EU NIS2 Directive NIS2 essential entities vs NIS2 important entities

Essential entities are covered entities that NIS2 places in the higher criticality tier, including specified Annex I cases, certain special categories, and entities designated by Member States.

Important entities are covered entities that are not essential but still fall within NIS2, including many Annex I or Annex II activities when the applicable size and national rules are met.

Classify the tier before building the evidence pack; the same operational service can carry different authority expectations depending on the classification.

Management bodies must approve and oversee cybersecurity risk-management measures, while security, incident-response, procurement, operations, and legal teams maintain the evidence.

The same management-body, security, incident-response, procurement, operations, and legal functions usually own the work, even though supervision is generally ex post.

Do not split owners just because the tier changes; split the authority-response playbook and evidence-readiness cadence.

Typical triggers include covered Annex I activities above the applicable size threshold, critical-entity status under the CER Directive, selected digital or trust-service categories, and Member State designation.

Typical triggers include covered Annex I or Annex II activities that meet the applicable size or national implementation rules but do not fall into the essential-entity category.

Keep sector, size, special-case, and national-designation facts in the classification memo so later control work does not obscure the legal basis.

Apply Article 21 cybersecurity risk-management measures, Article 23 significant-incident reporting, management-body oversight, and the evidence needed for Article 32 supervision.

Apply Article 21 cybersecurity risk-management measures, Article 23 significant-incident reporting, management-body oversight, and the evidence needed if Article 33 ex post supervision is triggered.

Build one control baseline where the duties are identical, then add separate supervision procedures for essential and important entities.

Keep the classification memo, Article 21 control evidence, Article 23 incident files, management-body approvals, supplier-risk records, registration data, and supervisory-response log.

Keep the same classification, control, incident, supplier, management-body, and registration records, with an ex post response file ready if the authority requests evidence.

Use one evidence library where practical, but tag records by tier, jurisdiction, and authority-response status.

Plan for registration and Member State list updates, supervisory requests, and Article 23 incident clocks: early warning without undue delay and within 24 hours, notification within 72 hours, and a final report within one month.

Track the same incident-reporting clocks and registration facts, but expect authority engagement mainly after evidence, information, or indications of non-compliance.

Run one incident clock process for both tiers, then separate proactive supervision calendars from ex post response readiness.

Essential entities can face Article 32 ex ante and ex post supervision, including audits, checks, security scans, information requests, and orders under national implementation.

Important entities are supervised under Article 33 on an ex post basis when competent authorities receive evidence, an indication, or information suggesting non-compliance.

Prepare essential-entity packs for proactive review; prepare important-entity packs for fast production after an ex post trigger.

Essential entities can reuse the same policies, incident workflows, supplier files, and control tests as important entities when those artifacts satisfy Article 21 and Article 23.

Important entities can reuse those same artifacts, but the file should not imply proactive Article 32 supervision unless the entity is also classified as essential.

Reuse controls; do not reuse the tier conclusion, supervision narrative, or penalty analysis without checking the classification.

For an essential entity, record the classification basis, Article 21 and Article 23 evidence owners, Article 32 supervision pack, jurisdiction facts, and penalty exposure.

For an important entity, record the classification basis, Article 21 and Article 23 evidence owners, Article 33 ex post response pack, jurisdiction facts, and penalty exposure.

Classify first, reuse shared duties second, and keep supervision and sanction analysis tier-specific.