NIS2 vs CER Directive cybersecurity duties and critical-entity resilience
This comparison helps separate NIS2 cybersecurity obligations from CER critical-entity resilience work, then identify the records that can support both without merging the legal tests.
Compare the NIS2 and CER legal texts, then check the applicable national identification decisions, implementing law, and authority instructions for the entity.
NIS2 covers cybersecurity; Directive (EU) 2022/2557 (CER) covers the wider resilience of critical entities against natural and human-made, non-cyber and hybrid risks. A Member State's CER identification brings that into NIS2 regardless of size and makes it an essential entity, subject to the directives' exclusions and national transposition. Keep separate scope decisions and join only the risks, incidents, assets, suppliers, and authority exchanges that genuinely overlap.
Side-by-side comparison
NIS2 vs CER Directive: scope, evidence, and overlap rules
Use the rows below to decide which facts belong to the NIS2 cybersecurity workstream, which facts belong to critical-entity resilience coordination, and which records need both citations.
Cybersecurity duties for covered essential and important entities, including critical entities identified under CER, with risk-management, incident-reporting, management-body, supervision, and enforcement requirements.
Second framework
CER Directive
Resilience duties for Member State-identified critical entities, including risk assessment, resilience measures, incident notification, and cooperation with NIS2 authorities, subject to CER scope qualifications.
NIS2 vs CER Directive: scope, evidence, and overlap rules
NIS2 covers public or private entities in Annex I and Annex II sectors that meet the size-cap or special-case rules, and it also applies regardless of size to entities identified as critical under CER.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER covers entities in its Annex sectors that a Member State identifies because they provide an essential service, operate and have critical infrastructure there, and could suffer an incident with significant disruptive effects. Its Annex includes energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and certain food activities.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Start with NIS2 applicability, then flag any critical-entity designation as both a NIS2 scope trigger and a resilience-coordination item.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
NIS2 work needs entity leadership, management bodies, security owners, incident-response teams, supplier-risk owners, legal or compliance, and national authority contacts.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER-facing overlap needs the owner who tracks critical-entity identification, non-cyber risks, resilience facts, and communications with the competent authority responsible for critical entities.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Use one register if helpful, but assign named owners for cybersecurity controls, incident reporting, critical-entity status, and resilience evidence.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
NIS2 is triggered by Annex sector coverage, medium-size or larger status unless an exception applies, special-case inclusion, and critical-entity identification under CER regardless of size.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER is triggered by a Member State identification decision based on the three Article 6 criteria and the Article 7 disruption factors, not by enterprise size or a private critical-supplier label. Member States were to identify critical entities by 17 July 2026 and notify an identified entity within one month.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Do not wait for a cybersecurity incident to decide scope; run the NIS2 sector, size, special-case, and critical-entity checks before assigning controls.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
NIS2 requires cybersecurity risk-management measures, significant-incident reporting, management-body accountability, supply-chain security attention, registration or notification for some entities, and evidence for supervision.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER requires an all-hazards risk assessment, appropriate and proportionate resilience measures, a resilience plan or equivalent documents, a liaison officer or equivalent contact, and notification of incidents that significantly disrupt or could significantly disrupt essential services.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Primary legal text for critical-entity identification, sector qualifications, risk assessment, resilience measures, incident notification, and applicable timing.
Assign cybersecurity controls to the NIS2 owner and applicable CER risk assessment, resilience measures, and incident notification to the resilience owner. Keep each national-law basis with its decision.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Keep overlap records for critical-entity identification, resilience and non-cyber risk facts, shared incident information, authority correspondence, and any request to coordinate supervisory activity.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Tag each file before reuse: NIS2 cybersecurity evidence, CER-alignment evidence, or shared evidence that must keep both source citations.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
NIS2 timing includes national transposition and registration effects plus Article 23 incident reporting steps: early warning, incident notification, intermediate updates where relevant, and final reporting.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER timing includes national risk assessments at least every four years, Member State identification by 17 July 2026 and notification within one month, entity risk assessment within nine months after notification and at least every four years, and incident notification without undue delay with a 24-hour initial notice unless the entity is operationally unable to submit it. Chapter III generally applies ten months after notification; check the special sector treatment and national measures before assigning these duties.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
NIS2 competent authorities supervise essential and important entities, with different supervisory treatment and enforcement powers for the two categories.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
For entities identified as critical under CER, NIS2 authorities and CER authorities are expected to inform, cooperate, exchange information, and in some cases coordinate supervisory or enforcement activity.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Prepare separate authority-response material for NIS2 cybersecurity compliance and critical-entity resilience coordination.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
NIS2 can reuse service maps, supplier files, incident logs, continuity records, and asset inventories when they prove cybersecurity risk-management or reporting duties.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER alignment can reuse those same records only for supported critical-entity, physical-resilience, non-cyber risk, incident, or authority-cooperation questions.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Reuse facts, not conclusions: the same incident log may support both workstreams, but the NIS2 reportability decision and the CER resilience question remain separate.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
If the question is about Annex scope, essential or important entity status, Article 21 controls, Article 23 reporting, management bodies, or NIS2 supervision, route it to the NIS2 workstream.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Route critical-entity identification, physical resilience, non-cyber risks and CER authority coordination to the resilience owner. Confirm the national identification decision, applicable sector qualifications and national measures before assigning duties.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Create a coordinated work item only when the same entity, service, incident, supplier, or authority request has both a NIS2 citation and a CER-alignment citation.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Scope and covered activity
NIS2 Directive
NIS2 covers public or private entities in Annex I and Annex II sectors that meet the size-cap or special-case rules, and it also applies regardless of size to entities identified as critical under CER.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER Directive
CER covers entities in its Annex sectors that a Member State identifies because they provide an essential service, operate and have critical infrastructure there, and could suffer an incident with significant disruptive effects. Its Annex includes energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and certain food activities.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Operational implication
Start with NIS2 applicability, then flag any critical-entity designation as both a NIS2 scope trigger and a resilience-coordination item.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Who must act
NIS2 Directive
NIS2 work needs entity leadership, management bodies, security owners, incident-response teams, supplier-risk owners, legal or compliance, and national authority contacts.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER Directive
CER-facing overlap needs the owner who tracks critical-entity identification, non-cyber risks, resilience facts, and communications with the competent authority responsible for critical entities.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Operational implication
Use one register if helpful, but assign named owners for cybersecurity controls, incident reporting, critical-entity status, and resilience evidence.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Trigger or threshold
NIS2 Directive
NIS2 is triggered by Annex sector coverage, medium-size or larger status unless an exception applies, special-case inclusion, and critical-entity identification under CER regardless of size.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER Directive
CER is triggered by a Member State identification decision based on the three Article 6 criteria and the Article 7 disruption factors, not by enterprise size or a private critical-supplier label. Member States were to identify critical entities by 17 July 2026 and notify an identified entity within one month.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Operational implication
Do not wait for a cybersecurity incident to decide scope; run the NIS2 sector, size, special-case, and critical-entity checks before assigning controls.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Core obligations
NIS2 Directive
NIS2 requires cybersecurity risk-management measures, significant-incident reporting, management-body accountability, supply-chain security attention, registration or notification for some entities, and evidence for supervision.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER Directive
CER requires an all-hazards risk assessment, appropriate and proportionate resilience measures, a resilience plan or equivalent documents, a liaison officer or equivalent contact, and notification of incidents that significantly disrupt or could significantly disrupt essential services.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Primary legal text for critical-entity identification, sector qualifications, risk assessment, resilience measures, incident notification, and applicable timing.
Operational implication
Assign cybersecurity controls to the NIS2 owner and applicable CER risk assessment, resilience measures, and incident notification to the resilience owner. Keep each national-law basis with its decision.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Evidence and records
NIS2 Directive
Keep NIS2 records for entity classification, Article 21 controls, supplier security, management approval, Article 23 incident notifications, registration, authority requests, and supervision responses.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER Directive
Keep overlap records for critical-entity identification, resilience and non-cyber risk facts, shared incident information, authority correspondence, and any request to coordinate supervisory activity.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Operational implication
Tag each file before reuse: NIS2 cybersecurity evidence, CER-alignment evidence, or shared evidence that must keep both source citations.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Timing and cadence
NIS2 Directive
NIS2 timing includes national transposition and registration effects plus Article 23 incident reporting steps: early warning, incident notification, intermediate updates where relevant, and final reporting.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER Directive
CER timing includes national risk assessments at least every four years, Member State identification by 17 July 2026 and notification within one month, entity risk assessment within nine months after notification and at least every four years, and incident notification without undue delay with a 24-hour initial notice unless the entity is operationally unable to submit it. Chapter III generally applies ten months after notification; check the special sector treatment and national measures before assigning these duties.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Supervision and enforcement
NIS2 Directive
NIS2 competent authorities supervise essential and important entities, with different supervisory treatment and enforcement powers for the two categories.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER Directive
For entities identified as critical under CER, NIS2 authorities and CER authorities are expected to inform, cooperate, exchange information, and in some cases coordinate supervisory or enforcement activity.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Operational implication
Prepare separate authority-response material for NIS2 cybersecurity compliance and critical-entity resilience coordination.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Overlap and reuse
NIS2 Directive
NIS2 can reuse service maps, supplier files, incident logs, continuity records, and asset inventories when they prove cybersecurity risk-management or reporting duties.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER Directive
CER alignment can reuse those same records only for supported critical-entity, physical-resilience, non-cyber risk, incident, or authority-cooperation questions.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Operational implication
Reuse facts, not conclusions: the same incident log may support both workstreams, but the NIS2 reportability decision and the CER resilience question remain separate.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Practical decision rule
NIS2 Directive
If the question is about Annex scope, essential or important entity status, Article 21 controls, Article 23 reporting, management bodies, or NIS2 supervision, route it to the NIS2 workstream.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
CER Directive
Route critical-entity identification, physical resilience, non-cyber risks and CER authority coordination to the resilience owner. Confirm the national identification decision, applicable sector qualifications and national measures before assigning duties.
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Operational implication
Create a coordinated work item only when the same entity, service, incident, supplier, or authority request has both a NIS2 citation and a CER-alignment citation.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Practical decision rule
How should teams decide which workstream owns a NIS2/CER issue?
Use NIS2 when the issue is cybersecurity scope, Article 21 controls, Article 23 reporting, management-body accountability, registration, supervision, or enforcement.
Use CER-alignment handling when a critical-entity designation, physical-resilience fact, non-cyber risk, or authority-cooperation request affects the same service.
Use a joint work item only when the record needs both cyber and resilience owners, and keep the source citations separate.
Escalate unresolved entity identification, exclusions, national deadlines, and authority routes before relying on the CER decision.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
1
Section 1
What is the practical difference between NIS2 and CER?
NIS2 is the cybersecurity regime: it applies to covered Annex I and Annex II entities, certain special cases, and entities identified as critical under CER regardless of size. Its operational questions are whether the entity is in scope, which cybersecurity risk-management measures apply, who approves and supervises them, and how significant incidents are reported.
CER requires Member States to identify critical entities using the directive's criteria and national risk assessments. The entity must provide an essential service, operate and have critical infrastructure in the Member State, and face an incident capable of significantly disrupting that service. Article 6 set 17 July 2026 as the deadline for Member States to identify critical entities and requires notification to each identified entity within one month. Once identified, a falls within NIS2 regardless of size and is essential under NIS2 Article 3(1)(f); the applicable national decisions and any defence, national-security, public-security, or law-enforcement exclusions still need case-specific review.
CER then requires the identified entity to assess risks and take appropriate and proportionate technical, security, and organisational resilience measures. The measures cover prevention, physical protection, response, recovery, personnel security, awareness, and a resilience plan or equivalent documents. CER incident notification uses its own test and route: incidents that significantly disrupt or could significantly disrupt essential services are notified to the competent authority without undue delay, with an initial notification no later than 24 hours after awareness unless the entity is operationally unable to submit it, followed where relevant by a detailed report no later than one month afterward. Under Article 6(3), Chapter III generally applies ten months after notification of identification, while the entity risk assessment is due within nine months. Identified entities in banking, financial market infrastructure, and digital infrastructure have no Chapter III or IV duties unless national measures provide otherwise.
Use NIS2 sources for cybersecurity controls, incident reporting, management-body accountability, and essential or important entity supervision.
Use CER for national critical-entity identification, all-hazards risk assessment, resilience measures, background checks where permitted, resilience liaison, and CER incident reporting.
Use the Commission NIS2/CER alignment guidance for shared critical-entity, authority-cooperation, and physical-versus-cyber resilience claims.
Treat national identification, competent-authority instructions, and transposition measures as controlling for the entity-specific result.
Binding CER text for the critical-entity identification criteria, the 17 July 2026 identification deadline, resilience duties, incident notification, and scope exclusions.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
2
Section 2
What should the comparison produce?
Create a two-column scoping and evidence record. The NIS2 side should name the Annex or special-case trigger, essential or important entity status, cybersecurity owner, Article 21 control evidence, Article 23 incident-reporting path, and national registration or supervision notes where relevant.
The CER side should record the Member State identification decision and notification date, essential service, critical infrastructure, Article 7 significance factors, national risk-assessment context, resilience owner, resilience measures, liaison officer or equivalent contact, incident route, and critical-entity authority. Do not treat a customer label such as 'critical supplier' as a CER identification decision.
For the CER Article 7 significance factors, record the number of service users, dependencies of other sectors, the degree and duration of economic, societal, environmental, public-safety or health effects, the entity's market share, the affected geographic area and cross-border exposure, including vulnerability due to geographic isolation, and the entity's importance in maintaining a sufficient level of the essential service given the alternatives available. These factors support the Member State identification decision; they do not replace it.
Write separate scope conclusions for NIS2 and CER instead of one combined compliance label.
Tag every record as cybersecurity evidence, critical-entity resilience evidence, or reusable overlap evidence.
Escalate unresolved questions about national CER identification, applicable exclusions, and authority instructions to the legal or resilience owner.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Identification criteria and the six factors for significant disruptive effect.
3
Section 3
When should teams run this comparison?
Run the comparison when a service may fall in a NIS2 Annex sector, when size-cap or special-case rules are uncertain, when a Member State or customer treats the organisation as critical, or when an incident affects a critical service and may require cross-authority information sharing.
Repeat it when the entity adds a covered service, changes its EU establishment or representative analysis, receives a national registration or authority request, changes a high-risk supplier, or learns that a critical-entity designation affects the same service.
Inputs: entity legal name, EU countries, service description, Annex sector mapping, size and special-case analysis, authority contacts, critical-service facts, and incident-reporting routes.
Outputs: separate NIS2 and CER scope notes, shared-risk register tags, owner assignments, source citations, and unresolved legal questions.
Exclusions: apply the CER defence, national-security, public-security, and law-enforcement rules and the special treatment of public administration and critical entities in the banking, financial market infrastructure, and digital infrastructure sectors before assigning CER duties.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Implementing regulation for technical and methodological cybersecurity risk-management requirements for specified digital providers under NIS2.
technical and methodological requirements
4
Section 4
Who should own the overlap evidence?
Security should own NIS2 cybersecurity controls and incident reporting. Legal or public-policy owners should maintain the interpretation of NIS2 scope, critical-entity status, national transposition effects, and competent-authority contacts. Resilience or continuity owners should maintain non-cyber risk and critical-service records when CER-facing facts are present.
A single coordinator can run the register, but the register should preserve regime tags. That prevents a supplier risk file, incident log, continuity plan, or authority email from being reused without checking whether it supports cyber resilience, physical resilience, or both.
Keep NIS2 Article 21 control evidence separate from continuity and physical-resilience records unless a source supports reuse.
Record when NIS2 authorities and CER authorities must exchange information about critical entities, risks, threats, incidents, and supervisory activity.
Assign unresolved national identification, resilience-plan, or incident-route questions to a named owner with a review deadline.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
high common level of cybersecurity across the Union
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
physical and cyber resilience of critical entities
Recommended next step
Build separate NIS2 and critical-entity resilience workstreams
Sorena can help turn the NIS2/CER comparison into cited scope decisions, separate cyber and resilience owners, shared evidence records, and national authority routes.
Binding CER text for critical-entity identification, the 17 July 2026 deadline, resilience measures, incident notification, supervision, and scope exclusions.
Binding CER text for the critical-entity identification criteria, the 17 July 2026 identification deadline, resilience duties, incident notification, and scope exclusions.
Binding NIS2 text for covered Annex I and II entities, critical entities brought into NIS2 scope, cybersecurity risk-management duties, incident reporting, supervision, and cooperation with CER authorities.
"high common level of cybersecurity across the Union"
Commission FAQ sources support the NIS2/CER relationship: aligned scope, critical entities becoming subject to NIS2 cybersecurity obligations, and cooperation between NIS2 and CER competent authorities.
"physical and cyber resilience of critical entities"