NIS2 Competent Authority Registration Data Sheet
Collects the entity information national registration requires, with a note on member-state variations to check.
Available soon
- Format
- Excel
- Size
- 60 KB
- Length
- 11 sheets
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Complete the NIS2 Scope & Entity Classification Assessment first. Registration applies to: Every essential and important entity, and every entity providing domain name registration services (Article 3(3) and (4)). Enter its classification on the Registration Data sheet. |
| 2 | Answer whether the entity is one of the digital providers Article 27(1) names. Only the digital providers Article 27(1) names: DNS service providers, TLD name registries, domain name registration services, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines and social networking services platforms. If it is, the Article 27(2) fields are required as well. |
| 3 | Fill each field from the source named beside it and replace every [[placeholder]]. The Status column shows Complete, Missing or Placeholder to replace. Enter the date you last confirmed each value. |
| 4 | Answer every point on the Member State Check sheet from the official national text, with counsel (NR-12). Add any field the national form asks for under "Fields the national form adds". |
| 5 | Submit through the national route. Record the date, who submitted, the route and the acknowledgement on the Submission sheet. Keep the submission and the acknowledgement: a supervisor may ask for them (the NIS2 Documentation & Evidence Checklist, EV-02). |
| 6 | When any registered value changes, log it on the Change Log sheet the same day and notify the authority without delay (NR-02). The deadline is calculated: two weeks for the Article 3(4) fields, three months for the Article 27(2) fields. |
| 7 | Confirm the values at each readiness self-assessment (the NIS2 Readiness Self-Assessment, item SR-02), and update the Last confirmed column. |
| 8 | To clear the EXAMPLE, delete the word EXAMPLE in E5 of the Registration Data sheet and replace every yellow cell on the Registration Data, Submission and Member State Check sheets. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule NR-02: "The entity must give its competent authority the information Article 3(4) asks for, through the national mechanism where there is one, and notify any change within two weeks. An entity Article 27(1) names must also give the Article 27(2) information and notify changes within three months."
Rule NR-12: "The national law, the competent authority and its forms must be checked against the Member State's official text, and with counsel, before this pack is relied on and at each annual review."
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity (the NIS2 Scope & Entity Classification Assessment, row ST-13). Legal registered it on 2025-04-10, and the authority acknowledged it on 2025-04-24. It is not an Article 27 provider. Since then 3 registered values have changed, each logged on the Change Log sheet and notified within two weeks. The name, address, contacts and IP ranges stay placeholders: they are the adopter's own.
Member State variations: NIS2 sets the least each entity gives. National law may add fields, set its own route and deadline, or send registration to a different authority. Check each point on the Member State Check sheet before you rely on this sheet.
For Cyprus, check the law in force with the Digital Security Authority and counsel. On 29 September 2026 the Authority's legislation page listed the Security of Networks and Information Systems Law of 2020 (N.89(I)/2020), and no law transposing NIS2.
Tailoring — group of companies: each legal entity in scope registers on its own. Complete one sheet per entity, and keep the group's shared contact details the same on each.
Tailoring — a digital provider under Article 27: it is also listed in ENISA's registry (Article 27(1)), and its jurisdiction follows its main establishment in the Union (Article 26(1)). Ask counsel which Member State's authority receives its information.
Tailoring — contact details: register a monitored mailbox and a 24-hour number, not a named person's own, so a change of staff is not a change to notify.
Limitations: This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it.
Registration Data
Registration data
Who must register, the fields NIS2 asks for, and any the national form adds. Yellow cells are yours; grey cells are calculated.
| Worked example | EXAMPLE | Delete EXAMPLE here, and replace every yellow cell, to use your own. | ||||
Who must register
| Classification, from the scope assessment | Important | From the NIS2 Scope & Entity Classification Assessment, Result sheet. | ||||
| Registration required? | Yes: register (Article 3(4)) | Every essential and important entity, and every entity providing domain name registration services (Article 3(3) and (4)). | ||||
| One of the digital providers Article 27(1) names? | No | Only the digital providers Article 27(1) names: DNS service providers, TLD name registries, domain name registration services, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines and social networking services platforms. | ||||
| Deadline to notify a change | Any change notified without delay, and within two weeks of the change (Article 3(4)). | Calculated from the answer above. Each change is logged on the Change Log sheet. | ||||
Article 3(4): every entity that registers
| ID | Field | NIS2 article | Your entry | Where it comes from, and who keeps it | Last confirmed | Status |
|---|---|---|---|---|---|---|
| RF-01 | Name of the entity | Article 3(4)(a) | [[registered name of the distributor]] | [[Company register or certificate of incorporation; kept by the company secretary]] | 30 Sep 2026 | Placeholder to replace |
| RF-02 | Address | Article 3(4)(b) | [[registered office address]] | [[Registered office, from the company register]] | 30 Sep 2026 | Placeholder to replace |
| RF-03 | Up-to-date contact details: email addresses and telephone numbers | Article 3(4)(b) | [[security mailbox and 24-hour telephone number]] | [[A monitored security mailbox and a 24-hour number, not a person's own; kept by the NIS2 lead]] | 30 Sep 2026 | Placeholder to replace |
| RF-04 | IP ranges | Article 3(4)(b) | [[public IP ranges]] | [[Public IP ranges from the network team or the internet provider's allocation; ask the authority which ranges it expects]] | 30 Sep 2026 | Placeholder to replace |
| RF-05 | Where applicable, the relevant sector and subsector in Annex I or II | Article 3(4)(c) | Production, processing and distribution of food; food business engaged in wholesale distribution (Annex II, point 4) | From the NIS2 Scope & Entity Classification Assessment, SQ-03 | 30 Sep 2026 | Complete |
| RF-06 | Where applicable, the Member States where it provides services in scope | Article 3(4)(d) | [[Member State where the entity is established (Article 26(1))]] | From the NIS2 Scope & Entity Classification Assessment, SQ-10 | 30 Sep 2026 | Placeholder to replace |
Article 27(2): only the digital providers Article 27(1) names
| ID | Field | NIS2 article | Your entry | Where it comes from, and who keeps it | Last confirmed | Status |
|---|---|---|---|---|---|---|
| RF-07 | Name of the entity | Article 27(2)(a) | As RF-01 | Not required | ||
| RF-08 | Relevant sector, subsector and type of entity in Annex I or II, where applicable | Article 27(2)(b) | From the NIS2 Scope & Entity Classification Assessment, SQ-03, with the type of entity | Not required | ||
| RF-09 | Address of the main establishment and other legal establishments in the Union, or of the representative | Article 27(2)(c) | [[Main establishment in the Union and every other legal establishment, or the representative's address]] | Not required | ||
| RF-10 | Up-to-date contact details, including email addresses and telephone numbers of the entity and, where applicable, its representative | Article 27(2)(d) | As RF-03, with the representative's details where there is one | Not required | ||
| RF-11 | Member States where it provides services | Article 27(2)(e) | Every Member State where the services are provided | Not required | ||
| RF-12 | IP ranges | Article 27(2)(f) | As RF-04 | Not required |
Fields the national form adds
| ID | Field | NIS2 article | Your entry | Where it comes from, and who keeps it | Last confirmed | Status |
|---|---|---|---|---|---|---|
| NF-01 | [[any duty or field the national law adds to the Directive]] | [[national law, article]] |
NF-02
NF-03
Completeness
| Article 3(4) fields complete | 1 of 6 | ||
| Article 27(2) fields complete | Not required | ||
| Placeholders still to replace | 5 | ||
| Fields missing | 0 | ||
| Oldest confirmation | 30 Sep 2026 | ||
| Ready to submit? | Not yet: complete every field | ||
|---|---|---|---|
Submission
Submission and approval
When the registration was made, by whom and by which route, and the authority's acknowledgement. Keep both as evidence.
| Item | Value | Note |
|---|---|---|
| Date submitted | 10 Apr 2025 | EXAMPLE — before the Member State's list was due (Article 3(3)). |
| Submitted by | Legal | |
| Route | [[national registration mechanism or form, and its address]] | |
| Authority | [[competent authority designated under that law]] | |
| Acknowledged on | 24 Apr 2025 | |
| Authority's reference | [[registration number or reference the authority gave]] | |
| Submission and acknowledgement kept at | [[document store and file reference]] | |
| Registration status | Registered: submitted 2025-04-10, acknowledged 2025-04-24 | |
Approval before submission
| Role | Name | Date and reference |
|---|---|---|
| Prepared by (NIS2 lead) | [[Name]] | [[YYYY-MM-DD, reference]] |
| Checked by (Legal) | [[Name]] | [[YYYY-MM-DD, reference]] |
| Submitted by (authorised to act for the entity) | [[Name]] | [[YYYY-MM-DD, reference]] |
Change Log
Every change to a registered value, logged the day it happens. The deadline is calculated: two weeks for the Article 3(4) fields, three months for the Article 27(2) fields; a national field follows the national law.
| Row | Change ID | Date of the change | Field | What changed (from, to) | Deadline rule | Notify by | Notified on | Notified by | Authority's reference | Status |
|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | CH-01 | 15 Sep 2025 | RF-03 | Security mailbox moved from a named person to the shared security mailbox: [[old address]] to [[new address]] | two weeks (Article 3(4)) | 29 Sep 2025 | 19 Sep 2025 | Legal | [[authority's reference]] | On time |
| EXAMPLE | CH-02 | 2 Feb 2026 | RF-04 | New public IP range after the change of internet provider: [[old range]] to [[new range]] | two weeks (Article 3(4)) | 16 Feb 2026 | 10 Feb 2026 | Legal | [[authority's reference]] | On time |
| EXAMPLE | CH-03 | 22 Jun 2026 | RF-03 | 24-hour telephone number moved to the IT service desk: [[old number]] to [[new number]] | two weeks (Article 3(4)) | 6 Jul 2026 | 26 Jun 2026 | Legal | [[authority's reference]] | On time |
Member State Check
Member State check
NIS2 sets the least an entity gives. National law may add fields, set its own route and deadline, or name a different authority. Answer each point from the official national text, with its source, and have counsel confirm it (NR-12).
| ID | What to check | Your answer | Official source | Checked on | Counsel confirmed? | Status |
|---|---|---|---|---|---|---|
| MS-01 | Member State where the entity is established, whose law and authority apply | [[Member State where the entity is established (Article 26(1))]] | [[official URL or reference]] | To check | ||
| MS-02 | The national law transposing NIS2 | [[national law transposing NIS2: title, number and date]] | [[official URL or reference]] | To check | ||
| MS-03 | The competent authority the entity registers with | [[competent authority designated under that law]] | [[official URL or reference]] | To check | ||
| MS-04 | Where incident notifications go | [[national CSIRT, or the competent authority where notifications go to it]] | [[official URL or reference]] | To check | ||
| MS-05 | The registration route: a portal, a form or another mechanism, and its address | [[national registration mechanism or form, and its address]] | [[official URL or reference]] | To check | ||
| MS-06 | Fields or duties the national law adds to the Directive's list | [[any duty or field the national law adds to the Directive]] | [[official URL or reference]] | To check | ||
| MS-07 | The national deadline for first registration, and whether it has passed | [[deadline, from the national law or the authority]] | [[official URL or reference]] | To check | ||
| MS-08 | Who may submit, and what proof of authority the authority asks for | [[e.g. a director, or an authorised representative with a mandate]] | [[official URL or reference]] | To check | ||
| MS-09 | The language and format the authority accepts, for example how IP ranges are written | [[language and format]] | [[official URL or reference]] | To check | ||
| MS-10 | How changes are notified, and whether the authority acknowledges them | [[route for changes, and acknowledgement]] | [[official URL or reference]] | To check | ||
| MS-11 | Whether the authority confirms the classification it holds for the entity, and how to see it | [[how to see the entry]] | [[official URL or reference]] | To check |
For Cyprus, check the law in force with the Digital Security Authority and counsel. On 29 September 2026 the Authority's legislation page listed the Security of Networks and Information Systems Law of 2020 (N.89(I)/2020), and no law transposing NIS2.
Rule NR-12: "The national law, the competent authority and its forms must be checked against the Member State's official text, and with counsel, before this pack is relied on and at each annual review."
Lists
| YesNo | ClassificationList | FieldId | Article27Fields |
|---|---|---|---|
| Yes | Essential | RF-01 | RF-07 |
| No | Important | RF-02 | RF-08 |
| In scope | RF-03 | RF-09 | |
| Ask the authority | RF-04 | RF-10 | |
| Out of scope | RF-05 | RF-11 | |
| RF-06 | RF-12 |
RF-07
RF-08
RF-09
RF-10
RF-11
RF-12
National
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Registration | The information an entity must give its competent authority so it appears on the Member State's list (Article 3(4)), and, for the digital providers Article 27 names, for ENISA's registry. |
| Competent authority | The authority a Member State designates to supervise NIS2 (Article 8(1)). The entity registers with it, and it inspects, asks for evidence and enforces. |
| Computer security incident response team | Computer security incident response team: the national team that receives incident notifications and helps entities handle incidents (Article 10). In some Member States notifications go to the competent authority instead. |
| Essential entity | An entity that Article 3(1) of NIS2 classes as essential: mainly a large entity in an Annex I sector, and some entities whatever their size. Supervised both before and after an incident or complaint (Article 32). |
| Important entity | An entity of a type in Annex I or II that is in scope and is not essential (Article 3(2)). Supervised after the event, when the authority has evidence or an indication that it does not comply (Article 33). |
| Article 27 provider | Only the digital providers Article 27(1) names: DNS service providers, TLD name registries, domain name registration services, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines and social networking services platforms. |
| Main establishment | For the digital providers named in Article 26(1)(b), the establishment in the Union whose Member State has jurisdiction over them (Article 26(1)). Confirm with counsel which it is. |
| IP ranges | The blocks of public internet addresses the entity uses, written in the form the authority asks for. |
| Change | Any difference between a registered value and the current one, from the date it takes effect. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, registered on 2025-04-10. Clear it before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.5 — Contact with authorities | The whole sheet: contact with the competent authority kept, with the details it holds current |
| NIST CSF 2.0 | GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed” | The whole sheet: the NIS2 registration requirement understood and met in time |
| NIS2 — Directive (EU) 2022/2555 | Article 3(3) — by 17 April 2025 Member States establish a list of essential and important entities and of entities providing domain name registration services, and review and, where appropriate, update it regularly and at least every two years | Registration Data: the list of entities the Member State keeps, and why registration comes early |
| NIS2 — Directive (EU) 2022/2555 | Article 3(4) — entities submit at least their name; address and up-to-date contact details, including email addresses, IP ranges and telephone numbers; where applicable, the relevant sector and subsector in Annex I or II; and, where applicable, the Member States where they provide services in scope. They notify any change “without delay, and, in any event, within two weeks of the date of the change”. Member States may set up national mechanisms for entities to register themselves | Registration Data, Article 3(4) section; Change Log: two weeks to notify a change |
| NIS2 — Directive (EU) 2022/2555 | Article 27(1) — ENISA keeps a registry of DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, and providers of online marketplaces, online search engines and social networking services platforms | Registration Data: who is an Article 27 provider |
| NIS2 — Directive (EU) 2022/2555 | Article 27(2) — those entities submit their name; relevant sector, subsector and type of entity in Annex I or II, where applicable; the address of their main establishment and other legal establishments in the Union, or of their representative; up-to-date contact details, including email addresses and telephone numbers; the Member States where they provide services; and their IP ranges | Registration Data, Article 27(2) section |
| NIS2 — Directive (EU) 2022/2555 | Article 27(3) — those entities notify any change to that information “without delay and in any event within three months of the date of the change” | Change Log: three months to notify a change to the Article 27(2) fields |
| NIS2 — Directive (EU) 2022/2555 | Article 26(1) — entities fall under the jurisdiction of the Member State in which they are established, with exceptions for electronic communications providers (where they provide their services), the digital providers listed in point (b) (their main establishment in the Union) and public administration entities (the Member State that established them) | Member State Check, MS-01: which Member State has jurisdiction |
Editions referenced: Directive (EU) 2022/2555 (NIS2); Commission Recommendation 2003/361/EC; Implementing Regulation (EU) 2024/2690; ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any NIS2 requirement.