NIS2 and Logistics: Controlling IT Assets Distributed Across Multiple Sites

In June 2017, NotPetya hit Maersk, the world’s largest shipping company. Within 7 minutes, malware spread across the entire global network: 49,000 laptops, 3,500 servers, and 1,200 applications rendered useless. Port terminals across 76 ports halted operations. Total cost: $300 million. Maersk had to reinstall its entire IT infrastructure in 10 days — and only succeeded because they found a backup copy in Ghana, where a power outage had disconnected a server from the domain just before the attack.

Logistics and transport depend on massively distributed IT infrastructure. And that makes them especially vulnerable.

Why NIS2 applies to logistics and transport

NIS2 classifies transport as an essential entity (Annex I), covering air, rail, maritime, and road transport. This includes transport operators, infrastructure managers, port and airport authorities.

• Asset inventory: mandatory for all IT devices at every site, warehouse, vehicle, and terminal
• Incident management: 24/72-hour notification linked to affected assets
• Operational continuity: plans identifying which assets are critical to maintaining the supply chain
• Fines up to 10 million euros or 2% of annual turnover

Real incidents in logistics and transport

• Port of Antwerp, 2011-2013: A criminal organization hacked port terminal systems to track drug-laden containers. They installed unauthorized hardware devices on the network that went undetected for two years because nobody inventoried network equipment.
• Deutsche Bahn (Germany), 2017: WannaCry hit passenger information systems. Station screens displayed ransom messages instead of schedules. Ticketing systems went offline.
• Expeditors International, 2022: The logistics giant suffered a cyberattack that paralyzed global operations for three weeks. The company processed shipments manually, causing massive delays and $60 million in losses.

Why exhaustive asset control is essential

• Assets are geographically dispersed. A typical logistics operator has devices in warehouses, distribution centers, regional offices, vehicles, and port terminals. Without a centralized inventory, you don’t know what’s at each location.
• Devices move with the cargo. Barcode scanners, driver tablets, GPS devices — they change vehicles, warehouses, and operators. The trail is lost without a tracking system.
• Warehouse networks are complex. Industrial WiFi, RFID readers, WMS systems, label printers, handheld scanners — each warehouse is its own IT ecosystem with dozens of connected devices.
• Third parties add assets to your network. Subcontracted carriers, terminal operators, management software vendors — all connect devices to your infrastructure. You need to know what’s connected.

What you need to control

• Warehouse devices: Barcode scanners, RFID readers, RF terminals, label printers
• Fleet devices: GPS trackers, driver tablets, fleet cameras, digital tachographs
• Network infrastructure per site: Switches, routers, WiFi access points, firewalls — per warehouse and office
• Management systems: WMS, TMS, ERP servers at each location or in cloud
• Terminal equipment: Automated cranes, access control systems, security cameras

Metrica Control gives you visibility over all your IT assets, wherever they are. From the warehouse scanner in Rotterdam to the GPS on a truck crossing Europe. Centralized inventory, by site, with full NIS2 traceability.