Search every question across sub-FAQs

Annex I lists ICT service management (business-to-business), including managed service providers and managed security service providers. Article 6 defines a managed service provider as an entity providing services related to installation, management, operation, or maintenance of ICT products, networks, infrastructure, applications, or other network and information systems through assistance or active administration on customer premises or remotely. A managed security service provider is an MSP that performs or assists with cybersecurity risk-management activities.

The sector entry is only the first step. Article 2 generally covers an Annex I provider that qualifies as medium-sized under Recommendation 2003/361/EC or exceeds the medium-enterprise ceilings and has the required Union activity. Article 3(1)(a) generally makes an Annex I provider above those ceilings essential. A covered medium-sized MSP or MSSP that does not meet an essential-entity limb is important under Article 3(2). Small providers need a separate Article 2(2) special-case and national-law check before being treated as outside scope.

The classification file should show why the service meets, or does not meet, the NIS2 MSP or MSSP definition. A sales category is not enough; the record should explain the actual installation, management, operation, maintenance, active administration, or cybersecurity risk-management activity provided to customers.

The record should also show the entity-level analysis. Identify the contracting legal entity and apply the Recommendation's partner- and linked-enterprise aggregation rules where relevant. Then record the Article 26 main-establishment decision, any Union representative, and the national registration and authority route.

A provider can be an MSP or MSSP even when the customer owns the environment because Article 6 includes assistance or active administration on customer premises or remotely. A supplier is not necessarily an MSP merely because it sells software, cloud capacity, hardware, professional services, or staff. Classify the activity from the contract and actual operating model.

Article 26 assigns an MSP or MSSP to the Member State of its main establishment in the Union using a three-step test: predominant cybersecurity risk-management decisions; if that Member State cannot be determined or those decisions are not taken in the Union, cybersecurity operations; and, if that Member State also cannot be determined, the Union establishment with the highest number of employees. A provider not established in the Union that offers services there must designate a representative in a Member State where it offers those services.

Under NIS2 Article 23, essential and important entities notify their CSIRT or competent authority of significant incidents. The first required step is an early warning submitted without undue delay and, in any event, within 24 hours of becoming aware of the significant incident.

The early warning is not the full incident report. It must indicate, where applicable, whether unlawful or malicious acts are suspected or whether the incident could have a cross-border impact. The 72-hour incident notification supplies the initial severity and impact assessment and available indicators of compromise.

The evidence file should prove the significance decision and the timing. Keep the detection record, initial assessment, awareness timestamp, affected services, notification route, warning payload, submission receipt, and escalation approvals together. Preserve facts that were uncertain at submission instead of silently replacing the first assessment later.

Do not wait for the final root cause before sending the early warning. Article 23 expects a staged process: early warning, 72-hour incident notification, intermediate reports if requested, and a final report after the incident notification or after handling a continuing incident.

Awareness, significance, and routing often require separate decisions. Determine when the entity had enough information to conclude that Article 23(3), applicable national criteria, or binding sector-specific criteria were met; then identify the correct national route and possible cross-border impact.

For the DNS, TLD, trust-service, cloud, data-centre, CDN, MSP, MSSP, marketplace, search, and social-platform entities covered by Implementing Regulation (EU) 2024/2690, its recitals treat the entity as aware when its initial assessment provides a reasonable degree of certainty that a significant incident occurred. The regulation also supplies binding horizontal and entity-specific significance criteria. Scheduled interruptions and planned maintenance consequences are excluded under that regulation, while incidents with the same apparent root cause can count collectively when they occur at least twice within six months and together cross its financial-loss criterion. Other entities must use Article 23, national implementing law, and applicable authority guidance.

Submit the incident notification without undue delay and in any event within 72 hours of becoming aware of a significant incident. It must update the early warning where applicable and indicate the entity's initial assessment, including severity and impact and, where available, indicators of compromise.

Do not wait for perfect root-cause certainty if the Article 23 significance threshold is met. Record what is known, what is estimated, what is unavailable, and which facts will be updated through intermediate reports or the final report.

The record should let incident responders, management, and an authority reconstruct the decision. It should show why the incident met the significance threshold, when the entity became aware, what was submitted, what evidence supported the initial assessment, and what remained unknown.

Separate the authority notification from customer, recipient, public, and law-enforcement communications. Article 23 includes recipient communication and authority guidance paths, but those decisions may have different owners, approval steps, and confidentiality constraints.

After the incident notification, provide intermediate reports when the CSIRT or competent authority requests status updates. The final report is due no later than one month after the incident notification and must include a detailed description, severity and impact, the likely threat type or root cause, applied and ongoing mitigation measures, and cross-border impact where applicable.

If the incident is still ongoing when the final report would otherwise be due, Article 23 calls for a progress report at that time and a final report within one month after handling the incident.

Essential entities include Annex I entities that exceed the Recommendation 2003/361/EC ceilings for medium-sized enterprises; qualified trust service providers, TLD registries, and DNS service providers regardless of size; medium-sized or larger providers of public electronic communications networks or publicly available electronic communications services; covered central-government public administrations; critical entities under Directive (EU) 2022/2557; entities identified by a Member State as essential under Article 2(2)(b) to (e); and legacy operators where national law preserves that status.

Important entities are covered Annex I or Annex II entities that do not qualify as essential entities under Article 3(1), including entities that Member States identify under the specified Article 2(2) special-risk grounds. They are still in scope and still need cybersecurity risk-management, management-body oversight, and significant-incident reporting.

Both essential and important entities need management-body involvement. NIS2 requires management bodies to approve cybersecurity risk-management measures and oversee implementation, while their members must follow training, with Member States deciding the national liability framework.

Both tiers also need appropriate and proportionate technical, operational, and organisational measures under Article 21. The listed measures cover risk analysis and security policies, incident handling, business continuity, supply-chain security, secure acquisition and maintenance, control effectiveness, cyber hygiene, cryptography, access control and asset management, and authentication or secure communications where appropriate.

For significant incidents, both tiers follow Article 23 notification duties, including the 24-hour early warning, 72-hour incident notification, status updates on request, and final reporting route.

Article 32 permits both regular and targeted supervision of essential entities, including on-site inspections, off-site supervision, random checks, regular and targeted audits, ad hoc audits, security scans, information requests, document access, and evidence requests. Essential-entity enforcement can also include a monitoring officer and, where specified measures are ineffective, temporary suspension or temporary management-function prohibition routes under national law.

Important entities are mainly supervised ex post. Article 33 says competent authorities act when they have evidence, indication, or information that an important entity allegedly does not comply, especially with Articles 21 and 23. Ex post tools still include inspections, targeted audits, scans, information requests, document access, evidence requests, warnings, binding instructions, orders, and fines.

The Directive-level minimums for maximum fines differ for Article 21 or 23 infringements. Article 34 requires national maximum fines for essential entities of at least EUR 10 million or 2 percent of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, and for important entities of at least EUR 7 million or 1.4 percent, whichever is higher in each tier. National law controls the authority, procedure, and final fine rules.

Article 41 required Member States to adopt and publish national measures by 17 October 2024 and apply them from 18 October 2024. The directive remains the common baseline, but a private organisation normally needs the applicable national measures to identify enforceable local duties and procedures.

Start with jurisdiction, not a country list. Article 26 generally points to the Member State of establishment but uses special rules for communications providers, specified cross-border digital providers, and public administrations. Then identify any additional Member State registration, service-recipient, incident, mutual-assistance, or sector exposure and verify each relevant national source.

The same EU obligation can require different practical steps once national law, each competent authority, portals, and supervisory structures apply. Keep one EU baseline and a country appendix for each jurisdiction or other national route that affects the legal entity.

Avoid treating a country as complete based only on a generic EU overview. The Commission page says its content is without prejudice to the formal assessment of whether national transposition measures comply with NIS2, so teams should keep primary national sources in the evidence file where available.

A usable transposition record separates EU baseline facts, binding national provisions, and non-binding authority guidance. An EU article number does not identify the national portal, form, competent authority, or any stricter national rule.

If a Member State status, authority route, penalty, reporting threshold, or registration deadline is not supported by the cited source, leave it unresolved and assign a legal or country owner to verify it. Do not fill gaps with assumptions from another Member State.