A traffic-control failure brings a hub to a standstill. The timetable is reshuffled, passengers are rerouted, the system comes back and the notification goes out on time. Three months later the regulator asks: "what did that disruption change in your organisation?" The answer sits scattered across inboxes, an evaluation document and the minutes of the incident meeting. You did learn — you just cannot show it.
The same directives, your regulator
NIS2 and CER apply to essential and critical entities in this sector; supervision lies with the competent authority designated for it. The annex lists four subsectors: air, rail, water and road — from airports and traffic control to infrastructure managers, ports and operators.
Per anchor: what the directive asks, and what is ready for it.
Go to the law →One yardstick for exercise and real response, recurring threads that get followed through, and readiness from exercise and response data alike.
Go to the approach →