I85PREP
⌘ K
NIS 2 LI study materials
NIS 2 LI study resources

NIS 2 LI practice questions

One question at a time. Build your NIS 2 LI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of the NIS 2 Directive

Under the NIS 2 Directive, which characteristic determines whether an entity falls within its scope as an essential or important entity?

  1. The entity operating in a listed sector and meeting size criteria or being of a specified type Correct answer.
  2. The entity's annual turnover exceeding a fixed euro threshold in all cases
  3. The entity holding a certification issued by ENISA
  4. The entity being headquartered in a NATO member state

Explanation

NIS 2 scopes entities primarily by sector and by size: medium and large entities in listed sectors are covered, plus certain entities regardless of size such as qualified trust service providers. Turnover thresholds are only part of the size test and are not applied uniformly to all sectors. Headquarters location in a military alliance and ENISA certification are not scoping criteria.

Question 2Fundamental concepts and principles of the NIS 2 Directive

How does the NIS 2 Directive distinguish essential entities from important entities?

  1. Essential entities are those that voluntarily register, while important entities are designated by ENISA
  2. Essential entities are those outside the EU, while important entities are established inside the EU
  3. Essential entities are those in Annex I sectors that are large, while important entities are all medium entities plus certain others Correct answer.
  4. Essential entities are always public bodies, while important entities are always private companies

Explanation

The Directive separates covered entities into two groups: essential entities, which include large entities in the sectors listed in Annex I and certain specified types, and important entities, which include medium entities in Annex I sectors and entities in Annex II sectors. The distinction drives the intensity of supervision, with essential entities subject to proactive oversight and important entities to ex post supervision.

Question 3Fundamental concepts and principles of the NIS 2 Directive

Which supervisory regime applies to important entities under the NIS 2 Directive?

  1. Ex post supervision, triggered where there is evidence of non-compliance Correct answer.
  2. No supervision, only self-assessment obligations
  3. Proactive, ex ante supervision including regular on-site audits
  4. Supervision delegated exclusively to the national data protection authority

Explanation

Important entities are subject to a lighter, ex post supervisory regime: competent authorities act when they receive evidence, information or indications of non-compliance. Essential entities, by contrast, are subject to proactive ex ante oversight that can include audits, inspections and requests for information. This graduated approach reflects the Directive's risk-based design.

Question 4Fundamental concepts and principles of the NIS 2 Directive

Which set of sectors is listed in Annex I of the NIS 2 Directive as sectors of high criticality?

  1. Energy, transport, banking, health, drinking water, wastewater, digital infrastructure, ICT service management, space and public administration Correct answer.
  2. Agriculture, fisheries, forestry, mining and construction
  3. Telecommunications, postal services, waste management, chemicals, food and manufacturing
  4. Retail, tourism, real estate, media and education

Explanation

Annex I lists sectors of high criticality, including energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, space and public administration. Annex II contains the other critical sectors such as postal, waste, chemicals, food, manufacturing, digital providers and research. The Annexes anchor the scope and the essential/important classification.

Question 5Fundamental concepts and principles of the NIS 2 Directive

A medium-sized company provides cloud computing services in the EU. How is it most likely classified under NIS 2?

  1. As an important entity, since digital providers fall in Annex II and medium size is sufficient there Correct answer.
  2. As an essential entity because cloud services are always essential
  3. As a critical entity under the CER Directive instead
  4. As outside scope because it is only medium-sized

Explanation

Cloud computing service providers are among the digital providers listed in Annex II. For Annex II sectors, medium-sized and large entities are covered, and they are classified as important entities rather than essential. Size and sector together produce the classification.

Question 6Fundamental concepts and principles of the NIS 2 Directive

What is the main objective of the NIS 2 Directive as stated in its framework?

  1. Achieving a high common level of cybersecurity across the Union Correct answer.
  2. Harmonising criminal penalties for cyber offences across Member States
  3. Establishing a single EU cybersecurity certification scheme
  4. Replacing national data protection laws with a unified regime

Explanation

NIS 2 aims to achieve a high common level of cybersecurity across the Union by setting baseline obligations for covered entities and harmonising supervision. It repeals and replaces the original NIS Directive to strengthen resilience and incident response. It does not set criminal law or replace data protection rules.

Question 7Fundamental concepts and principles of the NIS 2 Directive

Which Directive does NIS 2 repeal and replace?

  1. The eIDAS Regulation
  2. The GDPR
  3. The Cybersecurity Act
  4. The original NIS Directive (EU) 2016/1148 Correct answer.

Explanation

NIS 2 repeals and replaces Directive (EU) 2016/1148, the original NIS Directive, broadening its scope and strengthening obligations. The eIDAS Regulation, the Cybersecurity Act and the GDPR remain separate instruments. NIS 2 builds on but does not absorb them.

Question 8Fundamental concepts and principles of the NIS 2 Directive

What does the 'significant incident' concept require an entity to do under NIS 2?

  1. Notify the CSIRT or competent authority without undue delay, including an early warning within 24 hours Correct answer.
  2. Publish the incident in the national gazette
  3. Report to ENISA directly within one month
  4. Notify only its customers within 72 hours

Explanation

NIS 2 introduces a staged incident reporting regime: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Notifications go to the CSIRT or competent authority, not directly to ENISA or the public. The regime is designed to enable swift situational awareness and cross-border cooperation.

Question 9Fundamental concepts and principles of the NIS 2 Directive

Which governance obligation does NIS 2 place on the management bodies of essential and important entities?

  1. They must approve and oversee the cybersecurity risk-management measures and can be held liable for infringements Correct answer.
  2. They must personally operate the security operations centre
  3. They must obtain a security clearance from the national intelligence service
  4. They must delegate all cybersecurity decisions to an external auditor

Explanation

NIS 2 makes cybersecurity a governance responsibility: management bodies must approve and oversee the implementation of risk-management measures, and members can be held liable for infringements. Management must also undergo training. This shifts accountability from technical staff to the top of the organisation.

Question 10Fundamental concepts and principles of the NIS 2 Directive

Which of the following is one of the core cybersecurity risk-management measures that NIS 2 requires entities to adopt?

  1. Compulsory cyber insurance for all essential entities
  2. Supply chain security, including security-related aspects of relationships with suppliers and service providers Correct answer.
  3. Annual penetration testing by ENISA
  4. Mandatory use of a specific commercial firewall product

Explanation

NIS 2 lists a set of baseline risk-management measures, including risk analysis, incident handling, business continuity, supply chain security, vulnerability handling and cryptography. Supply chain security is explicitly included, reflecting dependencies on third parties. The Directive does not mandate specific products, ENISA-run testing or insurance.

Question 11Fundamental concepts and principles of the NIS 2 Directive

An entity suffers a significant incident. Within what timeframe must it submit an early warning under NIS 2?

  1. Within 24 hours of becoming aware of the incident Correct answer.
  2. Within one month of becoming aware of the incident
  3. Within 6 hours of becoming aware of the incident
  4. Within 72 hours of becoming aware of the incident

Explanation

The reporting timeline begins with an early warning within 24 hours of awareness, followed by an incident notification within 72 hours and a final report within one month. These staged deadlines allow authorities to react quickly while the entity continues its investigation. The clock starts from awareness, not from the incident's occurrence.

Question 12Fundamental concepts and principles of the NIS 2 Directive

Which entities can be covered by NIS 2 regardless of their size?

  1. Qualified trust service providers and certain other specified types such as sole providers of critical services Correct answer.
  2. All small and micro enterprises in the energy sector
  3. Only entities listed by the European Commission each year
  4. Only entities with more than 500 employees

Explanation

NIS 2 generally uses a size threshold, but certain entities are covered irrespective of size, such as qualified trust service providers, top-level domain name registries and DNS service providers, and providers of public electronic communications networks. Member States may also designate additional entities. This ensures critical functions are covered even when the operator is small.

Question 13Fundamental concepts and principles of the NIS 2 Directive

What role do national CSIRTs play in the NIS 2 framework?

  1. They act as the single point of contact for cross-border cooperation and handle incident reporting Correct answer.
  2. They set the EU-wide cybersecurity certification requirements
  3. They approve the annual budgets of essential entities
  4. They prosecute cyber criminals under criminal law

Explanation

CSIRTs are designated national bodies that monitor incidents, provide early warnings and support incident response, and they often serve as or support the single point of contact for cross-border cooperation. They are operational and coordination bodies, not certification authorities, prosecutors or budget approvers. Their role links national supervision with EU-level cooperation.

Question 14Fundamental concepts and principles of the NIS 2 Directive

What is the purpose of the Cooperation Group established under NIS 2?

  1. To issue binding individual decisions against non-compliant entities
  2. To coordinate cybersecurity policy and information exchange among Member States and support consistent implementation Correct answer.
  3. To operate the EU-wide SOC for all essential entities
  4. To manage the EU cybersecurity budget and allocate funding to entities

Explanation

The Cooperation Group brings together Member State representatives, the Commission and ENISA to coordinate policy, exchange information and promote consistent implementation of the Directive. It is a strategic and cooperative body, not a fund manager, an operational SOC or an enforcement authority. Enforcement remains with national competent authorities.

Question 15Fundamental concepts and principles of the NIS 2 Directive

How does NIS 2 treat the relationship between its cybersecurity obligations and the GDPR?

  1. NIS 2 replaces the GDPR for entities in covered sectors
  2. NIS 2 transfers all data protection supervision to CSIRTs
  3. NIS 2 prohibits processing personal data for security purposes
  4. NIS 2 obligations apply in addition to GDPR obligations, and personal data breaches may need to be reported under both regimes Correct answer.

Explanation

NIS 2 and the GDPR are complementary: entities must comply with both, and a single incident may trigger a NIS 2 notification to the CSIRT and a GDPR breach notification to the supervisory authority. NIS 2 explicitly states that it is without prejudice to Union law on data protection. It neither replaces nor overrides data protection rules.

Question 16Fundamental concepts and principles of the NIS 2 Directive

Which entity type is explicitly excluded from NIS 2 scope?

  1. Operators of critical infrastructure in the energy sector
  2. Small and micro enterprises, except where a size-independent category applies Correct answer.
  3. Qualified trust service providers
  4. Entities providing public electronic communications networks

Explanation

NIS 2 generally excludes small and micro enterprises from its scope, with exceptions for entities that fall into size-independent categories such as qualified trust service providers or public electronic communications providers. This keeps the administrative burden proportionate. The other listed types are expressly within scope.

Question 17Fundamental concepts and principles of the NIS 2 Directive

What is the function of the European Cyber Crisis Liaison Organisation Network (EU-CyCLONe) in the NIS 2 architecture?

  1. It replaces national CSIRTs in incident response
  2. It certifies cybersecurity products for the EU market
  3. It supports coordinated management of large-scale cybersecurity incidents and crises at the operational and political level Correct answer.
  4. It sets the fines for non-compliant entities

Explanation

EU-CyCLONe is a cooperation network of Member State crisis-management authorities that supports the coordinated management of large-scale incidents and crises. It complements the technical CSIRT network and the strategic Cooperation Group. It does not certify products, replace CSIRTs or impose fines.

Question 18Fundamental concepts and principles of the NIS 2 Directive

Which statement best describes the NIS 2 approach to supply chain risk?

  1. Entities must transfer all supply chain risk to the supplier by contract
  2. Entities must only use suppliers certified under an EU scheme
  3. Entities must terminate contracts with any supplier that has suffered an incident
  4. Entities must assess and manage security risks arising from suppliers and service providers as part of their risk-management measures Correct answer.

Explanation

NIS 2 requires entities to address security in their supply chain, including the security practices of suppliers and service providers, as part of their overall risk management. It does not impose a blanket certification requirement, automatic contract termination or full risk transfer. The obligation is to assess and mitigate, not to outsource accountability.

Question 19Fundamental concepts and principles of the NIS 2 Directive

What is the maximum level of administrative fine that NIS 2 requires Member States to provide for essential entities?

  1. At least EUR 10,000,000 or 2% of global annual turnover, whichever is higher
  2. At least EUR 7,000,000 or 1.4% of global annual turnover, whichever is higher Correct answer.
  3. Fines are set only by the European Commission
  4. At least EUR 20,000,000 or 1% of global annual turnover, whichever is higher

Explanation

NIS 2 requires Member States to provide for administrative fines for essential entities of at least EUR 7,000,000 or 1.4% of global annual turnover, whichever is higher. For important entities the minimum ceiling is EUR 7,000,000 or 1.4% as well, but the Directive sets a lower floor for important entities of EUR 7,000,000 or 1.4% depending on the transposition. The Directive sets minimum ceilings; Member States may go higher.

Question 20Fundamental concepts and principles of the NIS 2 Directive

Which statement reflects the NIS 2 principle of minimum harmonisation?

  1. Member States may adopt stricter rules provided they are consistent with Union law and do not lower the baseline Correct answer.
  2. Member States may lower the obligations for small entities in Annex I sectors
  3. Member States may exempt entities in their territory from all obligations
  4. Member States must adopt exactly the same national law with no variation

Explanation

NIS 2 sets a baseline that Member States must implement but allows stricter national rules where consistent with Union law. This preserves national discretion while preventing a race to the bottom. Member States cannot exempt covered entities or lower the baseline below the Directive's requirements.

Question 21Fundamental concepts and principles of the NIS 2 Directive

What does the 'single point of contact' concept mean in NIS 2?

  1. A national body that liaises with the Commission, the Cooperation Group and other Member States on NIS 2 matters Correct answer.
  2. A single EU-wide authority that supervises all entities
  3. A designated employee inside each entity responsible for all IT operations
  4. A private company that audits all essential entities

Explanation

Each Member State designates a single point of contact to liaise with EU institutions and other Member States and to coordinate cross-border cooperation. It is a national coordination function, not a central EU supervisor, an internal role in entities or a private auditor. It may be hosted by the same body as a CSIRT or competent authority.

Question 22Fundamental concepts and principles of the NIS 2 Directive

Which of the following best describes the NIS 2 obligation regarding cybersecurity training?

  1. Training must be delivered only by ENISA-accredited providers
  2. Training is optional and left entirely to market demand
  3. Management bodies must undergo training, and entities must provide training to staff to enable them to recognise and respond to risks Correct answer.
  4. Only IT staff must be trained, with no obligation for management

Explanation

NIS 2 explicitly requires management bodies to undergo training and encourages entities to provide cybersecurity training to staff. This reflects the governance and human-factor focus of the Directive. Training is not limited to IT staff and is not restricted to ENISA-accredited providers.

Question 23Fundamental concepts and principles of the NIS 2 Directive

An important entity in the manufacturing sector repeatedly fails to comply with its risk-management obligations. Which supervisory action is most consistent with NIS 2?

  1. The competent authority may issue binding instructions, order compliance and impose administrative fines Correct answer.
  2. The competent authority may immediately withdraw the entity's operating licence without any procedure
  3. The competent authority may refer the matter to ENISA for criminal prosecution
  4. The competent authority may only send an advisory letter with no legal effect

Explanation

For important entities, supervision is ex post, but once non-compliance is established the competent authority can use enforcement measures such as binding instructions, compliance orders and administrative fines. Any action must follow national procedural law. Advisory letters alone would not reflect the Directive's enforcement tools, and ENISA does not prosecute.

Question 24Fundamental concepts and principles of the NIS 2 Directive

Which statement about the NIS 2 transposition deadline and application date is correct?

  1. Member States had to transpose by 1 January 2023, with application from the same date
  2. There is no transposition deadline; the Directive applies directly
  3. Member States had to transpose by 17 October 2024, with application from 18 October 2024 Correct answer.
  4. Member States must transpose by 2030, with application from 2031

Explanation

NIS 2 required Member States to transpose by 17 October 2024, and the obligations apply from 18 October 2024. Directives require national transposition and do not apply directly in the same way as regulations. The deadline is a key milestone for compliance planning.

Question 25Fundamental concepts and principles of the NIS 2 Directive

Which best explains why NIS 2 uses a size-based threshold together with sector-based lists?

  1. To ensure only the largest multinationals are covered
  2. To exclude all private companies from the regime
  3. To replace national risk assessments with EU-level lists
  4. To target entities whose disruption could affect essential services or the economy while keeping the burden proportionate Correct answer.

Explanation

The combination of sector lists and size thresholds targets entities whose disruption would have significant societal or economic impact while avoiding disproportionate burdens on small operators. National risk assessments still inform additional designations. The design is not intended to exclude private companies or focus only on the largest multinationals.

Question 26Fundamental concepts and principles of the NIS 2 Directive

Under NIS 2, which criterion determines whether a medium-sized enterprise in a listed sector falls within the scope of the Directive?

  1. It must be designated by a national authority as critical infrastructure.
  2. It must exceed the medium-sized enterprise threshold in the sector-specific Union act.
  3. It must have an annual turnover above EUR 50 million regardless of headcount.
  4. It must qualify as a medium-sized enterprise under the SME Recommendation and operate in a sector listed in Annex I or II. Correct answer.

Explanation

NIS 2 uses a size-based threshold: entities employing 50 or more staff or with annual turnover and balance sheet total above EUR 10 million are in scope if they operate in a sector listed in Annex I or II. Medium-sized enterprises (50-249 staff) therefore qualify on that basis, subject to the Directive's exceptions. The threshold is defined by reference to the SME Recommendation, not by sector-specific turnover rules or national designation.

Question 27Fundamental concepts and principles of the NIS 2 Directive

Which sectors are listed in Annex I of NIS 2 as sectors of high criticality?

  1. Energy, transport, banking, health, water, digital infrastructure, ICT service management, space, and public administration. Correct answer.
  2. Agriculture, fisheries, forestry, and mining.
  3. Defence, education, retail, and tourism.
  4. Manufacturing, food, chemicals, research, and postal and courier services only.

Explanation

Annex I of NIS 2 lists the sectors of high criticality: energy, transport, banking, health, water, digital infrastructure, ICT service management, space, and public administration. Annex II lists other critical sectors such as postal and courier services, waste management, chemicals, food, manufacturing, digital providers, and research. The distinction matters because Annex I entities are generally essential entities and Annex II entities important entities, subject to size and exceptions.

Question 28Fundamental concepts and principles of the NIS 2 Directive

What is the default classification under NIS 2 for a large enterprise operating in a sector listed in Annex I?

  1. It is outside scope because Annex I covers only public bodies.
  2. It is an important entity unless a Member State designates it otherwise.
  3. It is an essential entity unless a Member State decides otherwise. Correct answer.
  4. It is a critical infrastructure operator under the CER Directive.

Explanation

NIS 2 distinguishes essential and important entities. Entities in Annex I sectors that meet the size threshold are essential entities by default, while those in Annex II sectors are important entities. Member States may designate additional entities as essential or important on a case-by-case basis, but the default for large Annex I operators is essential.

Question 29Fundamental concepts and principles of the NIS 2 Directive

Which national body does NIS 2 require Member States to designate to oversee the implementation of the Directive at national level?

  1. The European Union Agency for Cybersecurity (ENISA) acting as national supervisor.
  2. A single national cybersecurity certification authority.
  3. One or more competent authorities, a single point of contact, and one or more CSIRTs. Correct answer.
  4. A joint supervisory body composed of the Cooperation Group and Europol.

Explanation

NIS 2 requires each Member State to designate one or more competent authorities responsible for cybersecurity risk management and reporting, a single point of contact to liaise with other Member States and the Commission, and one or more CSIRTs. These bodies may be housed in the same organisation but perform distinct functions. ENISA supports cooperation but does not act as a national supervisor.

Question 30Fundamental concepts and principles of the NIS 2 Directive

An essential entity identifies a vulnerability in a service it provides. How does NIS 2 treat the obligation to notify this vulnerability?

  1. Vulnerabilities are never notifiable; only incidents that have already caused disruption are reported.
  2. The entity must publish the vulnerability in a public register within 24 hours.
  3. Under NIS 2 itself, identification alone does not create a blanket notification duty; coordinated vulnerability disclosure mechanisms are available. Correct answer.
  4. The entity must notify the vulnerability only if it has already been exploited in an incident.

Explanation

NIS 2 distinguishes coordinated vulnerability disclosure under Article 12 and voluntary notifications under Article 30 from mandatory reporting of significant incidents under Article 23. Merely identifying a vulnerability does not create a blanket CSIRT notification duty. Additional duties may arise under national law or other legislation.

Question 31Fundamental concepts and principles of the NIS 2 Directive

A cloud computing service provider is an important entity under NIS 2. Which supervisory approach applies to it compared with an essential entity?

  1. It is subject to ex post supervision, meaning authorities act when evidence of non-compliance emerges, rather than routine ex ante oversight. Correct answer.
  2. It is subject to the same ex post supervision as essential entities, including regular on-site audits.
  3. It is exempt from supervision because digital providers are regulated only under the DSA.
  4. It is supervised exclusively by ENISA rather than by national authorities.

Explanation

NIS 2 distinguishes the supervisory regime for essential and important entities. Essential entities are subject to ex ante supervision, including proactive audits and inspections, while important entities are subject to ex post supervision triggered by evidence of non-compliance. Both remain subject to the same substantive risk-management and reporting obligations.

Question 32Fundamental concepts and principles of the NIS 2 Directive

Which enforcement measure may a competent authority impose on an essential entity for a breach of NIS 2 obligations?

  1. Automatic withdrawal of the entity's operating licence without any prior procedure.
  2. Referral of the entity to the European Commission for infringement proceedings.
  3. Immediate criminal prosecution of the entity's management body.
  4. A binding instruction requiring the entity to remedy the deficiency within a set period. Correct answer.

Explanation

NIS 2 provides a set of administrative enforcement measures, including binding instructions, orders to implement security recommendations, and orders to bring compliance within a specified period. Fines and other penalties may also apply. Criminal prosecution and licence withdrawal are not the standard NIS 2 enforcement tools, and infringement proceedings against private entities are not brought by the Commission.

Question 33Fundamental concepts and principles of the NIS 2 Directive

Which statement best describes the role of the NIS 2 Cooperation Group in relation to national supervisory practices?

  1. It approves each Member State's list of essential entities before publication.
  2. It manages the day-to-day incident response for cross-border incidents.
  3. It facilitates strategic cooperation and exchange of information and best practices among Member States. Correct answer.
  4. It adopts binding decisions that directly replace national supervisory decisions.

Explanation

The Cooperation Group is a strategic body composed of Member State representatives, the Commission, and ENISA. It supports cooperation, information exchange, and the development of best practices, including on supervisory approaches. It does not replace national authorities, manage operational incident response, or approve national entity lists.

Question 34Fundamental concepts and principles of the NIS 2 Directive

An important entity becomes aware of a significant incident. Which sequence of reporting steps does NIS 2 require?

  1. A final report within 24 hours, followed by an early warning within 72 hours.
  2. A single notification within 72 hours that serves as both early warning and final report.
  3. An early warning within 72 hours and a final report within three months.
  4. An early warning within 24 hours, an incident notification within 72 hours, and a final report within one month. Correct answer.

Explanation

NIS 2 sets a three-stage reporting timeline: an early warning without undue delay and in any event within 24 hours of becoming aware of the significant incident, an incident notification within 72 hours, and a final report within one month. The early warning indicates whether the incident is suspected to be malicious or cross-border, while the final report provides a detailed description and remedial measures.

Question 35Fundamental concepts and principles of the NIS 2 Directive

Which governance requirement does NIS 2 impose on the management bodies of essential and important entities?

  1. They must hold a professional cybersecurity certification before taking office.
  2. They must approve and oversee the entity's cybersecurity risk-management measures and may be held liable for infringements. Correct answer.
  3. They must report directly to ENISA on an annual basis.
  4. They must delegate all cybersecurity decisions to an external auditor.

Explanation

NIS 2 places responsibility for compliance on the management bodies of essential and important entities. They are required to approve, oversee, and be accountable for the implementation of cybersecurity risk-management measures, and Member States must provide for liability for infringements. This is intended to embed cybersecurity at the highest level of governance.

Question 36Fundamental concepts and principles of the NIS 2 Directive

How does NIS 2 address the relationship between its cybersecurity obligations and the GDPR?

  1. NIS 2 is without prejudice to the GDPR, and personal data breach notification under the GDPR remains separate. Correct answer.
  2. NIS 2 prevails over the GDPR whenever a cybersecurity incident involves personal data.
  3. Compliance with NIS 2 automatically satisfies all GDPR security obligations.
  4. The GDPR is suspended for entities that are subject to NIS 2.

Explanation

NIS 2 states that it is without prejudice to Union law on the protection of personal data, in particular the GDPR and the ePrivacy Directive. A significant incident may trigger both NIS 2 reporting to the CSIRT and GDPR breach notification to the supervisory authority, and these obligations operate in parallel. NIS 2 does not displace or suspend the GDPR.

Question 37Fundamental concepts and principles of the NIS 2 Directive

Which entities may be brought into the scope of NIS 2 even if they do not meet the size threshold?

  1. Only entities that voluntarily opt in to the regime.
  2. All small and micro enterprises in the manufacturing sector.
  3. Only entities owned by the national government.
  4. Entities providing services whose disruption could significantly affect public safety, security, or health, or that are sole providers of a critical service. Correct answer.

Explanation

NIS 2 allows Member States to include entities regardless of size where they are critical for society or the economy, for example because their disruption could affect public safety, security, or health, or because they are the sole provider of a service essential to critical activities. This is an exception to the general size-based threshold and is applied on a case-by-case basis.

Question 38Fundamental concepts and principles of the NIS 2 Directive

A managed service provider is established in one Member State and provides services to clients in several others. Which supervisory principle applies under NIS 2?

  1. The provider is supervised only by the Member State where its largest client is located.
  2. The provider is supervised by the Member State where it has its main establishment, with mutual assistance among authorities. Correct answer.
  3. The provider is supervised jointly by the Commission and ENISA.
  4. Each client's Member State supervises the provider independently for the services delivered there.

Explanation

NIS 2 follows a main-establishment principle for certain cross-border entities, including DNS service providers, TLD registries, cloud providers, data centres, content delivery networks, managed service providers, and managed security service providers. The authority of the Member State of the main establishment supervises the entity, and other Member States' authorities cooperate and assist rather than duplicate supervision.

Question 39Fundamental concepts and principles of the NIS 2 Directive

Which statement best explains the function of the NIS 2 peer-review mechanism?

  1. It reviews individual entities' security measures and assigns compliance scores.
  2. It replaces national supervision for entities operating in more than one Member State.
  3. It allows the Commission to audit Member States' supervisory authorities and impose corrective measures.
  4. It organises mutual reviews among Member States' authorities on their supervisory practices and capacities. Correct answer.

Explanation

NIS 2 introduces a peer-review mechanism under which Member States' authorities review each other's supervisory practices, capacities, and methodologies. The aim is to build trust, share good practice, and promote consistent implementation across the Union. It does not give the Commission direct audit powers over national authorities, nor does it assess individual entities.

Question 40Fundamental concepts and principles of the NIS 2 Directive

Which statement accurately reflects the relationship between NIS 2 and the CER Directive?

  1. NIS 2 focuses on cybersecurity risk management and reporting, while the CER Directive addresses the physical resilience of critical infrastructure, and they apply cumulatively. Correct answer.
  2. NIS 2 applies only to public entities and the CER Directive only to private entities.
  3. NIS 2 and the CER Directive cover the same entities and obligations, and compliance with one satisfies the other.
  4. The CER Directive repeals NIS 2 for critical infrastructure operators.

Explanation

NIS 2 and the CER Directive are complementary instruments adopted together. NIS 2 addresses the cybersecurity of network and information systems, while the CER Directive strengthens the physical resilience of critical infrastructure. An entity may be subject to both, and the obligations are cumulative rather than mutually exclusive.

Question 41Scoping and planning a NIS 2 compliance programme

A company is deciding whether it falls within the scope of NIS 2. Which criterion determines whether an entity is covered as a 'important entity' under the Directive?

  1. Being designated by a Member State authority as critical infrastructure following a national risk assessment
  2. Having more than 500 employees and a turnover above EUR 100 million in the internal market
  3. Providing cloud computing services to at least 10,000 business customers within the Union
  4. Operating in a listed sector and meeting the size threshold for medium-sized enterprises or being of a type specifically named regardless of size Correct answer.

Explanation

NIS 2 applies to entities in the sectors listed in its annexes that are medium-sized or larger, or that are of a type specifically named in the Directive regardless of size. The classification as essential or important then depends on sector and specific criteria such as criticality. National designations and customer counts are not the general scoping test.

Question 42Scoping and planning a NIS 2 compliance programme

Under NIS 2, which pair of categories is used to classify entities that fall within scope?

  1. Critical entities and significant entities
  2. High-criticality entities and standard entities
  3. Operators of essential services and digital service providers
  4. Essential entities and important entities Correct answer.

Explanation

NIS 2 splits in-scope entities into essential entities and important entities, with different supervisory regimes attached to each. The older NIS 1 terminology of operators of essential services and digital service providers was replaced. The other pairings come from different legal instruments or are invented.

Question 43Scoping and planning a NIS 2 compliance programme

Which sector is explicitly listed in the annexes of NIS 2 as a sector of high criticality?

  1. Real estate
  2. Retail trade
  3. Energy Correct answer.
  4. Legal consultancy

Explanation

Energy is one of the sectors of high criticality listed in Annex I of NIS 2, alongside sectors such as transport, banking and health. Retail trade, real estate and legal consultancy are not listed sectors. This matters because sector listing is the first step in scoping an entity.

Question 44Scoping and planning a NIS 2 compliance programme

A medium-sized enterprise operates a regional water distribution network. How should a compliance planner classify it at the scoping stage?

  1. As a digital service provider, because distribution relies on networked control systems
  2. As an essential entity, because water supply is in a sector of high criticality and the entity meets the size threshold Correct answer.
  3. As an important entity, because all utilities are automatically treated as important rather than essential
  4. As out of scope, because only large enterprises in the water sector are covered

Explanation

Drinking water supply and distribution is listed among the sectors of high criticality, and entities meeting the size threshold are essential entities. Important-entity status generally applies to other listed sectors or to specifically named types. Being medium-sized does not exclude the entity, since the threshold is medium-sized or larger.

Question 45Scoping and planning a NIS 2 compliance programme

Which of the following is a key difference in the supervisory regime between essential and important entities under NIS 2?

  1. Essential entities may self-certify compliance, while important entities must undergo annual third-party audits
  2. Important entities are supervised only by the European Union Agency for Cybersecurity, while essential entities are supervised nationally
  3. Essential entities are subject to proactive, ex ante supervision, while important entities are supervised ex post after evidence of non-compliance Correct answer.
  4. Essential entities are exempt from incident reporting, while important entities must report all incidents

Explanation

NIS 2 distinguishes the supervisory approach: competent authorities supervise essential entities proactively and can conduct regular audits and inspections, whereas important entities are generally subject to a reactive, ex post approach triggered by evidence of non-compliance. Reporting duties apply to both categories. Self-certification and EU-level supervision are not features of the regime.

Question 46Scoping and planning a NIS 2 compliance programme

An entity provides managed security services to clients across several Member States. What is the primary basis for determining whether it is in scope of NIS 2?

  1. Whether it has a physical office in the Member State where it operates
  2. Whether its clients are themselves essential entities
  3. Whether it holds a certification under an EU cybersecurity scheme
  4. Whether it qualifies as a medium-sized or larger enterprise in a listed sector such as ICT service management Correct answer.

Explanation

Managed service providers fall under the ICT service management sector, and scoping depends on the size threshold and the sector listing. Certification status and the nature of the client base are not scoping criteria. A physical establishment is not required for scope, although it affects jurisdiction.

Question 47Scoping and planning a NIS 2 compliance programme

What is the significance of the 'main establishment' concept when planning a NIS 2 compliance programme for a cross-border entity?

  1. It determines whether the entity is classified as essential or important
  2. It determines the language in which incident reports must be submitted
  3. It determines the maximum fine the entity can face under national law
  4. It determines which Member State's competent authority has jurisdiction and where the entity is registered for supervision Correct answer.

Explanation

For entities providing services in more than one Member State, jurisdiction is generally attributed to the Member State where the main establishment is located. This affects which authority supervises the entity and where registration occurs. It does not set fine levels, classification or reporting language.

Question 48Scoping and planning a NIS 2 compliance programme

Which action is the most appropriate first step when starting a NIS 2 scoping exercise for a group of companies?

  1. Purchase cyber insurance to cover potential administrative fines
  2. Draft the incident notification templates required by the competent authority
  3. Immediately appoint a third-party auditor to certify the group's security management system
  4. Build an inventory of services and map each business unit to the NIS 2 sector annexes and size thresholds Correct answer.

Explanation

Scoping must begin with an accurate inventory of services and entities, mapped against the sector annexes and size thresholds, because obligations flow from that determination. Audits, templates and insurance are later steps that depend on knowing which entities are in scope. Starting elsewhere risks misallocating effort.

Question 49Scoping and planning a NIS 2 compliance programme

Under NIS 2, how does the size threshold generally treat an entity that is part of a larger group?

  1. Only the global headcount of the entire group is considered, regardless of the entity's own size
  2. The entity's own staff headcount and financial figures are assessed, with group-level aggregation relevant where the entity is a subsidiary assessed in its own right Correct answer.
  3. Size is irrelevant if any group company operates in a listed sector
  4. The group is always treated as a single entity and all subsidiaries are essential entities

Explanation

The size assessment generally looks at the entity's own headcount and financial data, while recognising that group relationships can matter when determining the entity concerned. It is not the case that group-wide headcount alone decides, nor that all subsidiaries become essential automatically. Size remains relevant even in listed sectors.

Question 50Scoping and planning a NIS 2 compliance programme

Which of the following best describes the role of national transposition in planning a NIS 2 compliance programme?

  1. The Directive applies identically in all Member States without any national implementing measures
  2. National law may exempt entities in listed sectors from the Directive's requirements
  3. Transposition only affects public-sector entities, not private companies
  4. Member States transpose the Directive into national law, so thresholds, registration details and authority procedures may differ between countries Correct answer.

Explanation

NIS 2 is a Directive, so Member States must adopt national implementing measures, which can vary in procedural detail such as registration portals and authority contacts. The core requirements are harmonised but practical planning must reference the applicable national law. Transposition does not allow blanket exemptions for listed sectors or apply only to public bodies.