Which companies must comply with NIS 2? Essential vs. important entities

The NIS 2 Directive clearly lists all the sectors and subsectors (industries) that need to comply with this European cybersecurity directive. However, there are many exceptions to this list, and the line between essential and important entities is not very easy to understand — in this article, I present a clear explanation of who needs to be compliant, and in what status.

Criteria that determine which companies must comply with NIS2

There are three general criteria that define which organizations must comply with NIS 2:

• 1) Location — if they provide services or carry out activities in any country in the European Union (no matter if they are based in the EU or not), and
• 2) Size — if they are categorized as mid-sized or large organizations (see the criteria in the section below), and
• 3) Industry — if they operate in any of the 18 sectors listed in the table below.

However, there are some exceptions to these rules — see the table in the section below for further explanation.

What are essential and important entities?

“Essential entities” and “important entities” are what NIS 2 calls companies and other organizations that need to comply with NIS 2.

NIS 2 defines essential entities as follows:

• Companies that are categorized as large enterprises (see the criteria in the next section) and are in one of the 11 critical sectors (listed in the table below)
• Trust service providers
• DNS service providers
• Public electronic communication networks
• Public administration entities
• Any critical entity according to Critical Entities Resilience (CER) Directive (EU) 2022/2557
• Other entities specified by Member States

Important entities are all other organizations that are not categorized as essential entities, but that fall under the 3 criteria mentioned in the previous section.

Comprehensive Guide to the NIS 2 Directive

Free white paper that explains the basics of the European Union’s NIS 2 Directive

DOWNLOAD NOW

Breakdown of sectors & essential and important entities

Since the above explanation from NIS 2 is a bit confusing, I made the table below to show which organizations need to comply with NIS 2, and if they are classified as essential or important entities.

For clarification, here’s how the EU classifies companies according to their size:

• Micro and small organizations — if they have fewer than 50 employees and less than 10 million euros in annual revenue.
• Mid-size organizations — if they have 50 to 250 employees and 10 to 50 million euros in annual revenue.
• Large organizations — if they have more than 250 employees and more than 50 million euros in annual revenue.

*Micro and small organizations also need to be compliant with NIS 2 in the following cases:

• If, according to NIS2 Article 2 paragraph 2:
  • “(b) the entity is the sole provider in a Member State of a service which is essential for the maintenance of critical societal or economic activities;
  • (c) disruption of the service provided by the entity could have a significant impact on public safety, public security or public health;
  • (d) disruption of the service provided by the entity could induce a significant systemic risk, in particular for sectors where such disruption could have a cross-border impact;
  • (e) the entity is critical because of its specific importance at national or regional level for the particular sector or type of service, or for other interdependent sectors in the Member State;”
• If a Member State has defined that entity as a “critical entity” according to Critical Entities Resilience (CER) Directive (EU) 2022/2557

What is different for essential and important entities in NIS2?

Here are the most important differences in how NIS 2 treats essential and important entities:

• Article 32 specifies stricter supervisory and enforcement measures for essential entities than those specified in Article 33 for important entities.
• Article 34 specifies higher fines for essential entities:
  • For essential entities – the fines are up to 10 million euro or 2% of the total annual turnover.
  • For important entities – the fines are up to 7 million euro or 1.4% of the total annual turnover.

A much wider reach than the old NIS Directive

It is estimated that at least 100,000 companies need to be compliant with NIS 2 – this is a much larger number than the old NIS Directive required. On top of this, NIS2 covers also important and essential entities that provide services in any EU country, even if these companies are based outside of the European Union.

So, there will be lots of work for cybersecurity professionals.

For more information about NIS2, download this free white paper: Comprehensive guide to the NIS 2 Directive.