Types of Private Entities Not Covered by NIS2

The NIS2 Directive, effective from October 18, 2024, imposes rigorous cybersecurity requirements on critical sectors within the EU. However, certain private entities are explicitly exempt from these obligations, particularly those involved in national security, public safety, defense, or law enforcement activities, including the prevention, investigation, detection, and prosecution of criminal offenses. Member States have the discretion to exempt these entities from specific obligations under the directive concerning these activities.

Additionally, entities that provide services exclusively to another public administration entity excluded from NIS2’s scope may also be exempt from certain obligations related to those services. The directive does not apply to diplomatic and consular missions of EU Member States in third countries, nor to their network and information systems located within mission premises or used by users in third countries.

Explicit exclusions mentioned in Annexes I and II include:

1. Road Transport: Public authorities responsible for traffic management where traffic management or intelligent transport systems are not a core part of their activities.
2. Maritime and Inland Waterway Transport: Excludes private vessels operated by these companies.
3. Digital Infrastructure: Excludes root DNS server operators.
4. Air Transport: Includes commercial airlines, implicitly excluding non-commercial airlines.
5. Drinking Water Supply: Excludes suppliers for whom water distribution is not a core part of their activities.
6. Wastewater Management: Excludes companies where wastewater management is not a core part of their business.
7. Postal Services: Excludes providers that do not handle significant parts of the postal distribution chain.
8. Space Sector: Excludes public electronic communications networks providers supporting space services.
9. Research Sector: Excludes educational institutions unless specified by Member States for conducting critical research activities.

Entities not listed in the “Type of entity” column in Annexes I and II are also excluded. However, final determinations will depend on how Member States transpose these regulations into national law, which will clarify competent authorities for each sector and resolve any specific ambiguities.

How Edgewatch Can Help

Edgewatch offers comprehensive cybersecurity solutions tailored to meet the stringent requirements of the NIS2 Directive. Our services include risk assessment, continuous monitoring, and incident response, ensuring that essential and important entities comply with the directive’s mandates. By leveraging Edgewatch, organizations can enhance their cybersecurity posture, protect critical infrastructure, and avoid potential penalties associated with non-compliance. Our expertise in network security, data protection, and threat management will help entities navigate the complexities of NIS2, providing peace of mind and robust defense against cyber threats.

The NIS2 Directive establishes stringent cybersecurity requirements for critical sectors within the EU. However, certain private entities are exempt from these obligations, particularly those involved in national security, public safety, defense, or law enforcement activities, including the prevention, investigation, detection, and prosecution of criminal offenses. Member States have the discretion to exempt these entities from specific obligations under the directive concerning these activities.

Additionally, entities that provide services exclusively to another public administration entity excluded from NIS2’s scope may also be exempt from certain obligations related to those services. The directive does not apply to diplomatic and consular missions of EU Member States in third countries, nor to their network and information systems located within mission premises or used by users in third countries.

Explicit exclusions mentioned in Annexes I and II include:

1. Road Transport: Public authorities responsible for traffic management where traffic management or intelligent transport systems are not a core part of their activities.
2. Maritime and Inland Waterway Transport: Excludes private vessels operated by these companies.
3. Digital Infrastructure: Excludes root DNS server operators.
4. Air Transport: Includes commercial airlines, implicitly excluding non-commercial airlines.
5. Drinking Water Supply: Excludes suppliers for whom water distribution is not a core part of their activities.
6. Wastewater Management: Excludes companies where wastewater management is not a core part of their business.
7. Postal Services: Excludes providers that do not handle significant parts of the postal distribution chain.
8. Space Sector: Excludes public electronic communications networks providers supporting space services.
9. Research Sector: Excludes educational institutions unless specified by Member States for conducting critical research activities.

Entities not listed in the “Type of entity” column in Annexes I and II are also excluded. However, final determinations will depend on how Member States transpose these regulations into national law, which will clarify competent authorities for each sector and resolve any specific ambiguities.