Ports around the world are facing rising pressures from several different directions. Cargo throughput is continuously increasing, while legacy infrastructure strains under the weight of emerging digital threats. The number of cyberattacks on the maritime industry
more than doubled in 2025 compared to the previous year, according to a report by CYTUR.
NIS2 intensifies this urgency. The new laws place cybersecurity duties on port authorities and many port operators – however, they don’t lay out how responsibility should be organised across complex port ecosystems with many interdependent stakeholders.
As a result, many organisations don’t yet have the basics in place: a 2026 report by the World Bank found that only 64% of port stakeholders had a formal cybersecurity policy.
In an operating environment where threats can emerge without warning and have far-reaching effects, this lack of clear cybersecurity governance is a risk. Here’s what to consider when closing the gaps in your port’s cybersecurity.
Cybersecurity responsibility differs from port to port
Ports are organised by a variety of governance arrangements, which influence who is responsible for making cybersecurity decisions, who owns the risk, and how complex a formal cybersecurity policy must be.
Below are three common governance models for ports and how they impact the cybersecurity set-up.
Type of port | Operational control | Cybersecurity impact |
| Public service and tool ports | Port authority has a large amount of operational control | Cybersecurity is more easily centralised
Port authorities can often standardise controls, security requirements and incident responses across operations |
| Landlord ports | Private terminal operators responsible for most operational systems | Cybersecurity responsibility is more fragmented across the port
Ports rely more on governance instruments (e.g., standards, reporting requirements, concession agreements) to ensure cybersecurity compliance |
| Fully private ports | Private operator has overarching responsibility for governing operations and cybersecurity | Cybersecurity approaches can vary more widely between fully private ports, increasing reliance on directives such as NIS2 and public oversight to ensure the minimum required levels of protection are met |
Whoever holds responsibility, management must own it
A port’s governance model determines which organisations are responsible for cybersecurity, whether that’s the port authority, individual terminal operators, or a private owner.
However, responsibility only becomes effective when each organisation’s top management takes clear ownership of it. In a tool port, this might be the port authority leadership; in a landlord port, it’s the management level of each terminal operator, plus a connecting piece such as a steering committee.
Without that ownership, cyber risk falls between departments and organisations, leaving no one in the driver’s seat when an incident hits. In NIS2-applicable countries like the Netherlands and Belgium, it also becomes a compliance risk.
3 ways to ensure management-level cybersecurity responsibility
To successfully implement clear management-level responsibility for cybersecurity, there are three key actions to take.
1. Formalise board involvement
NIS2 compliance is about more than signing off a policy once a year: boards should formally approve cyber risk-management measures, set a clear risk appetite, receive regular reporting, and undergo training. If your management hasn’t yet completed that training, this is a concrete first step.
2. Appoint dedicated executive ownership
The board is accountable, but someone needs to oversee day-to-day cybersecurity. A Chief Information Security Officer (CISO) or equivalent should act as the connecting point between the board and your operational technology, as well as IT infrastructure. Your cranes, gate systems and terminal operating systems are as attractive a target for attackers as your office networks, and are often more challenging to patch.
3. Connect owners across the port with a cybersecurity steering committee
In public service and tool ports, port authority leadership can coordinate cybersecurity directly.
In landlord ports, it is important to bridge the gaps between operators, even when those operators have robust governance themselves. Steering committees can help here by bringing key stakeholders together to align on priorities, share threat information and agree how to escalate in the event of a crisis.
This coordination is important because a single incident can trigger NIS2 reporting deadlines for several organisations at once. Port authorities can reinforce this through concession agreements, such as by requiring minimum security standards, participation in joint exercises or information sharing.
Decide where AI fits into your cybersecurity strategy
AI is part of the increasing threat against ports worldwide – but it can also be part of the solution. While automated attacks and scans for cybersecurity weaknesses are strengthening the capabilities of malign actors, AI is also rapidly developing as a key tool that supports day-to-day cybersecurity operations.
For instance, automated cybersecurity tools can significantly speed up effective incident response and support teams in dealing with a large volume of work. IBM’s recent “Cost of a Data Breach” report showed that, on average, organisations using AI and automation extensively identified and contained a breach 80 days faster than organisations not using AI tools.
Deciding where AI fits into your cybersecurity strategy and operational resilience – and preparing employees and leaders for sophisticated phishing and deepfake threats – is also part of management’s cybersecurity responsibility.
Moving from compliance to resilience takes a port-level cybersecurity strategy
NIS2 has put cybersecurity on the board agenda for ports in the Netherlands and Belgium, but compliance alone isn’t enough to ensure resilience amid escalating threats.
To do that, ports need clear ownership within every organisation, as well as a smooth mechanism for these owners to talk to each other well before an incident forces them to.
Sopra Steria’s experts can help. We partner with major European maritime hubs to optimise and protect port operations. Want to improve your cybersecurity posture?