Which sectors does NIS2 cover?
NIS2 is organised by sector. Find your sector and entity type, see how it is usually classified, and read what it means in practice.
In short: NIS2 covers 18 sectors: 11 sectors of high criticality in Annex I (energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space) and 7 other critical sectors in Annex II (postal and courier, waste management, chemicals, food, manufacturing, digital providers and research).
The 18 NIS2 sectors at a glance
NIS2 lists 11 sectors of high criticality in Annex I and 7 other critical sectors in Annex II. An entity of a listed type is in scope when it is at least medium-sized, or when a rule applies regardless of size. Every sector links to a page on what NIS2 means in practice and how Secrato helps.
| Sector | Entity types | Usual classification |
|---|---|---|
| Annex I – sectors of high criticality | ||
| Energy | Electricity (incl. recharging points), district heating and cooling, oil, gas, hydrogen | Large: essential · medium: important |
| Transport | Air, rail, water (incl. ports and vessel traffic services) and road | Large: essential · medium: important |
| Banking | Credit institutions – DORA applies for ICT risk and incident reporting | As Annex I, with DORA as the specific law |
| Financial market infrastructures | Trading venues, central counterparties – DORA applies | As Annex I, with DORA as the specific law |
| Health | Healthcare providers, EU reference labs, R&D of medicinal products, basic pharmaceuticals, critical medical devices | Large: essential · medium: important |
| Drinking water | Suppliers and distributors of water for human consumption | Large: essential · medium: important |
| Waste water | Collection, disposal or treatment of urban, domestic or industrial waste water | Large: essential · medium: important |
| Digital infrastructure | Internet exchange points, DNS, TLD registries, cloud, data centres, CDNs, trust services, public electronic communications | Large: essential · medium: important |
| ICT service management (B2B) | Managed service providers and managed security service providers | Large: essential · medium: important |
| Public administration | Central and regional government entities, as defined nationally | Central government: essential; others as set nationally |
| Space | Operators of ground-based infrastructure supporting space-based services | Large: essential · medium: important |
| Annex II – other critical sectors | ||
| Postal and courier services | Postal service providers and courier services | Medium and large: important |
| Waste management | Undertakings whose principal activity is waste management | Medium and large: important |
| Chemicals | Manufacture, production and distribution of chemicals | Medium and large: important |
| Food | Food businesses in wholesale distribution and industrial production and processing | Medium and large: important |
| Manufacturing | Medical devices and IVDs, computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment | Medium and large: important |
| Digital providers | Online marketplaces, online search engines, social networking platforms | Medium and large: important |
| Research | Research organisations (excluding education institutions) | Medium and large: important |
Based on Annexes I and II of Directive (EU) 2022/2555. Some entities are covered regardless of size (for example qualified trust service providers, TLD registries, DNS providers and critical entities under the CER Directive), and Member States can designate further entities.
Not sure where you stand?
Answer four questions in the NIS2 scope checker for a first indication, then document your decision with the free NIS2 scope decision worksheet and the scope check guide.
Not in a listed sector?
You may still be asked about NIS2. Customers that are in scope must manage supply-chain security, so they ask their suppliers for proof. A recognised baseline such as CyFun® BASIC is a credible answer; Secrato's free NIS2 Starter is built on it.
Common questions
How many sectors does NIS2 cover?
Eighteen: 11 sectors of high criticality in Annex I and 7 other critical sectors in Annex II of Directive (EU) 2022/2555.
Is my company in scope if it is in a listed sector?
Usually only if it is at least medium-sized: 50 or more staff, or turnover and balance sheet both above €10 million. Some entity types, such as DNS providers and qualified trust service providers, are covered regardless of size. Try the NIS2 scope checker.
Are Annex I entities always essential?
No. Large Annex I entities are generally essential; medium-sized ones are generally important, unless the authority designates them as essential. Annex II entities are generally important.
Do financial entities follow NIS2?
Banks and financial market infrastructures are listed in NIS2, but DORA applies as the specific law for ICT risk management and incident reporting. See DORA and NIS2 for financial services.
Find out what NIS2 means for your organisation
Check your scope, then run the NIS2 measures for your sector in Secrato.
