Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If we are not sure whether we must register with our NIS2 authority, then what do we do?

4 decision pointsThe pack behind this answer: NIS2 Implementation & Readiness

Add to board memo

The short answer

Recommendation
Settle your scope decision first. Register if it says you are essential, important or a domain name registration service; ask the authority if it must decide; and if you are out of scope, record why and watch for the triggers that would bring you in. Check the national rules with counsel before you submit.
Reasoning
Whether you must register follows from your scope result, so the doubt usually comes from an unsettled scope decision or from not knowing the national rules. Take them in that order. Registration applies to every essential and important entity and to every entity providing domain name registration services. NIS2 sets only the least an entity gives; national law may add fields, set its own route and deadline, or name a different authority (NR-12). Once registered, every change to a registered value is notified without delay (NR-02).
Considerations
  • The two-week deadline for changes, and three months for the digital providers' extra fields, are NIS2's as the pack states them (NR-02). A national field follows national law. This is not legal advice.
  • Some digital providers, such as cloud, data centre and managed service providers, give extra fields, and their jurisdiction follows their main establishment. If you are not sure whether you are one, assume you are and ask counsel.
  • You or someone in your group may already have registered. Look for a past submission and acknowledgement before preparing a new one. Each legal entity registers on its own.
  • Register a monitored mailbox and a 24-hour number rather than a person's own, so a change of staff is not a change to notify.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartWe are not sure whether we must registerDecisionIs your scope decision written and approved?StepRun the scope assessment firstDecisionWhat does the scope decision say?StepAsk the authority for its decision and classificationOutcomeNo registration due: record why, and watch the triggersDecisionAre you one of the digital providers with extra fields?StepAdd the extra fields, and ask which authority receives themStepCheck the national rules with counselDecisionDoes the authority already hold an entry for you?StepCheck every value it holds against today'sOutcomeNotify any change without delay, within two weeksStepFill each field from its sourceStepHave Legal check it, and an authorised person submitOutcomeSubmit, and keep the submission and acknowledgement

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.

  1. Start

    We are not sure whether we must register

    Registration is the information you give your competent authority so that you appear on the Member State's list of entities. Whether you must register follows from your scope result, so the uncertainty usually comes from an unsettled scope decision or from not knowing the national rules. Take them in that order.

    In the pack

  2. Decision

    Is your scope decision written and approved?

    A usable scope decision gives each answer with its fact, source and reasoning, is confirmed by counsel and is approved by the management body. If yours is missing, out of date, or overtaken by a trigger such as a new activity or a letter from an authority, treat it as not settled.

    In the pack

  3. Step

    Run the scope assessment first

    Apply NIS2's tests in order and let the first match decide. The result is one of five: essential, important, in scope for domain name registration, ask the authority, or out of scope. Have counsel confirm it before you rely on it.

    In the pack

    See also

  4. Decision

    What does the scope decision say?

    Registration applies to every essential and important entity, and to every entity providing domain name registration services. An out-of-scope result means no registration is due today. A regional public administration entity waits for the authority's decision.

    In the pack

  5. Step

    Ask the authority for its decision and classification

    Ask the competent authority whether its risk-based assessment brings you in, and with what classification, and record its answer with your scope decision. Ask too whether it confirms the classification it holds for you, and how you can see it. Then take the result it gives you back through this question.

    In the pack

  6. Outcome

    No registration due: record why, and watch the triggers

    Keep the written reasoning. Reassess at once if the Member State identifies you, national law changes, you start a new activity in an Annex I or II sector, a size ceiling is crossed for a second accounting period, or a merger changes the group's figures. If the new result brings you into scope, register.

    In the pack

  7. Decision

    Are you one of the digital providers with extra fields?

    The named digital providers are: DNS service providers, top-level domain name registries, domain name registration services, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines and social networking services platforms. If you are not sure, take the yes branch and ask counsel.

    In the pack

  8. Step

    Add the extra fields, and ask which authority receives them

    These providers also give the type of entity, the address of their main establishment and other legal establishments in the Union or of their representative, and every Member State where they provide services. They are listed in ENISA's registry, and their jurisdiction follows their main establishment in the Union. Ask counsel which Member State's authority receives the information.

    In the pack

  9. Step

    Check the national rules with counsel

    NIS2 sets the least you give. From the official national text, with counsel, confirm: the Member State whose law applies, the national law, the authority, the route and its address, any fields it adds, the deadline for first registration and whether it has passed, who may submit and with what proof, the language and format, and how changes are notified. The pack leaves each of these for you to fill.

    In the pack

  10. Decision

    Does the authority already hold an entry for you?

    You or someone in the group may have registered already. Look for a past submission and the authority's acknowledgement, and ask the authority whether it confirms the entry it holds for you and how to see it. If you cannot find out, prepare the registration.

    In the pack

  11. Step

    Check every value it holds against today's

    Compare each registered value with the current one: name, address, contact details, IP ranges, sector and the Member States where you provide services. A change counts from the date it takes effect.

    In the pack

  12. Outcome

    Notify any change without delay, within two weeks

    Log each change in your own records the day it happens and notify the authority without delay: within two weeks for the standard fields, within three months for the digital providers' extra fields, and as national law says for a national field. Confirm the values at each readiness self-assessment.

    In the pack

  13. Step

    Fill each field from its source

    Every entity gives at least its name, address, up-to-date contact details (email addresses and telephone numbers), IP ranges, and where applicable its sector and subsector and the Member States where it provides services in scope. Add any field the national form asks for. Register a monitored mailbox and a 24-hour number rather than a person's own, so a change of staff is not a change to notify. Ask the authority which IP ranges it expects.

    In the pack

  14. Step

    Have Legal check it, and an authorised person submit

    The pack's sign-off has three roles: the NIS2 lead prepares the data, Legal checks it, and a person authorised to act for the entity submits it. Submit through the national route counsel confirmed.

    In the pack

  15. Outcome

    Submit, and keep the submission and acknowledgement

    Record the date, who submitted, the route and the authority's acknowledgement and reference, and keep them where you can find them: a supervisor may ask for them. From then on, every change to a registered value is notified within its deadline.

    In the pack

    See also

Practical checklist

  1. Check your scope decision is written, confirmed by counsel and approved by the management body; if not, run the scope assessment.
  2. Read the result: register, ask the authority, or record why no registration is due.
  3. Check whether you are one of the digital providers with extra fields.
  4. Confirm with counsel the national law, the authority, the route, any added fields, the deadline and who may submit.
  5. Find out whether the authority already holds an entry for you, and compare every value with today's.
  6. Otherwise fill each field from its source, adding any field the national form asks for.
  7. Have Legal check it and a person authorised to act for the entity submit it.
  8. Keep the submission and acknowledgement, and log and notify each change within its deadline.

Evidence to have ready

  • The approved scope decision, or the authority's answer where it had to decide.
  • The national rules checked with counsel, with their official sources.
  • The submission: date, who submitted, route, the authority's acknowledgement and reference.
  • The sign-off: who prepared, who checked and who submitted.
  • The change log, showing each change, its deadline and when it was notified.

Assumptions

  • The fields and deadlines are NIS2's as the CISO Times NIS2 pack states them. National law may add fields, set its own route and deadline, or send registration to a different authority.
  • The national law, the competent authority, its registration route and its forms are yours to confirm with counsel. The pack leaves them as placeholders. This is not legal advice.
  • Each legal entity in a group registers on its own.

Not covered here