The NIS 2 Directive broadens the scope significantly compared to its predecessor, encompassing a wider range of sectors and introducing more defined categories of entities that must comply with its regulations. Here’s a detailed breakdown of who needs to adhere to the NIS 2 Directive:

1. Essential and Important Entities

The directive distinguishes between ‘essential’ and ‘important’ entities, both subject to specific cybersecurity obligations:

• Essential Entities: These include entities that are vital for the maintenance of critical societal or economic activities. The designation of essential entities includes, but is not limited to:

  • Sectors: Energy, transport, banking, financial market infrastructures, health, drinking water supply and distribution, digital infrastructure, and public administration.
  • Services: ICT service management, trust service providers, and DNS service providers.
  • Organizations: Entities covered by the Critical Entities Resilience (CER) Directive, public electronic communication networks, and other entities specified by Member States​​.

• Important Entities: These are entities that are not classified as essential but are still critical to the society or economy. The criteria for important entities focus on the size and impact, generally including medium-sized and large organizations within the sectors covered by the directive​.

2. Expanded Sector Coverage

The NIS 2 Directive significantly extends its reach into various sectors, reflecting the growing interconnectivity and reliance on digital technologies:

• Original Sectors: Includes sectors initially covered under the NIS Directive such as energy, transport, health, and financial services.
• New Sectors Added:
  • Public and Private Sectors: Postal and courier services, waste management, manufacture, production, and use of chemicals, and food production​.
  • Digital Services: Cloud computing services, online marketplaces, and search engines. The inclusion of digital service providers highlights the EU’s recognition of the pivotal role these services play in the digital economy​​.
  • Research and Development: Entities involved in research and development in the context of national security and economic resilience​.

3. Specific Compliance Requirements

The NIS 2 Directive sets out specific compliance requirements based on the entity’s classification as either essential or important:

• Cybersecurity Risk Management: Entities must implement appropriate technical and organizational measures to manage the risks posed to the security of network and information systems.
• Incident Reporting: Entities are required to report significant cyber incidents with detailed information swiftly, following guidelines set by the directive. This process is designed to standardize incident reporting across the EU, ensuring a prompt and effective response to cyber threats​​.

4. Proportionality and Adaptation

The directive also introduces provisions to ensure proportionality and adaptation to the specific needs and circumstances of different entities. This includes the flexibility for Member States to specify additional entities and sectors based on national risk assessments​​.

The NIS 2 Directive’s expanded scope and stringent requirements reflect a proactive and comprehensive EU approach to enhancing cybersecurity across a broad spectrum of sectors and entities. By identifying and classifying entities as essential or important, the directive ensures that a wide range of organizations implements robust cybersecurity practices, thus safeguarding Europe’s digital and economic security against evolving cyber threats.