The 18 sectors subject to NIS2

Production, transmission, distribution and storage of energy, including new vectors such as hydrogen.

Sub-sectors in scope

Entities typically concerned

Transmission and distribution system operators, producers, suppliers, nominated market operators, charging point operators, refineries, and storage and pipeline operators.

Operators and infrastructure managers across the four modes of transport.

Sub-sectors in scope

Entities typically concerned

Air carriers, airport operators and air traffic control managers, rail infrastructure managers and railway undertakings, maritime and inland waterway transport companies, port authorities, road authorities and operators of intelligent transport systems.

Credit institutions, whose ICT risk management requirements fall primarily under DORA.

Sub-sectors in scope

Entities typically concerned

Authorised banks and credit institutions. Please note: for ICT risk management and incident reporting requirements, DORA applies as lex specialis.

Operators of the platforms and systems that keep markets running.

Sub-sectors in scope

Entities typically concerned

Operators of regulated markets, multilateral trading facilities and clearing houses. Here again, DORA takes precedence for the ICT aspects.

From care delivery to the manufacture of critical medicines and medical devices.

Sub-sectors in scope

Entities typically concerned

Hospitals and clinics, care centres, medical biology laboratories and reference laboratories, the pharmaceutical industry, manufacturers of medical devices deemed critical during a public health emergency, and wholesale distributors of medicinal products.

Supply and distribution of water intended for human consumption.

Sub-sectors in scope

Entities typically concerned

Public water utilities and delegated operators involved in the production and distribution of drinking water, excluding parts of the distribution chain that are not essential to their main activity.

Collection, disposal and treatment of urban, domestic and industrial waste water.

Sub-sectors in scope

Entities typically concerned

Operators of sewerage networks and waste water treatment plants, where this activity is an essential part of their business.

The technical building blocks that keep the internet and the cloud running — the sector where size matters least.

Sub-sectors in scope

Entities typically concerned

Operators of exchange points, DNS resolvers and registries, cloud hosting providers and data centre operators, CDN operators, trust service providers (signature, timestamping), telecom operators and internet access providers. Several of these activities are in scope regardless of size.

Providers that operate or secure their clients' information systems.

Sub-sectors in scope

Entities typically concerned

IT services companies and managed infrastructure providers that administer information systems on behalf of third parties, outsourced SOCs, monitoring and incident response providers, and managed identity operators.

Public entities, with specific treatment depending on the level of administration.

Sub-sectors in scope

Entities typically concerned

Ministries, government agencies and operators, and regional entities designated by the transposition law. Central government public administration is in scope regardless of its size.

Operation of ground-based infrastructure supporting space-based services.

Sub-sectors in scope

Entities typically concerned

Operators of ground stations, satellite control centres and providers of positioning, navigation and timing services, owned or operated by private or public actors.

Delivery of mail and parcels, including express courier operators.

Sub-sectors in scope

Entities typically concerned

Postal operators, couriers and parcel carriers, sorting platforms and last-mile operators.

Collection, treatment and recovery of waste, where this is the principal economic activity.

Sub-sectors in scope

Entities typically concerned

Collectors and operators of sorting, incineration, anaerobic digestion and landfill facilities, for whom waste management is the principal economic activity.

Manufacture, production and distribution of chemical substances and mixtures.

Sub-sectors in scope

Entities typically concerned

Manufacturers of basic and speciality chemicals, distributors and traders of substances and mixtures, including sites subject to Seveso regulations.

Production, processing and wholesale distribution of food products.

Sub-sectors in scope

Entities typically concerned

Agri-food companies, cooperatives, logistics platforms and wholesalers engaged in wholesale distribution and industrial production.

Manufacturing industries designated as critical by the directive.

Sub-sectors in scope

Entities typically concerned

Manufacturers of medical devices, electronics manufacturers, electrical equipment suppliers, machinery manufacturers, automotive manufacturers and suppliers, and rail, shipbuilding and aerospace manufacturers.

Major digital economy platforms, excluding infrastructure.

Sub-sectors in scope

Entities typically concerned

Operators of marketplaces, consumer search engines, social networks and content-sharing platforms. Jurisdiction is determined by the main establishment in the Union.

Research organisations, excluding educational institutions, in accordance with national arrangements.

Sub-sectors in scope

Entities typically concerned

Research institutes and centres whose main activity is applied research or experimental development with a view to the commercial exploitation of the results.