NIS2 | Who is Affected?
NIS2 affects all member states of the European Union, as it establishes requirements and regulations that must be adhered to by entities within those states.
It is estimated that approximately 160,000 entities across the EU will fall under the scope of the NIS2 Directive. These are classified into two categories: Essential and Important entities.
While both categories are subject to the same cybersecurity requirements, the main difference lies in the level of regulatory supervision and potential sanctions. Essential entities are subject to both proactive and reactive oversight, while Important entities are primarily supervised ex post (after incidents or signs of non-compliance).
To be considered in scope as a private organisation under NIS2, the threshold is:
- At least 50 employees, and/or
- Annual turnover or balance sheet total of €10 million or more.
Find out more about NIS2 here.
