier may face requirements from a large customer. A logistics company may impose additional requirements on its software supplier. That software supplier may in turn make stricter agreements with its hosting provider. Supply chain security thus literally becomes a chain-wide issue.
What can logistics organisations do now?
For organisations that fall under the Cbw, the act has applied since 15 August 2026, so preparation is no longer a future project. A practical initial assessment can consist of five steps:
- Check whether your organisation falls under the Cbw. Use the information and self-assessment provided by the NCSC and the Dutch Authority for Digital Infrastructure (RDI).
- Map critical systems and integrations. List your TMS, WMS, ERP, customer portals, EDI, APIs, on-board computers and other operational systems.
- Record dependencies. Determine which processes come to a halt when a system, integration or external service is unavailable.
- Identify critical suppliers. Check which IT partners have access to systems or are essential to the continuity of your operation.
- Test incident response and recovery. Having a backup is not the same as being able to recover. Test how quickly essential logistics processes can actually be resumed after an incident.
Conclusion: NIS2 makes the entire logistics IT landscape relevant
The Cbw makes cybersecurity much more concrete for transport and logistics companies. It is not just about securing a server or laptop. A logistics operation now consists of a network of TMS, WMS, ERP, EDI, APIs, mobile devices, on-board computers, customer portals and external IT suppliers. It is precisely this interdependence that deserves attention.
An organisation can secure its own TMS perfectly and still come to a standstill if a crucial integration, supplier or external platform fails.
The most important step is therefore to map the logistics software landscape not just technically, but in terms of processes: which systems are essential, who has access, what do they depend on, and how does the operation keep running when one link fails?
Since 15 August 2026, for organisations that fall under the Cbw, this is not just good risk management. It is part of their legal responsibility for digital resilience.
Bronnen en achtergrond
- Government of the Netherlands, Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf vandaag van kracht, 15 August 2026. Government of the Netherlands, entry into force of the Cybersecurity Act
- National Cyber Security Centre, Cyberbeveiligingswet (NIS2). NCSC, Cybersecurity Act NIS2
- National Cyber Security Centre, Valt mijn organisatie onder de Cyberbeveiligingswet? NCSC, scope of the Cybersecurity Act
- National Cyber Security Centre, Zorgplicht. NCSC, duty of care under the Cybersecurity Act
- National Cyber Security Centre, Meld incidenten onder de Cyberbeveiligingswet. NCSC, reporting obligation under the Cybersecurity Act
- National Cyber Security Centre, De Cyberbeveiligingswet en toeleveranciers. NCSC, NIS2 and suppliers