Who it’s for
You move goods, mail or people, operate ports, railways, airports or warehouses. An outage of your IT stops supply chains far beyond your own company. This is why transport and postal and courier services are NIS2 sectors, and your customers ask about your information security. Complass helps you keep obligations and evidence in one account.
If the warehouse management or dispatch system fails, ramps, vehicles and customers come to a halt. Recovery and emergency operations must be planned.
Subcontractors, telematics, customer portals and customs: every interface is a possible way in for attackers.
Under NIS2 your customers have to take the security of their supply chain into account and therefore send you questionnaires and contract clauses.
Air, rail and water transport and road traffic management are listed in Annex 1, postal and courier services in Annex 2 of the German BSI Act. What counts is your activity and your company size.
Frameworks: NIS2 · ISO 27001 · KRITIS Umbrella Act · GDPR
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
Freight forwarding and road haulage. Pure freight forwarding and road haulage companies are not named as an entity type of their own in the BSI Act. They can, however, be covered through other activities, such as courier services, or as the operator of a critical facility, and are almost always asked for evidence as service providers in their customers’ supply chain. The applicability check helps you classify your company.
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Port facilities, terminal operations and shipping companies with strong interconnection and operational technology of their own.
Railway infrastructure and transport companies with signal boxes, control centres and passenger information.
Sorting centres, delivery and shipment tracking: important entity from medium size.
Often asked for evidence as your customers’ service provider: information security, contingency planning and data protection.
One management system for your obligations and the evidence your customers expect, with templates and action plan.
More about this featureAssess critical processes such as dispatch, warehousing and customs clearance, set recovery times and maintain contingency plans.
More about this featureIT, warehouse technology and network components of all sites in one place, with owners, protection needs and end of support.
More about this featureClassify service providers, request self-assessments and review evidence.
More about this feature
You use the frameworks for your sector individually; there is no logistics package of its own.
available
from €179 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
Pure freight forwarding and road haulage are not named as an entity type of their own in the BSI Act. If you also operate courier or parcel services, rail, water or air transport or a critical facility, NIS2 can apply. Regardless of that, many customers ask for evidence of your information security.
Operators of critical facilities in the transport sector must strengthen their physical resilience: registration, risk analysis, resilience plan and incident reporting. Whether a facility is critical follows from thresholds in a statutory ordinance.
Yes. Measures, evidence and documents are kept in one place and can be prepared for customers as Excel or PDF. This way you answer recurring questions from what you already have.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
