How NIS2 applies sector by sector: which entity types in each Annex I or II sector are covered, whether they are essential or important, which supervisor and rules apply, and the sector-specific details buyers ask about, from MSPs and cloud to hospitals and utilities.
Why MSPs and MSSPs are Annex I entities under NIS2: the definitions, essential status above the size cap, the implementing regulation's EU-level requirements and incident thresholds, main establishment jurisdiction and registration, and what customers will ask of them.
NIS2 for providers of cloud computing, data center and content delivery network services: the legal definitions, in-house data center exclusion, EU-level technical requirements, availability and physical access incident thresholds, jurisdiction and registration.
When a software or SaaS company falls under NIS2 itself and when it is only affected through its customers: SaaS as a cloud computing service model, managed services, online platforms, the size cap, and the supplier requirements customers pass down.
Which manufacturers NIS2 covers: medical and in vitro diagnostic devices and NACE divisions 26 to 30 in Annex II, important entity status and ex post supervision, the size cap, national rules for the measures, and the link to the Cyber Resilience Act for products.
NIS2 in the health sector: healthcare providers, EU reference laboratories, pharmaceutical research and manufacturing, critical medical devices, essential status, the all-hazards measures, incident reporting duties and the interaction with GDPR breach notification.
NIS2 for electricity, district heating and cooling, oil, gas and hydrogen undertakings: subsectors, essential status, critical entities under the CER Directive, business continuity and physical protection, incident reporting and fines.
NIS2 for transport operators in the air, rail, water and road subsectors: scope and size cap, essential status, sectoral rules that may displace NIS2, physical and cyber resilience under the CER Directive, and staged incident reporting.
NIS2 for water suppliers and distributors and waste water undertakings: the Annex I definitions and non-essential activity exclusions, essential status, critical entities, the all-hazards approach, backups and redundancy, and supervision.
How NIS2 treats public bodies: central and regional public administration in Annex I, the Member State option for local government and education, the national security exclusion, central government as essential regardless of size, and limits on fines and management bans.
NIS2 for digital providers in Annex II: the definitions, important entity status, EU-level technical requirements and user-based incident thresholds, main establishment jurisdiction, registration with the ENISA registry and the duty to appoint an EU representative.
NIS2 for providers of public electronic communications networks and services: in scope regardless of size, essential above the small-enterprise ceilings, jurisdiction where services are provided, the end of the telecom security articles in the EECC, and encryption expectations.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.