YTYK You think you know

Card 1 of 18 Scope — who is covered ●○○ Foundational

Essential and important entities

Everyone in scope carries the same obligations. The split into essential and important entities changes only how you are supervised and how large the fine can be — not what you have to do.

Why it is like this

The directive wanted one security baseline across critical sectors, but not one level of state attention. So the duties are uniform and the enforcement is proportionate: the entities whose failure would hurt most are watched most closely.

Not to be confused with

A tiering of how secure you must be. There is no lighter set of measures for important entities — an important entity that skips Article 21 is as non-compliant as an essential one.

In practice

A 300-person energy operator and a 120-person waste-management firm both implement the same ten measures. The energy operator can be inspected without any suspicion of a breach; the waste firm, in principle, only once something suggests a problem.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 3. Read on .

Predict Check yourself

An important entity and an essential entity are both found to have no incident-handling policy. What differs?

  1. Nothing in what they should have done — only how they were found out and what the fine can reach.
  2. The important entity is not required to have one, so only the essential entity is in breach.
  3. Both are in breach, but the important entity gets a longer remediation period by law.
  4. The important entity is judged against a reduced version of Article 21.
Show the answer

Nothing in what they should have done — only how they were found out and what the fine can reach.

Article 21 applies identically to both. The classification drives the supervisory regime (Articles 32 and 33) and the fine ceilings (Article 34), not the substance of the obligation.