Which companies are subject to NIS2?

The NIS2 rules apply to state and public administration bodies, as well as large and medium-sized private companies, as defined in detail in the law.

Sectors of high criticality

• Electricity
• District heating and cooling
• Establishment and operation of hydrocarbon (petroleum) transmission pipelines
• Operation of petroleum processing or storage facility
• Stockholding of imported petroleum and petroleum products
• Natural gas marketing
• Hydrogen production, storage and transport
• Air transport
• Rail transport
• Water transport
• Operation of road transport system
• Public transport
• Healthcare service
• Operation of high security biological laboratories
• Managing healthcare reserves and blood supplies
• Research and development of pharmaceuticals
• Manufacturing of basic pharmaceutical products and pharmaceutical preparations
• Wholesale distribution of pharmaceuticals
• Manufacturing medical devices of critical importance
• Wholesale distribution of medicinal products for human use
• Water utility services
• Communications services
• Digital infrastructure service (cloud, domain, DNS)
• Outsourced ICT services
• Space-based services

Other critical sectors

• Postal and courier services
• Production, processing and distribution of food
• Waste management
• Manufacture, production and distribution of chemicals
• Manufacture of medical devices and in vitro diagnostic medical devices
• Manufacture of computer, electronic and optical products
• Manufacture of electrical equipment (Sector 28 in Regulation (EEC) No 3037/90)
• Manufacture of motor vehicles, trailers and semi-trailers
• Manufacture of machinery and equipment not elsewhere classified
• Manufacture of other transport equipment
• Manufacture of cement, lime and plaster
• Online marketplace service
• Digital search service
• Provision of social media service platform
• Domain name registration service
• Research site

Back to the glossary