Pragmatic NIS2 Compliance for Medium-Sized Organizations

NIS2 Important Entities: Obligations and Compliance

Important entities under NIS2 must meet the same cybersecurity requirements as essential entities under Article 21, with reactive supervision and fines up to EUR 7 million.

  • 01Cost-effective NIS2 compliance for Important Entities
  • 02Pragmatic cybersecurity measures
  • 03Efficient incident response processes
  • 04Flexible security architectures
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

NIS2 Important Entities: Classification and Requirements

Important entities cover medium-sized organizations in critical sectors from NIS2 Annex II and medium-sized organizations from Annex I sectors. They face the same technical security obligations as essential entities but less intensive supervision. Correct self-classification avoids compliance risks and optimizes implementation effort.

Our consulting for Important Entities focuses on practical and cost-effective NIS2 compliance solutions that preserve business agility while ensuring solid cybersecurity.

2 service modules

Service scope

01

Important Entity Compliance Assessment

Comprehensive assessment of your compliance status and development of a customized implementation strategy.

  • Detailed analysis of your Important Entity status
  • Assessment of proportional security requirements
  • Gap analysis of existing cybersecurity measures
  • Development of cost-effective implementation roadmap
02

Proportional Cybersecurity Measures

Implementation of appropriate security solutions that match your specific requirements and resources.

  • Development of flexible security architectures
  • Implementation of cost-effective security technologies
  • Building lean incident response processes
  • Establishing continuous monitoring and improvement

5 phases

Our Approach for Important Entities

We develop customized, proportional compliance strategies that meet the specific needs and resources of Important Entities.

  1. Assessment of Important Entity status and proportional requirements

  2. Risk assessment focusing on business-critical assets

  3. Development of cost-effective security measures

  4. Implementation of lean governance structures

  5. Establishing sustainable monitoring and reporting

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn
Important Entities need pragmatic cybersecurity solutions that ensure compliance without compromising operational flexibility. ADVISORI supports medium-sized organizations in finding the right balance between security and efficiency.
ADVISORI expert opinion

Why ADVISORI

  • 01Specialized expertise for medium-sized organizations
  • 02Cost-effective and practical solution approaches
  • 03Proportional implementation strategies for Important Entities
  • 04Continuous support for compliance optimization

Compliance Notice

Although Important Entities are subject to less stringent supervisory measures than Essential Entities, they must still implement appropriate cybersecurity measures and can be sanctioned for violations.

6 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about NIS2 Important Entities

What are NIS2 important entities?

Important entities under NIS2 are: 1. Medium-sized organizations in critical sectors from Annex II such as postal, waste management, food, chemicals, and digital providers, with at least 50 employees or at least EUR 10 million in annual turnover; 2. Medium-sized organizations from Annex I sectors with 50‑249 employees or EUR 10‑50 million in turnover that do not qualify as essential. Important entities face identical Article 21 requirements but only reactive supervision.

What is the difference between essential and important entities under NIS2?

The key difference lies in supervision intensity and fines: Essential entities face active supervision meaning authorities can proactively audit them. Important entities face only reactive supervision triggered by specific incidents or complaints. Fines for essential entities: up to EUR 10 million or 2% of global annual turnover. Fines for important entities: up to EUR 7 million or 1.4% of annual turnover. The security requirements under Article 21 are identical for both categories, only enforcement differs.

What obligations do important entities have under NIS2?

Important entities must: 1. Register with the competent authority such as BSI in Germany, 2. Implement all ten security measures from Article 21 NIS2 including risk analysis, incident handling, BCM, supply chain security, MFA, and cryptography, 3. Report significant cybersecurity incidents within 24h and 72h deadlines, 4. Conduct management cybersecurity training per Article 20, 5. Establish an NIS2-compliant governance structure. Unlike essential entities, they are not proactively audited.

How am I classified as an important entity under NIS2?

You are an important entity if you operate in an NIS2 sector and meet the size thresholds for important but not essential entities. Self-classification follows these steps: 1. Sector check against NIS2 Annexes I and II, 2. Size check using the EU SME definition of employees and turnover or balance sheet, 3. Review of automatic classifications for critical infrastructure operators and trust service providers, 4. Registration with the competent authority. Errors in self-classification can lead to fines, so professional legal and technical guidance is recommended.

NIS2 fines for important entities: how high?

For important entities, competent authorities can impose fines of up to EUR 7 million or 1.4% of total global annual turnover, whichever is higher. Personal liability of management under Article 20 applies in principle to important entities as well, though national implementations vary. Reactive supervision does not mean violations go unpunished, reporting deadline violations or incidents can trigger enforcement proceedings and fines.

How does NIS2 self-classification work?

NIS2 self-classification involves four steps: 1. Sector check against NIS2 Annexes I and II to identify which annex applies, 2. Size check per EU SME definition covering employee count and annual turnover or balance sheet total, 3. Check for automatic classifications such as critical infrastructure operators and qualified trust service providers, 4. Registration with the competent national authority specifying entity category. Professional legal and technical support for self-classification is strongly recommended to avoid compliance gaps and potential enforcement action.