NIS 2 Foundation key terms

A public or private organisation whose disruption would seriously affect society or the economy, classified by size and sector, and subject to stricter supervision than important entities.

An organisation falling within a covered sector but not qualifying as essential, typically a medium-sized enterprise, receiving lighter supervisory treatment than essential entities.

The grouping of covered organisations into annexes of high-criticality sectors (energy, transport, health, digital infrastructure, etc.) and other critical sectors, which determines entity category and obligations.

The set of organisations, sectors, and services the directive covers, determined by sector, size thresholds, and exceptions such as micro and small enterprises.

The employee and turnover criteria used to decide whether an organisation is in scope, generally medium enterprises and larger, with sector-specific and criticality-based exceptions.

The process by which each EU member state transposes the directive into national law, designating authorities, establishing penalties, and setting registration duties.

A national body designated to supervise entities in a specific sector or region, enforce obligations, and coordinate with other authorities and the EU cooperation group.

A Computer Security Incident Response Team designated under the directive to receive incident notifications, provide early warning, and support entities during significant incidents.

Technical, operational, and organisational controls an entity must adopt to protect network and information systems and reduce the likelihood and impact of incidents.

The standard requiring measures to reflect current technology and security practice, so controls must be updated as threats and available solutions evolve.

The principle that security measures must be appropriate to the entity's exposure, size, and the risk posed, avoiding both under- and over-investment in controls.

A risk-management stance that considers every plausible threat source rather than only a narrow list, including natural events, accidents, and deliberate attacks.

A structured assessment of threats, vulnerabilities, and potential impacts used to select and prioritise security measures and to justify residual risk decisions.

The decision and action taken in response to assessed risk, such as mitigating, transferring, avoiding, or accepting it, documented and reviewed periodically.

The risk remaining after controls are applied, which management must consciously accept and monitor rather than assume eliminated.

The capability to detect, contain, eradicate, and recover from security incidents, supported by documented procedures, roles, and escalation paths.

Preparedness to keep critical services running or restore them quickly, including backup management, disaster recovery, and crisis management arrangements.

The practice of maintaining protected, tested copies of data and systems so operations can be restored after disruption, ransomware, or data loss.

The organisational structure and decision-making arrangements activated during major incidents to coordinate response, communication, and recovery at senior level.

Assessing and managing risks arising from direct suppliers and service providers, including their security practices and the products or services they deliver.

The evaluation of a vendor's security posture and contractual commitments before and during a relationship, used to select and monitor critical dependencies.

The ongoing process of identifying, prioritising, and remediating weaknesses in systems and software, including timely patching and disclosure handling.

Rules and mechanisms that limit who or what can use systems and data, including authentication, authorisation, and privileged access management.

Authentication requiring two or more independent factors, such as a password plus a device or biometric, reducing the impact of stolen credentials.

The use of encryption and related techniques to protect data confidentiality and integrity, including policy on algorithms, key management, and data in transit or at rest.

Basic, widely applicable practices such as patching, strong authentication, least privilege, and awareness training that reduce common attack success.

Education for staff and, where relevant, management on cyber threats and safe behaviour, required as part of the entity's risk-management measures.

The board or equivalent governing organ that approves and oversees cybersecurity measures and bears accountability for compliance with the entity's obligations.

The rule that governing bodies can be held liable for failures to approve, oversee, or implement required cybersecurity measures, with possible penalties for the body itself.

The obligation for members of the management body to undertake cybersecurity training, or to promote similar training for staff, to enable effective oversight.

An event that seriously disrupts service provision or causes substantial operational or financial loss, triggering the directive's notification duties to the CSIRT or authority.

The duty to report significant incidents to the competent authority or CSIRT within set deadlines, using prescribed content such as nature, impact, and measures taken.

A first, rapid notification of a significant incident, due shortly after detection, indicating suspected cause and harm so authorities can respond quickly.

A more detailed follow-up notification assessing the incident, its severity, indicators of compromise, and applied or planned mitigation, submitted after the early warning.

The concluding notification that describes the root cause, the measures taken, and cross-border impact, submitted within the deadline set after the incident report.

Proactive oversight applied to essential entities, including audits, on-site inspections, and security scans, conducted regardless of whether an incident has occurred.

Reactive oversight applied to important entities, typically triggered by evidence of non-compliance or an incident, rather than routine proactive inspection.

The set of administrative fines and other sanctions member states must adopt for breaches, including possible public naming and restrictions on management.

A structured evaluation showing that products, processes, or services meet specified security requirements, often through testing, documentation, and independent review.

A framework defining requirements, evaluation methods, and oversight for issuing certificates that attest to the security properties of ICT products, services, or processes.

An EU-wide voluntary scheme framework allowing certificates issued in one member state to be recognised across the union, with assurance levels from basic to high.

A graded statement of confidence in a certification result, from basic through substantial to high, reflecting the rigour of evaluation and resistance to attack.

The development of harmonised technical standards that entities can follow to demonstrate compliance with security requirements and support presumption of conformity.