Which sectors are covered by NIS2?

NIS2 covers 18 sectors, split across two annexes of Directive (EU) 2022/2555. Annex I lists 11 sectors of high criticality, including energy, health, transport and digital infrastructure. Annex II lists 7 other critical sectors, including manufacturing, food and waste management. Being in a listed sector is not enough on its own: size matters too.

Sector is only the first of four scope criteria. For the full method, see our pillar article Who does NIS2 apply to?.

Annex I: the 11 sectors of high criticality

Sector	Examples of entity types covered
Energy	Electricity (generation, transmission, distribution, supply, recharging points), district heating and cooling, oil, gas, hydrogen
Transport	Airlines, airports, rail infrastructure managers, railway undertakings, shipping and ports, road authorities, intelligent transport systems
Banking	Credit institutions
Financial market infrastructures	Trading venues, central counterparties
Health	Healthcare providers, EU reference laboratories, medicinal product R&D, basic pharmaceutical manufacturing, manufacturers of medical devices deemed critical in a public health emergency
Drinking water	Suppliers and distributors of water intended for human consumption
Waste water	Collection, disposal and treatment of urban, domestic or industrial waste water
Digital infrastructure	Internet exchange points, DNS providers, domain name registries, cloud computing, data centres, content delivery networks, trust service providers, electronic communications providers
ICT service management (B2B)	Managed service providers (MSPs), managed security service providers (MSSPs)
Public administration	Central government, and regional government at each Member State’s discretion
Space	Operators of ground-based infrastructure supporting space-based services

Annex II: the 7 other critical sectors

Sector	Examples of entity types covered
Postal and courier services	Postal service providers, including courier services
Waste management	Undertakings whose principal activity is waste management
Chemicals	Manufacture, production and distribution of substances and mixtures
Food production, processing and distribution	Wholesale distribution and industrial production and processing
Manufacturing	Medical and in vitro diagnostic devices, computer, electronic and optical products, electrical equipment, machinery and equipment, motor vehicles and trailers, other transport equipment
Digital providers	Online marketplaces, online search engines, social networking platforms
Research	Research organisations

Common scope traps

Thinking in broad “industries”. The directive targets specific entity types. In food, only wholesale distribution and industrial production are covered: a retailer is not. For waste and water, the activity must be principal or essential to the business.

Forgetting secondary activities. A services firm that also runs a data centre for clients, or a manufacturer that produces electrical equipment alongside its core business, may fall into scope through that second activity.

Assuming digital means big tech. The “ICT service management” sector covers medium-sized MSPs and MSSPs. It is one of the main changes compared with NIS1, explained in NIS1 vs NIS2: what changed?.

Confusing annex with category. The annex alone does not say whether an entity is essential or important. Under Article 3 of the directive, a medium-sized entity in an Annex I sector is, as a rule, classed as important, subject to the specific cases the text provides for. See NIS2 essential vs important entities.

What if my sector is not listed?

As a rule, the directive does not then target your business directly. Two points to watch, however, and if you are unsure about a specific situation, your legal counsel is the right person to ask:

1. a Member State may extend its national law to other entities, such as local government or education institutions (Article 2(5));
2. if your clients are in scope, they will probably ask you for information about your security. See Does NIS2 affect me if my client is in scope?.

Next step: check your size

Once your sector is identified, the second criterion is company size. That is the subject of NIS2 size thresholds.

Talk to an expert

In a covered sector and wondering what it means for detecting and handling incidents? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Is retail covered?

Not as a rule. In food, only wholesale distribution and industrial production are covered. A retailer that also runs an online marketplace may, however, be in scope on that basis if it exceeds the thresholds.

Are software vendors covered?

Not as such: software publishing is not listed in the annexes. A vendor may be in scope if it provides a listed service, such as cloud computing or managed services. It will also hear from regulated clients under supply chain security.

Are schools and universities covered?

The directive leaves this to each Member State (Article 2(5)). Research organisations, on the other hand, are listed in Annex II.

How do I decide if my activity sits on the edge of a sub-sector?

Start from the annex definitions and the texts they refer to (classification codes for manufacturing, sector definitions for energy or health). If doubt remains, your national authority's tools and contact channels are the right next step. See Not sure if NIS2 applies to you?.

Can a sector be added later?

Changing the annexes requires amending the directive. National laws can, however, extend scope to other entities.