NIS2
Data & Privacy
- Data Act
- Data Governance Act
- EHDS
- ePrivacy Directive
- GDPR
AI & Trust
- Artificial Intelligence Act
- Product Liability Directive
Cybersecurity
- Cyber Resilience Act
- Cybersecurity Act
- DORA
- NIS2
Digital Services & Media
- Digital Markets Act
- Digital Services Act
- European Media Freedom Act
Directive on Measures for a High Common Level of Cybersecurity Across the Union
- Recitals
CHAPTER I
GENERAL PROVISIONSArticles 1 — 6
CHAPTER II
COORDINATED CYBERSECURITY FRAMEWORKSArticles 7 — 13
CHAPTER III
COOPERATION AT UNION AND INTERNATIONAL LEVELArticles 14 — 19
CHAPTER IV
CYBERSECURITY RISK-MANAGEMENT MEASURES AND REPORTING OBLIGATIONSArticles 20 — 25
CHAPTER V
JURISDICTION AND REGISTRATIONArticles 26 — 28
CHAPTER VI
INFORMATION SHARINGArticles 29 — 30
CHAPTER VII
SUPERVISION AND ENFORCEMENTArticles 31 — 37
CHAPTER VIII
DELEGATED AND IMPLEMENTING ACTSArticles 38 — 39
CHAPTER IX
FINAL PROVISIONSArticles 40 — 46
ANNEXES
NIS2
Annex I. SECTORS OF HIGH CRITICALITY
| Sector | Subsector | Type of entity |
|---|---|---|
| 1.Energy | (a)Electricity | Electricity undertakings as defined in Article 2, point (57), of Directive (EU) 2019/944 of the European Parliament and of the Council , which carry out the function of ‘supply’ as defined in Article 2, point (12), of that Directive |
| Distribution system operators as defined in Article 2, point (29), of Directive (EU) 2019/944 | ||
| Transmission system operators as defined in Article 2, point (35), of Directive (EU) 2019/944 | ||
| Producers as defined in Article 2, point (38), of Directive (EU) 2019/944 | ||
| Nominated electricity market operators as defined in Article 2, point (8), of Regulation (EU) 2019/943 of the European Parliament and of the Council Market participants as defined in Article 2, point (25), of Regulation (EU) 2019/943 providing aggregation, demand response or energy storage services as defined in Article 2, points (18), (20) and (59), of Directive (EU) 2019/944 Operators of a recharging point that are responsible for the management and operation of a recharging point, which provides a recharging service to end users, including in the name and on behalf of a mobility service provider | ||
| (b)District heating and cooling | Operators of district heating or district cooling as defined in Article 2, point (19), of Directive (EU) 2018/2001 of the European Parliament and of the Council | |
| (c)Oil | Operators of oil transmission pipelines | |
| Operators of oil production, refining and treatment facilities, storage and transmission | ||
| Central stockholding entities as defined in Article 2, point (f), of Council Directive 2009/119/EC | ||
| (d)Gas | Supply undertakings as defined in Article 2, point (8), of Directive 2009/73/EC of the European Parliament and of the Council | |
| Distribution system operators as defined in Article 2, point (6), of Directive 2009/73/EC | ||
| Transmission system operators as defined in Article 2, point (4), of Directive 2009/73/EC | ||
| Storage system operators as defined in Article 2, point (10), of Directive 2009/73/EC | ||
| LNG system operators as defined in Article 2, point (12), of Directive 2009/73/EC | ||
| Natural gas undertakings as defined in Article 2, point (1), of Directive 2009/73/EC | ||
| Operators of natural gas refining and treatment facilities | ||
| (e)Hydrogen | Operators of hydrogen production, storage and transmission | |
| 2.Transport | (a)Air | Air carriers as defined in Article 3, point (4), of Regulation (EC) No 300/2008 used for commercial purposes |
| Airport managing bodies as defined in Article 2, point (2), of Directive 2009/12/EC of the European Parliament and of the Council , airports as defined in Article 2, point (1), of that Directive, including the core airports listed in Section 2 of Annex II to Regulation (EU) No 1315/2013 of the European Parliament and of the Council , and entities operating ancillary installations contained within airports | ||
| Traffic management control operators providing air traffic control (ATC) services as defined in Article 2, point (1), of Regulation (EC) No 549/2004 of the European Parliament and of the Council | ||
| (b)Rail | Infrastructure managers as defined in Article 3, point (2), of Directive 2012/34/EU of the European Parliament and of the Council | |
| Railway undertakings as defined in Article 3, point (1), of Directive 2012/34/EU, including operators of service facilities as defined in Article 3, point (12), of that Directive | ||
| (c)Water | Inland, sea and coastal passenger and freight water transport companies, as defined for maritime transport in Annex I to Regulation (EC) No 725/2004 of the European Parliament and of the Council , not including the individual vessels operated by those companies | |
| Managing bodies of ports as defined in Article 3, point (1), of Directive 2005/65/EC of the European Parliament and of the Council , including their port facilities as defined in Article 2, point (11), of Regulation (EC) No 725/2004, and entities operating works and equipment contained within ports | ||
| Operators of vessel traffic services (VTS) as defined in Article 3, point (o), of Directive 2002/59/EC of the European Parliament and of the Council | ||
| (d)Road | Road authorities as defined in Article 2, point (12), of Commission Delegated Regulation (EU) 2015/962 responsible for traffic management control, excluding public entities for which traffic management or the operation of intelligent transport systems is a non-essential part of their general activity | |
| Operators of Intelligent Transport Systems as defined in Article 4, point (1), of Directive 2010/40/EU of the European Parliament and of the Council | ||
| 3.Banking | Credit institutions as defined in Article 4, point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council | |
| 4.Financial market infrastructures | Operators of trading venues as defined in Article 4, point (24), of Directive 2014/65/EU of the European Parliament and of the Council | |
| Central counterparties (CCPs) as defined in Article 2, point (1), of Regulation (EU) No 648/2012 of the European Parliament and of the Council | ||
| 5.Health | Healthcare providers as defined in Article 3, point (g), of Directive 2011/24/EU of the European Parliament and of the Council | |
| EU reference laboratories referred to in Article 15 of Regulation (EU) 2022/2371 of the European Parliament and of the Council | ||
| Entities carrying out research and development activities of medicinal products as defined in Article 1, point (2), of Directive 2001/83/EC of the European Parliament and of the Council Entities manufacturing basic pharmaceutical products and pharmaceutical preparations referred to in section C division 21 of NACE Rev. 2 Entities manufacturing medical devices considered to be critical during a public health emergency (public health emergency critical devices list) within the meaning of Article 22 of Regulation (EU) 2022/123 of the European Parliament and of the Council | ||
| 6.Drinking water | Suppliers and distributors of water intended for human consumption as defined in Article 2, point (1)(a), of Directive (EU) 2020/2184 of the European Parliament and of the Council , excluding distributors for which distribution of water for human consumption is a non-essential part of their general activity of distributing other commodities and goods | |
| 7.Waste water | Undertakings collecting, disposing of or treating urban waste water, domestic waste water or industrial waste water as defined in Article 2, points (1), (2) and (3), of Council Directive 91/271/EEC , excluding undertakings for which collecting, disposing of or treating urban waste water, domestic waste water or industrial waste water is a non-essential part of their general activity | |
| 8.Digital infrastructure | Internet Exchange Point providers | |
| DNS service providers, excluding operators of root name servers | ||
| TLD name registries | ||
| Cloud computing service providers | ||
| Data centre service providers | ||
| Content delivery network providers | ||
| Trust service providers | ||
| Providers of public electronic communications networks | ||
| Providers of publicly available electronic communications services | ||
| 9.ICT service management (business-to-business) | Managed service providers Managed security service providers | |
| 10.Public administration | Public administration entities of central governments as defined by a Member State in accordance with national law | |
| Public administration entities at regional level as defined by a Member State in accordance with national law | ||
| 11.Space | Operators of ground-based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space-based services, excluding providers of public electronic communications networks |