NIS 2 fundamentals and scope
Domain 1 - NIS 2 fundamentals and scope
This domain tests whether you can place the NIS 2 Directive (EU) 2022/2555 in the EU legal framework and decide whether an organisation is in scope, and whether it is essential or important.
Core rules
NIS 2 is a directive, not a regulation: Member States had to transpose it by 17 October 2024, and it repealed Directive (EU) 2016/1148. It sets minimum harmonisation, so national law may add requirements. Its objective is a high common level of cybersecurity for network and information systems used by essential and important entities.
Scope is sector-and-size based. Annex I sectors - energy, transport, banking, financial market infrastructure, health, water, waste water, digital infrastructure, ICT service management (B2B), public administration and space - generally yield essential entities. Annex II sectors - postal and courier, waste management, chemicals, food, manufacturing, digital providers and research - generally yield important entities. The default size test is medium-sized or larger: 50 or more employees, or turnover and balance sheet total above €10 million. Some categories are size-independent or specially treated: qualified trust service providers, TLD registries, DNS service providers and central banks; public electronic communications providers are caught unless microenterprises. CER-critical entities are essential.
Exclusions include defence, national security, law enforcement, parliaments and the judiciary, and micro/small enterprises unless a size-independent category applies.
Worked example
A managed IT service provider with 70 staff and €15 million turnover supports hospitals. It is Annex I 'ICT service management (B2B)', medium-sized, and therefore essential. The hospitals' status does not decide it; the provider's sector and size do. At 40 staff and €8 million turnover, the size test would normally exclude it.
Traps
Do not call NIS 2 a regulation or assume every firm in a listed sector is caught. 'Important' does not mean exempt: the same Article 21 and 23 duties apply, with lighter supervision. Do not assume small providers are always out - trust services, DNS and public communications are exceptions.