The NIS2 Directive categorizes the 18 sectors into two groups: Sectors of High Criticality (Annex I) and Other Critical Sectors (Annex II).
1. Sectors of High Criticality (Annex I)
These 11 sectors are considered the most vital to the economy and society.
1. Energy: Electricity, district heating/cooling, oil, gas, and hydrogen.
2. Transport: Air, rail, water, and road transport.
3. Banking: Credit institutions (banks).
4. Financial Market Infrastructures: Trading venues and central counterparties.
5. Health: Healthcare providers, labs, R&D, and pharmaceutical manufacturing.
6. Drinking Water: Supply and distribution.
7. Wastewater: Collection, disposal, and treatment.
8. Digital Infrastructure: Cloud providers, data centers, DNS, TLD registries, and trust services.
9. ICT Service Management: Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs).
10. Public Administration: Central and regional government entities.
11. Space: Operators of ground-based infrastructure.
2. Other Critical Sectors (Annex II)
These 7 sectors are critical but subject to slightly less stringent oversight for medium-sized organizations.
1. Postal and Courier Services: Including delivery and logistics.
2. Waste Management: Collection and treatment of waste.
3. Chemicals: Manufacture, production, and distribution.
4. Food: Production, processing, and wholesale distribution.
5. Manufacturing: Specifically medical devices, computers/electronics, electrical equipment, machinery, and motor vehicles.
6. Digital Providers: Online marketplaces, search engines, and social networking platforms.
7. Research: Research organizations (excluding educational institutions).