Industries · Logistics and transport
Cybersecurity in logistics and transport: NIS2 and customer questionnaires
NIS2 in Poland (KSC) lists air, rail and maritime carriers, ports, the manager of national roads (GDDKiA) and ITS service providers. Road hauliers, freight forwarders and warehouse operators are usually not on that list, but their customers are, and they send security questionnaires. We help you find out where you stand and answer with evidence.
// In short
In the act itself, or in the supply chain
Annex 1 of the Polish KSC Act covers air, rail, water and road transport, but for road transport only the manager of national roads (GDDKiA) and ITS service providers. A road haulier, forwarder or warehouse operator comes into scope only if it is, for example, a postal operator, transports waste, or distributes food or chemicals wholesale.
As of 24 September 2026. Source: Dz.U. 2026 item 252, Annexes 1 and 2 (in Polish).
Transport under the KSC Act
| Mode | Who the act lists |
|---|---|
| Air | Air carriers, airport managing bodies, undertakings providing services to carriers at airports and security screening, the air navigation service provider |
| Rail | Railway infrastructure managers, licensed railway undertakings, operators of service facilities if they are also railway undertakings |
| Water | Maritime and inland waterway shipowners, port managing bodies and port facilities, undertakings in the port in NACE class 52.22 (service activities incidental to water transportation), the vessel traffic service (VTS) |
| Road | The manager of national roads (GDDKiA) under Article 19(2)(1) of the Public Roads Act, and ITS service providers. Road hauliers are not listed here |
Close to logistics: sectors in Annex 2
- Postal services: postal operators under the Polish Postal Law.
- Waste management: including waste transport, for companies in the waste register (Article 49 of the Waste Act) for which this is the main activity.
- Food: food businesses in wholesale distribution.
- Chemicals: distribution of substances and mixtures under REACH.
A company in an Annex 1 sector is an essential entity if large and an important entity if medium-sized. A company in an Annex 2 sector is an important entity from the medium-sized threshold. In Germany, postal and courier services are named explicitly in the NIS2 implementation (Annex 2 of the BSIG). Sources: Dz.U. 2026 item 252, Article 5 (in Polish), BSIG, Annex 2 (in German).
// Customer questionnaires
Not in the act, but the questionnaire still came
A manufacturer, food wholesaler or port covered by the KSC Act has to manage supply chain security (Article 8(1)(2)(e)) and take its suppliers' vulnerabilities and product quality into account (Article 8(2)). So it asks you about MFA, backups, incident notification times, subcontractor access and integrations with its systems.
- We link every answer to evidence: a configuration, a log or a dated test result
- Where a control is missing, we say so and give a date, instead of a claim with nothing behind it
- Answers go into a library, so the next questionnaire starts from there
Risks customers ask about and the missing evidence
Integrations with customers and carriers
EDI, APIs and partner portals, often one access key shared by several companies. What's missing: a register of connections with an owner, the data exchanged and the date of the last key rotation.
Subcontractor and driver accounts, shared warehouse logins
TMS and WMS access for outside firms, mobile apps, one login per shift for the handheld scanners. What's missing: an account list with last login dates and MFA status.
Continuity of the WMS and TMS
When the WMS is down, the warehouse stops, and the manual fallback plan exists only on paper. What's missing: a restore test result with the time it took to resume work.
Remote access for system vendors
The vendor of the WMS, the sorter or the telematics connects whenever it wants. What's missing: session approval, a named account and a log.
Many sites, different standards
Each warehouse has its own network, its own administrator and its own version of the procedures. What's missing: one asset and supplier register for the whole company.
Start with the questionnaire on your desk
The first questionnaire from a customer covered by NIS2 shows what's missing better than a generic audit. The same list will be useful if you later come into scope yourself.
// How we help
Services that fit logistics
01Questionnaires
Answers backed by evidence
We answer the customer's security questionnaire with you, item by item, and leave you a library of answers.
Compliance and auditFirst step, 5 weeks
One questionnaire, answered with evidence
- Evidence for every answer where the control works
- List of gaps with owners and dates
- Answer library for the next questionnaires
Key deliverable: the questionnaire sent back to the customer, with evidence wherever the control works
02Integrations
Tests of APIs, portals and mobile apps
We test customer integrations, the shipment tracking portal and the driver app: permissions, API keys and whether one partner can see another partner's data.
- Data separation between partners
- Scope and rotation of API keys
- Shipment tracking portal and driver app
03Continuity
A continuity plan for the warehouse
Business impact analysis, a manual fallback plan and a WMS or TMS restore test with a result you can show your customer.
Business continuity04KSC
When the act covers you
For ports, rail, postal operators and companies in Annex 2 sectors: ISMS, asset and supplier register, incident handling and management training.
NIS2 compliance in Poland
// Scope
What we do, and what we don't
We agree the scope and date in writing before we start.
We do
- Classification: whether the KSC Act covers you, and in which category
- Evidence-based answers to customer security questionnaires
- Tests of APIs, portals and mobile apps
- A test of the warehouse business continuity plan
We don't
- A "yes" in a questionnaire where the control is not in the system
- Fleet monitoring or telematics services
- Reselling tool licenses
We designed FutureCode Evidence Box for logistics and transport, among other industries: it collects evidence from systems in read-only mode and prepares an evidence index you can show your customer.
// FAQ
Questions from logistics
We are a trucking company. Does the KSC Act cover us?
For road transport, the act lists only the manager of national roads (GDDKiA) and ITS service providers, so hauling freight usually isn't enough. Check your other activities, though: postal services, waste transport and wholesale distribution of food or chemicals are in Annex 2. If you are at least a medium-sized company, you are then an important entity.
A customer under NIS2 sent us a questionnaire. Must we answer?
The law puts the obligation on your customer, not on you. But your customer has to manage supply chain risk, so the requirements will end up in your contract. It is better to answer truthfully, with evidence and a date for anything missing, than to write "yes" and explain yourself after an incident.
We operate in a port. Does that change anything?
It can. In water transport, the act lists port facility operators and undertakings that carry out, in the port, activities supporting maritime transport in NACE class 52.22. A medium-sized company is then an important entity, a large one an essential entity. Warehousing and cargo handling may fall under other activity codes, so we check your codes and your contracts with the port.
We provide ITS services for roads. Is that already in scope?
ITS service providers as defined in the Polish Public Roads Act are in Annex 1. If you are at least a medium-sized company, the Chapter 3 obligations apply to you from 3 April 2027. As of 24 September 2026.
Where do we start if the act doesn't cover us?
With the questionnaire you already have, the integrations with your largest customers and a WMS or TMS restore test. These are the three things customers ask about most, and the three pieces of evidence you will also need if NIS2 ever applies to you.
From the blog: processes and access
Send us the questionnaire you have to answer
In 30 minutes we check whether the KSC Act covers you and which questions you can close with evidence right away.
Book a 30-minute callPrefer the scope in writing?
Tell us about your company and the questionnaire you received. We will send back the scope and date of the first step. We reply within one business day.
Request the first step