YTYK You think you know

Card 15 of 18 Supervision and penalties ●○○ Foundational

Registering, and why it comes first

Member States must maintain a list of essential and important entities, and entities are required to submit at least their name, address, sector, contact details and the Member States where they provide services — and to notify changes.

Why it is like this

The authority cannot supervise a population it cannot enumerate, and a CSIRT cannot warn an entity whose contact details it does not hold. Registration is what makes the rest of the regime operable.

Not to be confused with

A certification or an approval. Registering does not say anything about your compliance; it says you exist and where to reach you at 03:00.

In practice

For a Belgian entity, registration runs through the CCB's Safeonweb@Work portal, and it is the first concrete action in almost every NIS2 programme — before any gap analysis.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 3(4). Read on .

Predict Check yourself

What does registering with the national authority establish about an entity?

  1. Only that it exists, in which sector, and how to reach it.
  2. That its cybersecurity measures have been accepted.
  3. That it has been classified as essential rather than important.
  4. That it is exempt from supervision for the first year.
Show the answer

Only that it exists, in which sector, and how to reach it.

Registration under Article 3(4) is an identification duty: name, address, sector, contacts, Member States served. It carries no judgement on compliance.