Who is affected by NIS 2? (Part 2)

This article is part of the series on NIS 2 . Find out what the NIS 2 Directive is and what requirements are imposed on companies .

The number of affected companies is increasing significantly with NIS 2. Estimates for Germany suggest 30,000 affected companies (for comparison: the first NIS Directive affected approximately 2,000 companies).

There is no official notification as to whether a specific company is affected. Therefore, it is up to the companies themselves to determine their status. A number of criteria are relevant for this.

What does affected status depend on?

First, there are two thresholds:

Small or micro-enterprises are only affected in exceptional cases.

Small or micro-enterprises have fewer than 50 employees and an annual turnover or annual balance sheet total of less than 10 million euros.

For medium-sized enterprises, the requirements are generally less stringent than for those exceeding these values.

Medium-sized enterprises have fewer than 250 employees.
The profit is less than 50 million euros or the balance sheet total is smaller than 43 million euros.

In the second step, the type of entity in which the company operates is decisive. A distinction is made between "important" and "especially important" entities. In addition, directly applicable implementing regulations apply to certain types of entities.

Especially important entities

The EU regulation speaks of essential entities, while the German implementation refers to especially important entities – both mean the same thing.

Entities that exceed the thresholds for medium-sized enterprises and belong to an entity type listed in Annex 1 of the NIS2UmsuCG are considered especially important. This includes entity types from the following sectors:

Energy
Transport and Traffic
Finance
Health
Water
Digital Infrastructure
Space

Not all companies operating in one of these sectors are affected; it depends on the precise definition of the entity type.

Especially important are also operators of critical infrastructures (KRITIS), qualified trust service providers, top-level domain name registries or DNS service providers, as well as medium-sized telecommunications providers.

Important entities

Important entities are medium or large companies that fall under one of the entity types in Annex I or II of the NIS2UmsuCG. This adds the following sectors to those mentioned above:

Waste Management
Food and Chemical Industries
Manufacturers of Medical Devices or certain Electrical Equipment
Mechanical Engineers and Vehicle Manufacturers
Digital Service Providers
Research Institutions

As with especially important entities, the precise definition of the entity types is decisive here as well.

Additionally, trust service providers and all telecommunications providers that are not especially important are considered important.

Those affected by the implementing regulation

With the first implementing regulation, the EU aims for the direct regulation of companies that offer inherently cross-border services. Currently, this includes providers of the following services:

DNS service providers and TLD name registries
Cloud Computing, Data Centers, and Content Delivery Networks
Managed (Security) Services
Online Marketplaces, Online Search Engines, and Social Networks

How do I find out if my company is affected?

An initial indication can be found, for example, in the NIS 2 impact assessment of the BSI. For a more detailed examination, the consultants at aramido GmbH are at your disposal. A final legal review can also be helpful.

We accompany you on the path to NIS 2 implementation! Take advantage of a free initial consultation to discuss your project with a security expert.