NIS2 Essential Entities: Obligations and Compliance

Essential entities under NIS 2 are organizations from the highly critical sectors listed in Annex I of the NIS 2 Directive that exceed certain size thresholds: at least

250 employees or at least EUR

50 million in annual turnover and at least EUR

43 million in balance sheet total. Additionally, regardless of size, all operators of critical infrastructure, qualified trust service providers, TLD registry operators, and certain public entities are automatically classified as essential.

The key differences: essential entities in Annex I face active supervision, authorities can proactively audit, request documents, and conduct on-site inspections. Fines: up to EUR

10 million or 2% of total global annual turnover. Important entities in Annex II or medium-sized Annex I organizations face only reactive supervision triggered by specific incidents or complaints. Fines: up to EUR

7 million or 1.4% of annual turnover. The technical security requirements under Article

21 are identical for both categories.

Essential entities must: 1. Register with the competent authority (e.g., BSI in Germany), 2. Implement and document all ten security measures from Article 21, 3. Report significant cybersecurity incidents within 24h and 72h deadlines, 4. Conduct and document management cybersecurity training per Article 20, 5. Ensure supply chain security for critical ICT suppliers, 6. Conduct regular risk assessments, 7. Actively support supervisory inspections and provide access to relevant systems and documentation.

You are likely an essential entity if your organization operates in one of the

11 highly critical sectors in Annex I AND employs at least

250 people or generates more than EUR

50 million in revenue. Automatically essential regardless of size: critical infrastructure operators, qualified trust service providers, TLD registry operators, and certain public entities. NIS 2 self-classification should be legally reviewed, as errors create compliance risks including potential fines.

For essential entities, competent authorities can impose fines of up to EUR

10 million or 2% of total global annual turnover, whichever is higher. In addition, in cases of serious violations by management, authorities can temporarily prohibit individuals from exercising management functions (personal liability under Article 20). In Germany, the BSI is the primary competent authority responsible for enforcing these measures.

Essential entities must report significant cybersecurity incidents in three stages: early warning within

24 hours of becoming aware of the incident, incident notification within

72 hours with initial assessment and measures taken, and final report within one month containing full analysis and lessons learned. Reports go to the competent national authority. An incident is considered significant if it causes major operational disruptions, financial damage, or affects other persons significantly.