Cyber Resilience Act & Co. What Logisticians Need to Know About Cybersecurity

Related Vendors

Sophos Technology GmbH

Piabo Medienmanagement GmbH

DQS GmbH

FAULHABER Drive Systems

Wuxi InfiMotion Technology Co., Ltd.

New EU directives and the Cyber Resilience Act are tightening the requirements for IT security in companies. The logistics industry must also protect its systems and products against cyber attacks. Read here what is needed for this.

Cyberattacks are not uncommon in the logistics industry. A recent study by the software company Sophos shows that around eight out of ten companies in the industry have already been affected by cyber attacks. Around 40 percent of the attacks were not aimed at the company's own systems, but at interfaces to business partners. Human error plays a major role: 81 percent of the companies surveyed have identified human error or a lack of security awareness as a major risk. Added to this is the shortage of IT specialists: around three quarters of companies complain about a lack of cybersecurity staff.

Cybersecurity Increasingly Important in Transport And Intralogistics

Telematics systems, fleet management solutions and logistics platforms make work easier for dispatchers, but like all IT systems, they are a target. Networked warehouse and conveyor systems as well as autonomous transport vehicles increase this even further. The increasing integration of warehouse technology and ERP systems is also leading to new data security requirements.

Negligence in IT security increases the risk of attacks and also causes problems with compliance. For some time now, all companies have been subject to comprehensive cybersecurity requirements from the European Union. With the NIS-2 Directive (Network and Information Security) and the Cyber Resilience Act, the EU has created regulations that tighten and standardize security requirements across Europe. The aim is to strengthen the digital resilience of companies and better protect critical infrastructures.

Requirements of the NIS-2 Directive

The NIS 2 Directive applies to companies with at least fifty employees or an annual turnover of more than ten million euros. Whether a company is affected by the directive and what specific obligations result from it can be found in the annexes to the directive. Cautious estimates assume that more than 30,000 companies in Germany alone are subject to the NIS 2 regulations. The Federal Office for Information Security provides an initial assessment of how affected companies are.

According to the NIS 2 Directive, companies must demonstrate that they have taken technical and organizational measures to prevent cyber attacks as far as possible, detect them early and manage them appropriately. These include

• Risk management systems,
• Early warning and detection devices,
• Business continuity and crisis plans and
• regular training for employees.

A central part of the NIS-2 directive is the reporting obligation. Serious security incidents must be reported to the relevant authorities within 24 hours. After 72 hours at the latest, the company must submit a detailed assessment of the situation. These requirements significantly increase the responsibility of the management, as they are personally liable in the event of breaches. In addition, there is the threat of high fines of up to ten million euros or two percent of annual global turnover.

The Cyber Resilience Act

The Cyber Resilience Act supplements the NIS 2 Directive at product level. It obliges manufacturers, suppliers and importers of digital products to incorporate cyber security into the development process from the outset or to ensure it for imported products. They must regularly assess risks, rectify security vulnerabilities and provide software updates.

In future, only products that meet these requirements may be sold in the European Union. This is particularly important for the logistics sector, as modern transportation and storage systems are based on networked devices. Manufacturers of telematics and intralogistics systems must ensure that their products are protected against attacks throughout their entire life cycle.

A particular focus of both directives is on security in the supply chain, as they are closely networked with numerous partners and service providers. The new EU regulations require security requirements to be included in contracts with suppliers and service providers. Business partners must provide evidence of NIS 2-compliant protective measures, and providers of logistics technologies must demonstrate compliance with CRA requirements.

Achieving Digital Resilience

Implementing the requirements of NIS-2 and CRA is complex. Individual, separate steps are not sufficient, as the legislator requires a comprehensive security concept that systematically reduces risks. A sensible approach is to introduce an information security management system in accordance with ISO 27001. This system supports the implementation of good security practices, but is more suitable for larger companies. Smaller companies can fall back on the BSI's IT baseline protection, which offers practical assistance and is compatible with the ISO standard.

Some general measures are already required by the NIS 2 directive. These include a functioning incident management system that prevents, detects and deals with security incidents. This must be supplemented by an identity and access management system with multi-factor authentication and secure single sign-on. Both communication and stored data must be encrypted. Constant monitoring of the IT infrastructure with automated anomaly detection ensures that failures or attempts at manipulation are detected at an early stage and rectified immediately. Business continuity management, which includes backups, disaster recovery and emergency plans, is required as the keystone.

NIS-2 and the Cyber Resilience Act create binding regulatory requirements that oblige companies to implement systematic security management. This is particularly important for the logistics sector, as networked systems with many interfaces offer great potential for attack. The new regulations increase digital resilience, which strengthens the stability and functionality of companies in the long term.

Ingo Unger is Business Development Manager at DQS

Secure and Compliant Authentication in Laboratories

Secure & Contactless User Authentication at GMP/GLP