NIS 2 LI key terms

An organisation type listed in Annex I of the directive (energy, transport, banking, health, water, digital infrastructure, ICT service management, public administration, space) that is automatically in scope when it meets or exceeds the size thresholds, regardless of sector criticality assessment.

An organisation in an Annex I or Annex II sector that falls under the directive but is not classified as essential, typically because it is below the large-enterprise threshold or because its sector is listed in Annex II rather than Annex I.

The scoping test that brings in medium and large enterprises, generally 50 or more employees or annual turnover and balance sheet total above 10 million euro, with Member States able to designate additional entities regardless of size.

The two sector lists attached to the directive: Annex I covers highly critical sectors whose large entities are essential, while Annex II covers other critical sectors whose large entities are important.

A national power allowing authorities to bring an entity into scope irrespective of its size, where it is critical for the economy or society or provides services relied upon by other in-scope entities.

A category used in some national implementations for entities designated as critical regardless of size, often subject to the same obligations as important entities but with lighter supervision than essential entities.

The national body designated to supervise and enforce the directive in a Member State, handling registration, audits, inspections, and penalties for entities established on its territory.

A Computer Security Incident Response Team designated under the directive to receive incident notifications, provide early warning and technical assistance, and act as the national point of contact for coordinated vulnerability disclosure.

A national or shared digital channel through which entities submit incident notifications once, with the platform distributing them to the CSIRT and other authorities, reducing duplicate reporting effort.

The duty on in-scope entities to submit identifying and contact information to the competent authority, including sector, service type, and relevant IP ranges, and to update it when facts change.

The requirement that the highest governing body of an entity approve the cybersecurity risk-management measures it implements, oversee their application, and bear accountability for non-compliance.

The obligation for members of the governing body to undertake regular cybersecurity training so they can identify risks and assess management practices, and to encourage similar training for staff.

The principle that senior management can be held personally liable, including through temporary bans from management roles, for an entity's failure to comply with its cybersecurity obligations.

The set of technical, operational, and organisational controls an entity must apply to manage cybersecurity risks, covering analysis, policies, incident handling, continuity, supply chain, and encryption.

The benchmark used to judge whether chosen security measures are proportionate and current, requiring entities to consider available technology, implementation costs, and the likelihood and severity of risks.

A risk-treatment stance that considers every plausible cause of disruption, from cyber attacks to physical events and human error, rather than focusing only on a single threat category.

The principle that the measures, documentation, and reporting effort applied should match the entity's exposure, size, and the criticality of the services it provides, avoiding one-size-fits-all controls.

Measures ensuring an entity can keep providing or restore its services during and after an incident, including backup management, disaster recovery, and tested crisis response plans.

The practice of maintaining protected copies of data and systems with tested restoration procedures, forming part of continuity measures and a frequent target of attacker activity.

The obligation to assess and manage risks arising from direct suppliers and service providers, considering their security practices, product quality, and the resilience of the wider value chain.

The due-diligence activity of evaluating a vendor's security posture and contractual commitments before and during the relationship, including vulnerability disclosure expectations and incident notification duties.

Clauses in supplier agreements that set security expectations, such as patching timelines, breach notification, audit rights, and disclosure of vulnerabilities affecting the delivered product or service.

The process of identifying, assessing, remediating, and tracking security weaknesses in systems and products, including the use of threat intelligence and vulnerability databases.

A structured process for reporting vulnerabilities to the party responsible for a product or service, allowing time for remediation before public disclosure, often facilitated by a CSIRT.

An event that compromises the availability, authenticity, integrity, or confidentiality of stored, transmitted, or processed data or of the services offered by or accessible through network and information systems.

An incident that causes severe operational disruption or financial loss for the entity or affects other persons through considerable material or non-material damage, triggering the reporting obligations.

The first-stage report due without undue delay and generally within 24 hours of becoming aware of a significant incident, indicating suspected malicious cause and cross-border impact where relevant.

The second-stage report, generally due within 72 hours of awareness, giving an initial assessment of severity, impact, and indicators of compromise, and where possible the attacker's tactics.

The concluding incident report, generally due within one month of the notification, describing root cause, applied mitigation, cross-border effects, and lessons learned.

A documented set of roles, escalation paths, communication lines, and technical playbooks that guides an entity from detection through containment, recovery, and post-incident review.

A recurring programme that builds staff understanding of cyber risks, safe behaviour, and reporting duties, expected to be mandatory and tailored to the roles people perform.

An access control combining at least two independent factors such as a password and a hardware token or biometric, expected for privileged and remote access under the directive's measures.

Measures using cryptographic techniques to protect data confidentiality, integrity, and authenticity, including encryption at rest and in transit and secure key management.

The policy and technical mechanisms that limit who and what can reach systems and data, built on least privilege, role separation, and periodic review of entitlements.

Maintaining an accurate inventory of hardware, software, data, and services with owners and criticality ratings, forming the foundation for scoping, risk assessment, and vulnerability management.

The documented list of in-scope entities, services, locations, and dependencies used to plan a compliance programme and to decide which obligations and authorities apply.

Authorised simulated attacks against systems to validate controls and reveal exploitable weaknesses, sometimes required by supervisors for essential entities on a risk-based schedule.

The oversight regime applied by competent authorities, using ex-ante and ex-post tools such as audits, inspections, and information requests, with lighter treatment for important entities.

A monetary penalty imposed for breach of the directive's obligations, commonly tiered so that essential entities face higher maxima than important entities, alongside other corrective measures.

The management practice of reviewing incidents, audit findings, and performance metrics to update controls, policies, and training, keeping the security programme aligned with evolving risks.