Answers to recurring NIS2 questions about entity scope, essential versus important classification, cybersecurity risk-management measures, incident reporting, management-body accountability, registration, and penalties.
Use the cited EU and ENISA sources to turn each answer into an auditable decision record before assigning control owners or reporting workflows.
Use this FAQ to decide whether an entity is covered, which tier applies, what Articles 20, 21, and 23 require, and what evidence to keep. Directive (EU) 2022/2555 sets the EU baseline. National implementing law and authority guidance determine the local registration, notification, supervision, enforcement, and procedural details, so record the relevant legal entity, country, sector, service, size facts, special-case rule, and authority route.
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.
Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.
NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.
Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.
How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.
Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.
Start with the legal entity, the service it provides, and the Annex I or Annex II entity type. Article 2 generally covers entities that qualify as medium-sized enterprises under Recommendation 2003/361/EC or exceed the medium-enterprise ceilings and provide services or carry out activities in the Union.
Then test every size-independent route. These include specified communications, trust, TLD, and DNS providers; sole essential-service providers; entities whose disruption could create specified public, systemic, or regional effects; covered public administrations; critical entities under Directive (EU) 2022/2557; and domain name registration service providers. Qualified trust service providers, TLD registries, and DNS service providers are essential regardless of size, but other size-independent cases still need the Article 3 tier test.
No. The Commission describes NIS2 as a framework for 18 critical sectors. In addition to sectors already covered by NIS1, it includes public electronic communications, more digital services, waste and wastewater, critical product manufacturing, postal and courier services, public administration, space, food, chemicals, and research.
No. The default rule covers medium-sized entities and entities above the medium-enterprise ceilings in listed sectors, but Article 2 contains several size-independent routes. Small and micro entities can also be covered because of their service type, critical-entity status, public or systemic effect, national or regional importance, or a Member State identification decision.
Sources (3)
Primary legal source for NIS2 scope, essential and important entities, exclusions, Articles 20, 21, 23, 27, and 34.
essential and important entities
Commission overview explaining the 18-sector scope, Member State obligations, risk-management duties, reporting duties, and top-management accountability.
18 critical sectors
Commission guidance for the entity information and list-building process under Article 3(4).
list of essential and important entities
Essential and important entities are both subject to the Article 20 management-body, cybersecurity risk-management, and significant-incident reporting duties. The tier mainly changes the supervisory model and some enforcement consequences.
Apply Article 3(1) first. It makes entities above the medium-enterprise ceilings in Annex I essential, along with specified qualified trust, TLD, DNS, communications, public-administration, critical-entity, Member-State-identified, and legacy categories. An in-scope Annex I or Annex II entity that does not qualify under Article 3(1) is important under Article 3(2).
No. applies to both essential and important entities. The measures must be appropriate and proportionate to the risk, entity size, likelihood and severity of incidents, and societal and economic impact.
Classification matters because essential entities are subject to the Article 32 supervisory regime, including regular and targeted tools, while competent authorities use Article 33 ex post supervision for important entities when they receive evidence, an indication, or information of alleged non-compliance. Both tiers can face enforcement and administrative fines for or infringements.
Sources (2)
Primary legal source for Article 3 classification and differentiated supervision.
Essential and important entities
Commission policy summary for broader scope, clearer rules, and stronger supervision tools.
stronger supervision tools
requires essential and important entities to take appropriate and proportionate technical, operational, and organisational measures to manage risks to the security of network and information systems and to prevent or minimise incident impact.
The minimum topics include risk analysis and information system security policies, incident handling, business continuity and crisis management, supply-chain security, secure acquisition, development and maintenance, effectiveness assessment, cyber hygiene and training, cryptography and encryption where appropriate, human resources security, access control, asset management, multi-factor or continuous authentication where appropriate, secure communications, and emergency communications.
No. Standards and certifications can support evidence, and NIS2 encourages relevant European and international standards, but still requires a risk-based and proportionate mapping to the NIS2 measures and the entity's actual services.
Use it for DNS service providers, TLD name registries, cloud computing providers, data centre providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking platforms, and trust service providers covered by the regulation.
Sources (3)
Primary legal source for Article 21 cybersecurity risk-management measures and supply-chain requirements.
appropriate and proportionate technical, operational and organisational measures
EU implementing regulation for technical and methodological Article 21 requirements in specified digital and trust-service sectors.
technical and methodological requirements
ENISA guidance with practical implementation advice, evidence examples, and mappings for the implementing regulation.
examples of evidence
requires essential and important entities to notify the or competent authority, without undue delay, of significant incidents. An incident is significant if it has caused or is capable of causing severe operational disruption or financial loss, or if it has affected or is capable of affecting others by causing considerable material or non-material damage.
The reporting sequence is staged: an early warning within 24 hours of awareness, an incident notification within 72 hours of awareness, intermediate reports if requested, and a final report no later than one month after the incident notification. If the incident is still ongoing when that final report is due, the entity provides a progress report then and a final report within one month after handling the incident. A trust service provider must submit the incident notification within 24 hours, rather than 72 hours, for a significant incident affecting its trust services.
No. The early warning is the first stage and should indicate, where applicable, whether unlawful or malicious acts are suspected or whether the incident could have cross-border impact. The 72-hour notification updates the early warning and adds the initial severity and impact assessment and available indicators of compromise.
states that the mere act of notification shall not subject the notifying entity to increased liability. This rule does not decide liability for the incident itself or remove the entity's incident-management, evidence, recipient-communication, or national-law obligations.
Sources (3)
Primary legal source for Article 23 significant incident thresholds and staged reporting deadlines.
within 24 hours
Commission guidance explaining equivalence of sector-specific incident reporting and the NIS2 staged reporting approach.
multiple-stage approach
Further specifies significant-incident cases for covered digital and trust-service sectors.
incident is considered to be significant
Article 4 prevents duplicate NIS2 obligations only where a sector-specific Union legal act requires cybersecurity risk-management measures or significant-incident notifications that are at least equivalent in effect to NIS2. If the sector-specific law covers only some entities or some duties, NIS2 continues to apply to the uncovered parts.
The Commission guidance explains that equivalence for risk-management measures should at minimum correspond to, or go beyond, (1) and (2). For incident reporting, the sector-specific law must give CSIRTs, competent authorities, or single points of contact immediate access to notifications and use reporting requirements at least equivalent to (1) to (6).
No. DORA is treated as a sector-specific Union legal act for covered financial entities for ICT risk management and major ICT-related incident reporting, but NIS2 coordination mechanisms, national strategies, crisis management frameworks, and information exchange with CSIRTs and single points of contact can still matter.
Keep the sector-specific Union law citation, the mapped NIS2 duty, the equivalence rationale, the covered entities or services, the authority route, and the unresolved NIS2 duties that remain in force.
Sources (2)
Primary legal source for Article 4 sector-specific Union legal act rules.
at least equivalent in effect
Commission guidance on when sector-specific Union cybersecurity and reporting rules replace NIS2 provisions.
sector-specific Union legal acts
A usable NIS2 decision record should preserve the legal source, scoped legal entity and service, national implementation note, owner, control or reporting workflow, and evidence of implementation.
At minimum, save the sector and service mapping, essential or important classification, control mapping, reporting route, supplier dependencies, management-body approval trail, training record, registration data owner, review trigger, and the competent authority or contact path.
Article 3 list-building information includes the entity name, address, current contact details including email addresses, IP ranges and telephone numbers, the relevant Annex I or II sector and subsector where applicable, and the Member States where in-scope services are provided. Article 27 separately requires specified DNS, TLD, domain-registration, cloud, data-centre, CDN, MSP, MSSP, marketplace, search, and social-platform entities to submit registry information and report changes within the national deadlines.
For infringements of or 23, Member States must ensure essential entities are subject to administrative fines with a maximum of at least EUR 10,000,000 or at least 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher. For important entities, the corresponding minimum maximum is EUR 7,000,000 or 1.4%, whichever is higher. These are Directive-level minimum maximums, not the fine for a particular case; national law sets the available penalty framework and authorities consider the circumstances listed in Article 32(7).
Reassess after a new service or Member State launch, acquisition or ownership change, change in partner or linked-enterprise data, two consecutive accounting periods above or below an SME ceiling, critical-entity or Member State identification, a material jurisdiction change, or a national transposition update. Article 3 list details must be updated without delay and within two weeks; Article 27 registry changes for the specified digital and ICT providers are due without delay and within three months.
Sources (2)
Primary legal source for registration data, governance, incident reporting, and administrative fines.
maximum of at least EUR 10 000 000
Commission guidance and template context for entity list information and registration data collection.
name, address and up-to-date contact details
Sorena can help turn NIS2 FAQ answers into cited decisions, owner assignments, Article 21 control evidence, Article 23 incident workflow checks, and reusable review triggers.
Ask questions tied to cited sources about NIS2 scope, obligations, reporting, penalties, and evidence using the cited sources on this page.
Review your NIS2 scope decisions, Article 21 control evidence, Article 23 reporting workflow, and unresolved national implementation questions with Sorena.
"high common level of cybersecurity across the Union"
"essential and important entities"
"Essential and important entities"
"appropriate and proportionate technical, operational and organisational measures"
"within 24 hours"
"at least equivalent in effect"
"maximum of at least EUR 10 000 000"
"sector-specific Union legal acts"
"multiple-stage approach"
"18 critical sectors"
"stronger supervision tools"
"technical and methodological requirements"
"incident is considered to be significant"
"list of essential and important entities"
"name, address and up-to-date contact details"
"examples of evidence"
Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.
NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.
Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.
Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.
Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.
Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.
Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.
This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.
A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.
Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.
Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.
Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.
Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.
Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.
Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.
A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.
Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.
NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.
Map NIS2 Article 3 entity lists, Article 27 registry submissions, competent authorities, national filing routes, required data, and change-notification deadlines.
Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.
Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.
Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.
Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.
Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.
Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.
Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.
Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.