Two things matter for NIS2: which sector you operate in and how large you are. Together they give the entity type, essential or important, and the standard risk score in the DNSC methodology, which sets how many controls you apply. We have written a guide for each sector, covering what is specific to it.
The sector guides
Energy
Producers, grid operators, suppliers, charging point operators and oil, gas and hydrogen companies have NIS2 obligations.
Read the guide ANNEX 1Transport
Air, rail, water and road transport have NIS2 obligations, but not every transport company is covered.
Read the guide ANNEX 1Banking and financial market infrastructure
Credit institutions, trading venue operators and central counterparties are in Annex 1 to OUG 155/2024.
Read the guide ANNEX 1Health
Medium and large hospitals and clinics, pharmacies and medicine distributors, reference laboratories and manufacturers of medicines and critical medical devices have NIS2 obligations.
Read the guide ANNEX 1Drinking water
Regional operators and companies that supply and distribute drinking water have NIS2 obligations.
Read the guide ANNEX 1Waste water
Collecting, disposing of and treating urban, domestic and industrial waste water are in Annex 1.
Read the guide ANNEX 1Digital infrastructure and ICT service management
Cloud providers, data centres, telecoms operators, DNS providers and managed service companies have NIS2 obligations.
Read the guide ANNEX 1Public administration
Ministries, agencies and other central public administration entities are essential entities regardless of size.
Read the guide ANNEX 1Space
NIS2 does not regulate satellites but the ground-based infrastructure that supports space services.
Read the guide ANNEX 2Postal and courier services
Postal service providers, including courier companies, are in Annex 2 to OUG 155/2024.
Read the guide ANNEX 2Waste management
Medium-sized and large waste management companies are important entities.
Read the guide ANNEX 2Chemicals
Manufacturers and distributors of chemical substances and mixtures, and companies producing articles from them, are in Annex 2.
Read the guide ANNEX 2Food
Industrial production, processing and wholesale distribution of food are in Annex 2.
Read the guide ANNEX 2Manufacturing
The NIS2 manufacturing sector is not the whole of industry but six specific branches, from medical devices to vehicles and automotive parts.
Read the guide ANNEX 2Digital providers
Online marketplaces, search engines and social networking platforms are in Annex 2.
Read the guide ANNEX 2Research
Research organisations aiming at the commercial exploitation of their results are in Annex 2.
Read the guideStandard score and level, by sector
| Sector | Annex | Small or micro | Medium | Large |
|---|---|---|---|---|
| Energy | 1 | 95 · basic | 190 · important | 285 · essential |
| Transport | 1 | 85 · basic | 170 · important | 255 · essential |
| Banking and financial market infrastructure | 1 | DORA | DORA | DORA |
| Health | 1 | 72.5 · basic | 145 · important | 217.5 · essential |
| Drinking water | 1 | 67.5 · basic | 135 · important | 202.5 · essential |
| Waste water | 1 | 67.5 · basic | 135 · important | 202.5 · essential |
| Digital infrastructure and ICT service management | 1 | 95 · basic | 190 · important | 285 · essential |
| Public administration (by employees) | 1 | 125 · important | 250 · essential | 375 · essential |
| Space | 1 | 87.5 · basic | 175 · important | 262.5 · essential |
| Postal and courier services | 2 | 50 · basic | 100 · important | 150 · important |
| Waste management | 2 | 15 · basic | 30 · basic | 45 · basic |
| Chemicals | 2 | 60 · basic | 120 · important | 180 · important |
| Food | 2 | 42.5 · basic | 85 · basic | 127.5 · important |
| Manufacturing | 2 | 57.5 · basic | 115 · important | 172.5 · important |
| Digital providers | 2 | 55 · basic | 110 · important | 165 · important |
| Research | 2 | 62.5 · basic | 125 · important | 187.5 · important |
The scores are those in the annex to the DNSC methodology. For public administration, size is set by the average number of employees. Banking and financial market infrastructure entities subject to DORA do not carry out the risk-level assessment.
Find your level and maturity score in a few minutes. Choose your sector and size, then answer 12 questions.
Open the NIS2 calculatorHow to read the table
Entity type and assurance level are not the same. A large waste management company is an important entity but stays at the basic level, with a score of 45. A medium-sized food company is also at the basic level. By contrast, a central public administration institution with 50 employees reaches the essential level.
Several sectors. If you operate in several sectors, you assess the risk level separately for each and apply the level matching the highest score.
Exceptions to the size rule. DNS service providers, TLD name registries and qualified trust service providers are essential entities regardless of size; the details are in the guide to digital infrastructure. Small and micro companies in the other sectors are covered only in the special cases in the law, for example if DNSC designates them.
What comes next
- notification to DNSC, within 30 days from the date OUG 155/2024 becomes applicable to the organisation; the first DNSC fine sanctioned exactly this deadline;
- the risk-level assessment, within 60 days of the DNSC decision;
- the self-assessment, within the following 60 days, on the controls of your level;
- the audit, carried out by a DNSC-certified auditor.
Sources
OUG 155/2024 (in Romanian) · Directive (EU) 2022/2555 · DNSC risk-level methodology (in Romanian) · Law No. 124/2025, CMS summary.