Guide

Annex II excludes universities from NIS2’s research sector definition — which legal track applies to your R&D lab or university, and what obligations follow?

ICT service management (B2B) sits in NIS2 Annex I — not Annex II. If your MSP meets the size threshold, you are directly regulated. Here is what Article 21, CIR 2024/2690, and the five-clause contract your clients will require actually demand from you.

IP theft from your research project may trigger NIS2 Art. 23 in 72 hours — even without service downtime. Here’s how to classify it and who to call first.

Your third-party sellers are direct service providers under NIS2 Art.21(2)(d). Here’s what marketplace operators must document before a supervisory audit.

Article 21 obligations for Annex II digital providers — and the DSA Art.34 risk obligation that adds a second compliance track for platforms with 45M+ EU users.

LockBit froze Royal Mail for 6 weeks before the £22M loss was confirmed. Art. 23’s disruption criterion fired on Day 1. What postal operators need to know about the significance test.

CIR 2024/2690 Article 7 sets exact thresholds that force cloud providers to notify CSIRTs — and when your tenant is also a NIS2 entity, the notification cascade doubles. Full breakdown of Art.23 timelines.

NIS2 scope for postal and courier operators: USP vs. commercial courier boundary, transport exclusion, and how Art. 21(2)(i) applies to WMS, TMS, and parcel tracking systems.

REACH manufacturers are NIS2 Important entities. This guide maps Article 21 obligations for chemicals — including the Seveso III scope overlap and REACH registration data protection under Art. 21(2)(i).

Your DCS vendor has write access to process setpoints. NIS2 Art.21(2)(d) names them as a direct supplier — and most chemical companies have no session controls in place.