NIS2
Which Sectors Does NIS2 Cover?
NIS2 covers 18 sectors, split across two annexes of Directive (EU) 2022/2555. Annex I lists eleven sectors of high criticality, whose large entities are supervised as essential entities. Annex II lists seven other critical sectors, whose in-scope entities are supervised as important entities. Both annexes carry the same security and reporting obligations — the annex decides how closely you are supervised and how hard you can be fined.
Annex I — sectors of high criticality
11 sectors. Large entities here are normally essential entities; medium-sized ones are normally important.
Energy
Electricity, district heating and cooling, oil, gas and hydrogen — including producers, network operators, storage and market participants.
Transport
Air, rail, water and road transport operators, plus the authorities and traffic management systems that keep them running.
Banking
Credit institutions as defined in EU banking law.
Financial market infrastructure
Trading venue operators and central counterparties.
Health
Healthcare providers, EU reference laboratories, medicinal product manufacturers and entities holding critical medical devices.
Drinking water
Suppliers and distributors of water intended for human consumption.
Waste water
Undertakings collecting, disposing of or treating urban, domestic or industrial waste water.
Digital infrastructure
IXPs, DNS providers, TLD registries, cloud and data centre services, CDNs, trust service providers and electronic communications networks and services.
ICT service management (B2B)
Managed service providers and managed security service providers.
Public administration
Central government entities, and regional entities where a member state decides they are in scope.
Space
Operators of ground-based infrastructure supporting space-based services.
Annex II — other critical sectors
7 sectors. In-scope entities here are normally supervised as important entities.
Postal and courier services
Postal service providers and courier operators, including last-mile delivery.
Waste management
Undertakings whose principal activity is waste collection, treatment or disposal.
Chemicals
Manufacture, production and distribution of chemical substances and mixtures.
Food production and distribution
Food businesses engaged in wholesale, industrial production and processing.
Manufacturing
Medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, trailers and other transport equipment.
Digital providers
Online marketplaces, online search engines and social networking service platforms.
Research organisations
Organisations whose primary goal is applied research or experimental development with commercial application.
How to use this list
Sector membership is decided by the activity you actually carry out, described in the sub-categories of Annex I and Annex II — not by your registered industry code. Being listed here is only half of the scope test: the size criterion decides whether you are supervised as an essential entity or an important entity, apart from a small set of entity types that are in scope regardless of headcount.
Sector deep-dives
Two sector pages go further than the list, covering what the Article 21 measures mean in practice, where operators in that sector usually fall short, and how the documentation maps onto their environment:
- NIS2 for Manufacturing — Annex II, IT/OT convergence, supplier and asset-inventory gaps.
- NIS2 for Energy — Annex I, grid-control and remote-access security, cascading incident impact.
Deep-dives for health and digital infrastructure are in preparation.