NIS2: all pages and articles
Directive (EU) 2022/2555 · Article 2, Article 3, Article 26
Is your company under NIS2, and is it essential or important? Five questions, each with the article it comes from, and the annexes as the Directive lists them in your language. The result is a written determination you can file: whether you are an entity of the Directive, which kind, which member state's law and which act, what applies to you directly, and where to start. Nothing you type leaves this page.
Company (optional, for the document title) Which type of entity in Annex I or II are you? The Directive lists types of entity by sector; a company is in scope by being one of them, not by being a supplier to one. Pick the row that describes what you provide. A software company that runs its product as a service is usually a cloud computing service provider; one that operates customers' systems is a managed service provider.
Which type of entity in Annex I or II are you? Choose a type of entity None of these describes us Electricity: Electricity undertakings as defined in Article 2, point (57), of Directive (EU) 2019/944 of the European Parliament and of the Council, which carry out the function of ‘supply’ as defined in Article 2, point (12), of that Directive Electricity: Distribution system operators as defined in Article 2, point (29), of Directive (EU) 2019/944 Electricity: Transmission system operators as defined in Article 2, point (35), of Directive (EU) 2019/944 Electricity: Producers as defined in Article 2, point (38), of Directive (EU) 2019/944 Electricity: Nominated electricity market operators as defined in Article 2, point (8), of Regulation (EU) 2019/943 of the European Parliament and of the Council Electricity: Market participants as defined in Article 2, point (25), of Regulation (EU) 2019/943 providing aggregation, demand response or energy storage services as defined in Article 2, points (18), (20) and (59), of Directive (EU) 2019/944 Electricity: Operators of a recharging point that are responsible for the management and operation of a recharging point, which provides a recharging service to end users, including in the name and on behalf of a mobility service provider District heating and cooling: Operators of district heating or district cooling as defined in Article 2, point (19), of Directive (EU) 2018/2001 of the European Parliament and of the Council Oil: Operators of oil transmission pipelines Oil: Operators of oil production, refining and treatment facilities, storage and transmission Oil: Central stockholding entities as defined in Article 2, point (f), of Council Directive 2009/119/EC Gas: Supply undertakings as defined in Article 2, point (8), of Directive 2009/73/EC of the European Parliament and of the Council Gas: Distribution system operators as defined in Article 2, point (6), of Directive 2009/73/EC Gas: Transmission system operators as defined in Article 2, point (4), of Directive 2009/73/EC Gas: Storage system operators as defined in Article 2, point (10), of Directive 2009/73/EC Gas: LNG system operators as defined in Article 2, point (12), of Directive 2009/73/EC Gas: Natural gas undertakings as defined in Article 2, point (1), of Directive 2009/73/EC Gas: Operators of natural gas refining and treatment facilities Hydrogen: Operators of hydrogen production, storage and transmission Air: Air carriers as defined in Article 3, point (4), of Regulation (EC) No 300/2008 used for commercial purposes Air: Airport managing bodies as defined in Article 2, point (2), of Directive 2009/12/EC of the European Parliament and of the Council, airports as defined in Article 2, point (1), of that Directive, including the core airports listed in Section 2 of Annex II to Regulation (EU) No 1315/2013 of the European Parliament and of the Council, and entities operating ancillary installations contained within airports Air: Traffic management control operators providing air traffic control (ATC) services as defined in Article 2, point (1), of Regulation (EC) No 549/2004 of the European Parliament and of the Council Rail: Infrastructure managers as defined in Article 3, point (2), of Directive 2012/34/EU of the European Parliament and of the Council Rail: Railway undertakings as defined in Article 3, point (1), of Directive 2012/34/EU, including operators of service facilities as defined in Article 3, point (12), of that Directive Water: Inland, sea and coastal passenger and freight water transport companies, as defined for maritime transport in Annex I to Regulation (EC) No 725/2004 of the European Parliament and of the Council, not including the individual vessels operated by those companies Water: Managing bodies of ports as defined in Article 3, point (1), of Directive 2005/65/EC of the European Parliament and of the Council, including their port facilities as defined in Article 2, point (11), of Regulation (EC) No 725/2004, and entities operating works and equipment contained within ports Water: Operators of vessel traffic services (VTS) as defined in Article 3, point (o), of Directive 2002/59/EC of the European Parliament and of the Council Road: Road authorities as defined in Article 2, point (12), of Commission Delegated Regulation (EU) 2015/962 responsible for traffic management control, excluding public entities for which traffic management or the operation of intelligent transport systems is a non-essential part of their general activity Road: Operators of Intelligent Transport Systems as defined in Article 4, point (1), of Directive 2010/40/EU of the European Parliament and of the Council Credit institutions as defined in Article 4, point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council Operators of trading venues as defined in Article 4, point (24), of Directive 2014/65/EU of the European Parliament and of the Council Central counterparties (CCPs) as defined in Article 2, point (1), of Regulation (EU) No 648/2012 of the European Parliament and of the Council Healthcare providers as defined in Article 3, point (g), of Directive 2011/24/EU of the European Parliament and of the Council EU reference laboratories referred to in Article 15 of Regulation (EU) 2022/2371 of the European Parliament and of the Council Entities carrying out research and development activities of medicinal products as defined in Article 1, point (2), of Directive 2001/83/EC of the European Parliament and of the Council Entities manufacturing basic pharmaceutical products and pharmaceutical preparations referred to in section C division 21 of NACE Rev. 2 Entities manufacturing medical devices considered to be critical during a public health emergency (public health emergency critical devices list) within the meaning of Article 22 of Regulation (EU) 2022/123 of the European Parliament and of the Council Suppliers and distributors of water intended for human consumption as defined in Article 2, point (1)(a), of Directive (EU) 2020/2184 of the European Parliament and of the Council, excluding distributors for which distribution of water for human consumption is a non-essential part of their general activity of distributing other commodities and goods Undertakings collecting, disposing of or treating urban waste water, domestic waste water or industrial waste water as defined in Article 2, points (1), (2) and (3), of Council Directive 91/271/EEC, excluding undertakings for which collecting, disposing of or treating urban waste water, domestic waste water or industrial waste water is a non-essential part of their general activity Internet Exchange Point providers DNS service providers, excluding operators of root name servers TLD name registries Cloud computing service providers Data centre service providers Content delivery network providers Trust service providers Providers of public electronic communications networks Providers of publicly available electronic communications services Managed service providers Managed security service providers Public administration entities of central governments as defined by a Member State in accordance with national law Public administration entities at regional level as defined by a Member State in accordance with national law Operators of ground-based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space-based services, excluding providers of public electronic communications networks Postal service providers as defined in Article 2, point (1a), of Directive 97/67/EC, including providers of courier services Undertakings carrying out waste management as defined in Article 3, point (9), of Directive 2008/98/EC of the European Parliament and of the Council, excluding undertakings for whom waste management is not their principal economic activity Undertakings carrying out the manufacture of substances and the distribution of substances or mixtures, as referred to in Article 3, points (9) and (14), of Regulation (EC) No 1907/2006 of the European Parliament and of the Council and undertakings carrying out the production of articles, as defined in Article 3, point (3), of that Regulation, from substances or mixtures Food businesses as defined in Article 3, point (2), of Regulation (EC) No 178/2002 of the European Parliament and of the Council which are engaged in wholesale distribution and industrial production and processing Manufacture of medical devices and in vitro diagnostic medical devices: Entities manufacturing medical devices as defined in Article 2, point (1), of Regulation (EU) 2017/745 of the European Parliament and of the Council, and entities manufacturing in vitro diagnostic medical devices as defined in Article 2, point (2), of Regulation (EU) 2017/746 of the European Parliament and of the Council with the exception of entities manufacturing medical devices referred to in Annex I, point 5, fifth indent, of this Directive Manufacture of computer, electronic and optical products: Undertakings carrying out any of the economic activities referred to in section C division 26 of NACE Rev. 2 Manufacture of electrical equipment: Undertakings carrying out any of the economic activities referred to in section C division 27 of NACE Rev. 2 Manufacture of machinery and equipment n.e.c.: Undertakings carrying out any of the economic activities referred to in section C division 28 of NACE Rev. 2 Manufacture of motor vehicles, trailers and semi-trailers: Undertakings carrying out any of the economic activities referred to in section C division 29 of NACE Rev. 2 Manufacture of other transport equipment: Undertakings carrying out any of the economic activities referred to in section C division 30 of NACE Rev. 2 Providers of online marketplaces Providers of online search engines Providers of social networking services platforms Research organisations How large is the company? Sizes as the Annex to Recommendation 2003/361/EC defines them, counted for the enterprise with its partner and linked enterprises. The Directive's Article 2(1) takes medium-sized enterprises and larger.
Micro or small: fewer than 50 staff and a turnover or balance sheet of EUR 10 million or less Medium: at least 50 and fewer than 250 staff, or above EUR 10 million in both turnover and balance sheet, and no more than EUR 50 million turnover or EUR 43 million balance sheet Large: 250 staff or more, or above both EUR 50 million turnover and EUR 43 million balance sheet
Does one of the size-blind rules apply? Article 2(2) to (4) bring some entities in whatever their size. The first four are decided by what you provide; the next two need an act of your member state, which will have told you; the last is a status under the critical entities Directive.
None of these We provide a public electronic communications network or a publicly available electronic communications service (Article 2(2)(a)(i)) We are a trust service provider under Regulation (EU) No 910/2014 (Article 2(2)(a)(ii)) We are a top-level domain name registry or a DNS service provider (Article 2(2)(a)(iii)) We provide domain name registration services (Article 2(4)) Our member state has identified us as the sole provider of a service essential for critical societal or economic activities (Article 2(2)(b)) Our member state has identified us under Article 2(2)(c) to (e): a disruption of our service would significantly affect public safety, security or health, or induce systemic risk, or we are critical for our sector at national or regional level We are identified as a critical entity under Directive (EU) 2022/2557 (Article 2(3))
Where is the company established? Article 26 gives every entity one member state. For cloud, data centre, content delivery, managed service, managed security, marketplace, search engine and social networking providers it is the main establishment in the Union, the place where the cybersecurity decisions are predominantly taken; a provider not established in the Union designates a representative in a state where it offers services (Article 26(3)).
In a member state (for the digital providers above: our main establishment in the Union) Outside the Union, with a representative designated in a member state Outside the Union, no representative designated
The determination Answer the first three questions and the determination is written here.
Essential or important: the rules, read in order The transposition register, state by state NIS2 mapped to ISO 27001 The Article 23 clocks beside the CRA's