Are you in scope yourself?

In this lesson

• Match each service you sell against the supplier types listed in Annex I, points 8 and 9, using the definitions of article 6.
• Apply the right size rule to each type: the size threshold of article 2(1), or one of the cases where size does not matter.
• Classify an in-scope supplier as essential or important under article 3, and tell whether Implementing Regulation (EU) 2024/2690 binds it.
• List what follows from being in scope: jurisdiction by main establishment, registration and reporting duties of your own.

Two routes into NIS2

NIS2 reaches an ICT supplier by one of two routes, or both. On the direct route, your company is itself an entity of a type listed in Annex I or II, meets the size rule or a case where size does not matter, and carries the obligations of articles 21 and 23 in its own name. On the indirect route, your company is not such an entity, but your customers are, and they pass requirements to you through the way they select, contract and monitor suppliers. This lesson settles the direct route; the rest of the course deals with the indirect one.

The supplier types in Annex I

Annex I, points 8 and 9

Annex I, point 8, headed Digital infrastructure, lists these types of entity, in this wording:

• Internet Exchange Point providers
• DNS service providers, excluding operators of root name servers
• TLD name registries
• Cloud computing service providers
• Data centre service providers
• Content delivery network providers
• Trust service providers
• Providers of public electronic communications networks
• Providers of publicly available electronic communications services

Point 9, headed ICT service management (business-to-business), lists two: managed service providers and managed security service providers. In Annex II, point 6 adds providers of online marketplaces, online search engines and social networking services platforms, and point 5(b) the manufacture of computer, electronic and optical products, which can catch hardware makers.

Notice what is not there: no entry for software publishers, IT consultancies or system integrators as such. A software company enters Annex I only if what it sells fits a listed type, in practice a cloud computing service or a managed service.

Reading the definitions

Art. 6(30), (31), (39), (40)

• Cloud computing service, Art. 6(30): “a digital service that enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources, including where such resources are distributed across several locations”. Recital 33 names the service models it includes, Software as a Service among them, and describes on-demand administration as self-provisioning “without any human interaction by the cloud computing service provider”. A multi-tenant SaaS product that customers provision for themselves is a serious candidate.
• Data centre service, Art. 6(31): structures dedicated to the centralised accommodation, interconnection and operation of IT and network equipment, with their power and environmental facilities. Recital 35 excludes “in-house corporate data centres owned and operated by the entity concerned, for its own purposes.”
• Managed service provider, Art. 6(39): “an entity that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers’ premises or remotely”.
• Managed security service provider, Art. 6(40): “a managed service provider that carries out or provides assistance for activities relating to cybersecurity risk management”. The MSP test always comes first.

The MSP definition is the broad one. Read literally, it covers installation as well as operation, and assistance as well as active administration. Where the line falls for one-off project work, such as an integrator that installs a system and leaves, the directive does not say. National guidance may, so check the transposition tracker and keep a written analysis per service line, not a single verdict for the company.

The size rule, type by type

Art. 2(1), (2), (4); Art. 3

Article 2(1) applies the directive to listed entities “which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article”. Small and micro enterprises are out by default. Article 2(2)(a) brings in, regardless of size, providers of public electronic communications networks or services, trust service providers, and TLD name registries and DNS service providers. Article 3 then sorts entities into essential and important:

Type	Size rule	Class
Cloud computing, data centre, content delivery network, IXP, MSP, MSSP	Medium-sized or larger (Art. 2(1))	Essential if above the medium-sized ceilings (Art. 3(1)(a)); important if medium-sized (Art. 3(2))
DNS service providers, TLD name registries	Any size (Art. 2(2)(a)(iii))	Essential regardless of size (Art. 3(1)(b))
Qualified trust service providers	Any size (Art. 2(2)(a)(ii))	Essential regardless of size (Art. 3(1)(b))
Other trust service providers	Any size (Art. 2(2)(a)(ii))	Essential if above the medium-sized ceilings (Art. 3(1)(a)); otherwise important (Art. 3(2))
Public electronic communications networks or services	Any size (Art. 2(2)(a)(i))	Essential if medium-sized (Art. 3(1)(c)) or larger (Art. 3(1)(a)); otherwise important
Domain name registration services	Any size (Art. 2(4))	Neither essential nor important; listed under Art. 3(3), duties under Arts 27 and 28

Two refinements. First, a member state can still bring in a small MSP or cloud provider under article 2(2)(b) to (e), for example as the sole provider in that state of a service essential for critical societal or economic activities, and identify it as essential (Art. 3(1)(e)) or important (Art. 3(2)). Second, size is measured with the group: under article 6(2) of the Annex to the Recommendation, 100 % of the data of linked enterprises and a proportional share of partner enterprises are added. Recital 16 lets member states take into account an entity's independence from its group in its systems and services; whether yours does is national.

The ceilings, from article 2 of that Annex: an SME employs fewer than 250 persons, with turnover not exceeding EUR 50 million and/or balance sheet total not exceeding EUR 43 million; a small enterprise employs fewer than 50 persons, with turnover and/or balance sheet total not exceeding EUR 10 million. A change of class needs the ceilings crossed over two consecutive accounting periods (art. 4(2)).

Is Implementing Regulation (EU) 2024/2690 yours?

Reg. 2024/2690, art. 1

Implementing Regulation (EU) 2024/2690 is the act article 21(5) required for a named list of digital entities. Its article 1 lists the relevant entities: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers. Recital 1 refers to them “as covered by Article 3 of Directive (EU) 2022/2555”, that is, when they are essential or important entities. Internet Exchange Point providers and electronic communications providers are not on the list. For them, and for every supplier outside scope, the regulation's Annex is a reference, never an obligation.

For a relevant entity, the regulation does two things. Its Annex sets the technical and methodological requirements of each article 21(2) measure, and where the entity considers a requirement marked “where appropriate”, “where applicable” or “to the extent feasible” not to fit, article 2(2) requires it to document its reasoning. Its articles 3 to 14 say when an incident is significant: for managed service and managed security service providers, article 10(a) covers a service that “is completely unavailable for more than 30 minutes”, and articles 7 to 9 set the cloud, data centre and CDN criteria. Scheduled interruptions of service and the planned consequences of scheduled maintenance are not significant incidents (art. 3(2)).

What follows if you are in scope

Art. 26, 27

• One member state, by main establishment. DNS, TLD, domain registration, cloud, data centre, CDN, MSP and MSSP providers fall under the member state of their main establishment in the Union (Art. 26(1)(b)): where decisions on cybersecurity risk-management measures are predominantly taken (Art. 26(2)). A provider not established in the Union must designate a representative there (Art. 26(3)).
• Registration. Article 27(2) requires the same providers to submit their name, type of entity, establishments, contact details, the member states where they provide services and their IP ranges, and to notify changes within three months (Art. 27(3)). The channel is national.
• Your own article 21 and 23 duties. You take the measures, report your significant incidents and, where appropriate, notify the recipients of your services (Art. 23(1)). Those recipients are your customers.
• Supervision and fines. Essential entities under article 32, important entities ex post under article 33, with the fine maxima of article 34(4) and (5).

What a supervisor will ask

• Which Annex I type are you, and why? The scoping memo matching each service line to an article 6 definition.
• Show us the size calculation. Headcount, turnover and balance sheet total from the latest approved accounts, with linked and partner enterprises aggregated.
• Where is your main establishment? Evidence of where decisions on cybersecurity risk-management measures are predominantly taken.
• Is your registration current? The article 27 submission and the changes notified since.

Key points

• Annex I, point 8, lists cloud, data centre, CDN, DNS, TLD, IXP, trust service and electronic communications providers; point 9 lists managed service and managed security service providers.
• Cloud, data centre, CDN, IXP, MSP and MSSP providers must be medium-sized or larger, unless a member state identifies them under article 2(2)(b) to (e); DNS, TLD, trust service and electronic communications providers are in scope regardless of size.
• Qualified trust service providers, TLD name registries and DNS service providers are essential whatever their size.
• Size is measured with linked and partner enterprises; recital 16 leaves a national margin.
• Implementing Regulation (EU) 2024/2690 binds the in-scope relevant entities of its article 1; IXPs and electronic communications providers are not among them.
• An in-scope supplier has its own article 21 and 23 duties, including notifying the recipients of its services where appropriate.