On this page
The sector alone doesn't decide whether you're essential or important - your size does too. See the classification section further down. First, the 18 sectors.
Quick check: are you covered?
- Does your organisation operate in one of the 18 sectors below?
- Are you medium-sized or larger, i.e. at least 50 employees or more than EUR 10 million in turnover? Include group companies and partner enterprises.
- Are you among those covered regardless of size? That includes regions, municipalities and municipal associations, among others providers of DNS services, top-level domain registries and qualified trust services, and organisations covered by the CER Directive.
If you answer yes to questions 1 and 2, or to question 3, you are most likely covered.
11 sectors of high criticality
Energy
Electricity grid operators, power generation, district heating, oil and gas, hydrogen
Transport
Air, rail, water, and road transport
Banking
Banks and credit institutions
Financial market infrastructure
Trading venues and central counterparties
Health
Hospitals, healthcare providers, laboratories, pharmaceutical manufacturers
Drinking water
Public water utilities
Waste water
Public wastewater and treatment utilities
Digital infrastructure
Data centres, cloud services, DNS providers, internet exchange points, telecom operators
ICT service management (B2B)
Managed service and security service providers running IT for other companies
Public administration
Central government bodies, regions, municipalities and municipal associations. The last three are covered regardless of size.
Space
Satellite operators and space infrastructure
7 other critical sectors
Postal and courier services
Postal operators, courier and parcel delivery companies
Waste management
Waste management and recycling companies
Manufacture, production and distribution of chemicals
Chemical manufacturers and distributors
Production, processing and distribution of food
Food producers, wholesalers, large-scale distributors
Manufacturing
Medical devices, electronics, machinery, motor vehicles, other transport equipment
Digital providers
Online marketplaces, search engines, social networking platforms
Research
Research organisations
Essential or important - what decides it?
Size decides it, not just the sector. Large organisations (generally 250+ employees or over €50M in revenue) in the 11 sectors of high criticality are classed as essential - they get planned, more active supervision and a higher sanctions cap. Medium-sized organisations (50-249 employees or €10-50M in revenue) in the same 11 sectors, plus all organisations above the threshold in the 7 other critical sectors, are classed as important - supervision there is reactive, triggered when the authority has reason to suspect non-compliance. Smaller organisations below the thresholds generally aren't covered directly, but can be covered indirectly as a supplier to one that is.
Frequently asked questions
Are small companies covered by NIS2?
As a rule, no. Small and micro enterprises are not covered, except for organisations covered regardless of size. A small company can still be affected indirectly, as a supplier to someone who is covered.
Are municipalities and regions covered?
Yes. Regions, municipalities and municipal associations are covered regardless of size, under the public administration sector. If they also run other operations within the law's sectors, they may be covered under several sectors.
How do we calculate our size?
Size is assessed by number of employees or turnover. You need to include linked and partner enterprises, for example companies in the same group.
Want to see it with your own organisation?
Getting started as a customer takes a few minutes. You choose frameworks, answer at your own pace and build compliance step by step - without consultancy fees.