The System Logistics site in Wackersdorf is included in Krones AG’s ISO/IEC 27001:2022-certified Information Security Management System, providing operators of automated warehouses with the evidence they need for supply chain security under NIS2.
Why information security has become mandatory in intralogistics
With the NIS2 Implementation Act, which came into force in December 2025, information security has become a legal obligation for many companies. Among other things, the law requires systematic risk management, established concepts for incident handling and business continuity, as well as effective measures to secure the supply chain.
For operators of automated warehouse and logistics systems, this responsibility is particularly significant: the systems are highly interconnected, and an IT outage has a direct impact on the physical flow of goods.
These issues are at the core of ISO/IEC 27001. The international standard requires an ISMS that systematically assesses risks, derives targeted protective measures and continuously reviews their effectiveness.
For us, certification was therefore the logical next step: instead of relying on individual measures, we permanently embed information security in clearly defined and externally audited processes.
What NIS2 means for the supply chain
The obligation applies to the operator, not the system manufacturer. Section 30(2)(4) BSIG requires operators to implement supply chain security measures, expressly including their relationships with direct suppliers and service providers.
These requirements are passed on through contractual arrangements. Security questionnaires, defined security levels, incident reporting procedures and proof of certification are now common elements of tender processes. Suppliers of systems used to control and remotely maintain a facility are therefore among those subject to particular scrutiny.
Scope: What is certified
The certified scope covers the provision and delivery of central and local IT services, IT infrastructure, IT systems and IT applications, as well as the implementation of company-wide cybersecurity governance.
| Information | Value |
| Standard | SO/IEC 27001:2022 |
| Registration number | 12 310 4511/25 TMS |
| Issuer | TÜV SÜD Management Service GmbH |
| Certificate holder | Krones AG (System Logistics GmbH’s Wackersdorf site included) |
| Valid until | July 20, 2029 |
The benefits for our customers and operators of automated warehouses
- Reliable evidence: The certificate effectively supports the risk-based assessment of your supply chain.
- Reduced effort: An independently audited management system reduces time-consuming individual assessments and follow-up inquiries.
- Clear processes: Risk assessment, access control, change management and incident handling follow defined and regularly audited procedures.
- Continuous improvement: The ISMS is reviewed annually, demonstrating the continuous development of our information security.
The benefits for our suppliers
For our suppliers, these requirements establish a common level of security and standardized processes. This ensures that project data and specialist knowledge are equally protected throughout the entire value chain.
Context
ISO/IEC 27001 certifies the organization and its processes, not individual products or systems. It does not replace either a project-specific security assessment or a legal assessment of an organization’s own NIS2 obligations.
However, it provides a robust foundation for the systematic management of information security risks.
What comes next
We are currently preparing further information on the key security considerations within the system itself – from separating operational and corporate networks and structuring remote maintenance to restarting operations after an incident – and will publish it in the coming weeks.
For existing systems, an inventory of systems, connections and access points is the first step. Contact us to learn more.