NIS2, the European Union directive on network and information security

An entity is caught if it is of a type listed in the directive's two annexes and is medium-sized or larger — broadly, fifty or more staff, or annual turnover and balance sheet total both above ten million euro. Some providers are caught whatever their size, including public electronic communications services, trust service providers and domain name system services, and so is any organisation that is the sole provider in a member state of a service the state depends on.

The essential and important labels decide supervision rather than duties. The security and reporting obligations are substantially the same for both; an essential entity can be inspected because a supervisor decided to look, while an important entity is generally examined after something has happened.

It is a directive, so it binds through each member state's own transposing law and not directly. Member states were required to apply their national measures from 18 October 2024, and several were late.

Each member state names its own competent authority and incident reporting point in its transposing law. Cyprus, for example, transposed it by amending the Security of Networks and Information Systems Law of 2020, number 89(I)/2020, with the amending law number 60(I)/2025 in April 2025. There the competent authority is the Cyprus Digital Security Authority, which is also where significant incidents are reported, and the national incident response team is CSIRT-CY.

How an entity finds out it is in scope is also a national choice, and it is where guidance written for one country most often misleads a reader in another. Guidance written for Germany or Ireland tells a reader to self-identify and register by a deadline. In Cyprus an entity does not register itself: the Authority draws up the list of essential and important entities, reviews it at least every two years, and an entity provides its profile information when the Authority notifies it. The Authority's scope self-check returns an indicative answer, which is guidance rather than a determination. Before acting on any guide, check which mechanic the applicable national law actually uses.