NIS 2 Directive: which sectors are concerned?

On 10 November 2022, Members of the European Parliament adopted the NIS 2 Directive (Network and Information Security 2), which aims to strengthen cybersecurity requirements for European companies. It builds on the NIS Directive, adopted six years earlier, which had not been enough to cope with the rise in cyberattacks across Europe. For a better understanding of the move from NIS to NIS 2, you can refer to this blog post.

One of the main changes concerns the scope of the entities covered by the new directive, which is much broader. Who falls under the NIS 2 Directive?

ALocation of the organisation

According to Article 2 of the official text, the directive only concerns organisations that provide their services or carry out their activities within the EU. Each country is then responsible for the organisations providing a service or carrying out an activity on its territory. For example, the transposition of NIS 2 in Belgium, already adopted on 26 April 2024 and known as the Law establishing a framework for the cybersecurity of network and information systems of general interest for public security, only concerns Belgian companies.

BSize of the organisation

NIS 2 will apply to all organisations considered to be medium-sized or large enterprises within the meaning of Commission Recommendation 2003/361/EC of 6 May 2003.

Under this method, a company's size is assessed not only by its number of employees but also by its annual turnover. A medium-sized enterprise therefore meets at least one of the following two conditions:

• at least 50 full-time staff;
• at least €10 million in total annual turnover.

However, this size criterion will not be a necessary condition in two special cases. Regardless of their size, entities belonging to either of these two types of organisation will necessarily fall under NIS 2:

• digital infrastructure providing certain services (DNS services, top-level domain name registries, qualified trust services, public electronic communications networks, public electronic communications services, publicly available electronic communications services);
• public administration (central and regional government).

CServices provided

The European text lists in its annexes all the sectors to which the directive will apply. Annex I defines the “sectors of high criticality” and Annex II the “other critical sectors”:

Article 3 of the directive distinguishes between two types of regulated entities according to their level of criticality.

• Essential entities (EEs): large enterprises within the meaning of the Recommendation of 6 May 2003 (more than 250 employees and/or more than €50 million in turnover) that belong to the “sectors of high criticality” (defined above), as well as the two special cases of digital infrastructure and public administrations.
• Important entities (IEs): medium-sized enterprises within the meaning of the Recommendation of 6 May 2003 that belong to the “sectors of high criticality”, as well as medium-sized and large enterprises that belong to the “other critical sectors”.

The directive brings about “a real change in terms of volume”. The previous NIS Directive only covered 7 sectors of activity, split between operators of essential services (OES) and digital service providers (DSPs). With the new distinction between essential and important entities, 18 sectors of activity will now be affected.

In France, there are thought to be around 600 types of entities, according to estimates by Yves Verhoeven, ANSSI's Deputy Director for Strategy. This could represent 10,000 different entities in total in France.