NIS2 requires more than just technical measures. It impacts governance, HR, procurement, and daily operations at every location. Discover how Rotom Group, with the help of Fendix and Tidal Control, gained control over a program spanning 25 locations and achieved the highest level of the NIS2 Supply Chain certification.

‍

About Rotom Group

Rotom Group provides load carriers and logistics solutions from 25 locations across nine European countries, with approximately 750 employees. As CISO, Ronald van Beers is responsible for the group's digital infrastructure, cybersecurity strategy, and business continuity.

‍

His mandate extends beyond monitoring the IT environment. Cybersecurity must permeate the entire organization, from the shop floor to the boardroom. From day one, this project was therefore much more than just an IT initiative.

‍

"Cybersecurity is no longer just a technical topic. It is a necessary part of how we protect our operations, our customers, and the continuity of our organization."

- Ronald van Beers, CISO Rotom Group

‍

Nine countries, one standard

The logistics sector is digitizing rapidly. Customers, suppliers, and internal teams are increasingly dependent on systems that must be available around the clock. For an organization with 25 locations, this is not an abstract risk, but a daily reality.

‍

Rotom Group falls under NIS2 as an important entity. On top of that, there is a second driver: customers in the supply chain are also setting their own requirements, as every organization subject to NIS2 must assess its suppliers' cybersecurity. Rotom occupies both roles simultaneously: as an organization with its own duty of care, and as a link in the supply chains of others.

‍

That made the choice of standard logical. The NIS2 Supply Chain certification translates the directive's requirements into concrete, verifiable measures. Rotom opted for SC30 High, the level for organizations where a cyber incident would cause major disruption in the supply chain. They didn't set the bar lower than necessary; they chose the level that fits their role.

‍

Bringing structure to complexity

25 locations, nine jurisdictions, nine languages, and just as many ways of working. Disparate documents and action lists per location seem manageable until you aggregate them at the group level. Then, you are left with a patchwork that no one can manage centrally. "The challenge wasn't just understanding the NIS2 requirements, but primarily organizing the work in a way that could be managed consistently across the entire group," says Ronald van Beers, CISO at Rotom Group.

‍

Rotom needed two things: subject-matter expertise to translate the requirements into concrete actions for each department and country, and a way to track those actions at the group level, with a clear owner for every task and real-time visibility into progress.

Fendix for the content, Tidal Control for the management

Fendix provided the expert guidance, and Tidal Control provided the platform. This combination was a deliberate choice. In a program spanning nine countries, content without management stalls, and management without content results in a checklist that no one understands.

‍

Fendix translated the SC30 requirements into what they concretely mean for IT, HR, procurement, and operations. From setting up the incident response process to awareness sessions for employees at the various locations. Always with the same approach: if people don't understand a measure, they won't implement it.

‍

As a GRC platform, Tidal Control brought all actions, responsibilities, policies, deadlines, and evidence together in one place. Location managers could see exactly what was expected of them. Management tracked progress without having to constantly follow up. During the audit, the evidence was centrally available instead of scattered across mailboxes in nine countries. "The strength of this approach lay in the combination of expert guidance from Fendix and the structured project management that Tidal Control enabled," says Ronald van Beers, CISO at Rotom Group.

‍