NIS2 Scope Checklist for Research Institutions: How Universities and R&D Labs Determine Whether They Are Essential, Important, or Exempt

Research institutions occupy a unique position under NIS2: they appear in the directive’s Annex II — which suggests straightforward automatic coverage — but universities are explicitly excluded from that classification and enter scope through a separate legal mechanism. The result is a compliance position where two organisations conducting near-identical research work face entirely different obligations depending on their legal structure and their member state’s transposition decisions.

This checklist resolves that ambiguity. It covers scope determination (which legal track applies to your organisation), classification (Essential, Important, or Exempt), and the specific compliance actions required under Article 21 of Directive (EU) 2022/2555 — adapted for research environments where intellectual property, consortium partnerships, and pre-publication timelines create tensions that no generic compliance guide addresses. Internal links to our research sector compliance overview and NIS2 scope guide provide supporting context for each stage.

Why Research Institutions Are Society-Critical Under NIS2

Research institutions generate and protect intellectual property that underpins critical national infrastructure. An R&D laboratory developing materials for energy grid components, a university running genomics research for pandemic preparedness, or a national research centre modelling critical infrastructure vulnerabilities — each holds data that state-sponsored actors have consistently demonstrated willingness to steal [7].

These are not opportunistic attacks. Security services across multiple EU member states have documented repeated campaigns targeting university networks and research databases, particularly in fields adjacent to defence, semiconductor R&D, and dual-use technologies. The targets are chosen for the value of unpublished findings and prototype designs, not for the size of the organisation.

NIS2 addresses this by classifying research organisations in Annex II — the directive’s list of other critical sectors — placing them alongside food production, waste management, and digital providers [4]. The classification reflects a principle embedded in the directive’s design: societal resilience depends not only on physical critical infrastructure, but on the organisations producing the knowledge and technology that critical infrastructure depends on.

This framing matters practically. It explains why member states can designate research organisations as Essential entities — a higher classification than the default Important category — when their work directly sustains multiple Annex I sectors or national security functions. It also explains why Article 2(5)(b) targets universities conducting “critical research activities” specifically: NIS2 draws a deliberate distinction between research that supports society-critical functions and routine academic work.

Determining which category applies to your institution starts with one question: are you a research organisation under Annex II, or an education institution that conducts research?

The Two Legal Tracks — Which Applies to Your Organisation

The most consequential gap in most NIS2 guidance for the research sector is treating research organisations and universities as interchangeable. They are not. NIS2 addresses them through two distinct legal mechanisms, and which one applies determines both your compliance obligations and your classification.

Track A — Annex II Research Organisations (Automatic Scope)

Annex II of Directive (EU) 2022/2555 lists research organisations as a covered entity type in the research sector [4]. Regulatory interpretation confirms this covers entities whose primary purpose is applied research or experimental development with a view to exploiting results commercially [5].

This definition explicitly excludes higher education institutions. A university is not a research organisation under Annex II — even where research generates the majority of its activity and revenue [5]. The distinction is between an organisation that exists to produce commercially exploitable research, and one that exists to educate students and conducts research as part of that mission.

Track A entities that meet either of the following size thresholds are automatically in scope [1, 5]:

• 50 or more employees, OR
• Annual turnover or balance sheet total exceeding EUR 10 million

Both conditions do not need to be met. A 30-person R&D laboratory with EUR 15 million in annual turnover is in scope. A 250-person research institute with EUR 8 million turnover is also in scope.

Track B — Article 2(5)(b) Member State Discretion

Universities and other higher education institutions enter NIS2 scope only if their member state has exercised the optional provision in Article 2(5)(b), which allows — but does not require — member states to extend the directive to education institutions, in particular where they carry out critical research activities [1].

This has two practical implications. First, if your member state has not transposed this provision, your university has no NIS2 obligations under the directive itself (though contractual supply chain clauses from NIS2-obligated partners may still apply). Second, if your member state has transposed it, scope depends on whether your institution’s research qualifies as critical under the national implementation.

The directive does not define critical research activities. National implementations suggest the following are generally treated as qualifying: research directly supporting Annex I sector operations (energy, healthcare, transport, banking), dual-use technology research, defence or national security-adjacent research, and research conducted under critical infrastructure protection programmes. Germany’s NIS2UmsuCG (December 2025) and Italy’s ACN framework (2024) both include university extension mechanisms, though the precise qualification thresholds vary.

Three-question track determination:

Question	If Yes	If No
Is applied research or experimental development your organisation’s primary purpose — not secondary to teaching?	Track A — check size thresholds	Proceed to Question 2
Are you a university or HEI where research is one function alongside teaching?	Track B — check member state transposition	Likely out of direct NIS2 scope
Has your member state transposed Article 2(5)(b) and do your research activities qualify as critical under national law?	Track B in scope — confirm with national authority	Check supply chain obligations from NIS2-covered partners

Classification — Essential, Important, or Exempt?

Once you have confirmed your legal track, the next determination is classification — which sets your supervision regime and maximum penalty exposure.

Default: Important Entity

Research organisations entering scope via Track A are classified as Important entities by default under Annex II [5]. Universities entering scope via Track B are also classified as Important entities in most member state implementations. Important entities are subject to reactive (ex-post) supervision: national authorities initiate review after an incident or following evidence of non-compliance, rather than conducting proactive audits [5].

Essential Entity Designation

A research organisation can be designated as an Essential entity by the national competent authority where its services are deemed to carry societal or economic significance exceeding the standard Important threshold. Practical triggers include:

• The organisation provides services that are critical to the operation of multiple Annex I essential entities (for example, the sole national provider of radiation safety testing for the energy sector)
• The organisation has been designated as a critical entity under the CER Directive (EU) 2022/2557, in which case NIS2 applies regardless of size [1]
• The member state determines the organisation’s continuity is essential to national security or public safety

Exemption — Micro and Small Organisations

Research organisations with fewer than 50 employees AND an annual turnover or balance sheet of EUR 10 million or less are exempt from NIS2 scope [1]. Both conditions must apply simultaneously — a 30-person laboratory with EUR 15 million in turnover remains in scope.

Classification at a Glance

Entity Type	Legal Track	Default Classification	Supervision	Max Penalty
Private R&D lab, 50+ staff or >EUR 10M turnover	Track A (Annex II)	Important	Reactive (ex-post)	EUR 7M or 1.4% turnover [3]
University, member state has transposed Art. 2(5)(b)	Track B	Important	Reactive (ex-post)	EUR 7M or 1.4% turnover [3]
National research centre, state-designated Essential	Track A + Essential designation	Essential	Proactive (ex-ante)	EUR 10M or 2% turnover [3]
R&D lab, <50 staff AND ≤EUR 10M	Out of scope	Exempt	None	None

NIS2 Compliance Checklist for Research Institutions

Article 21(2) of Directive (EU) 2022/2555 requires appropriate and proportionate technical, operational, and organisational measures across ten security areas [2]. Below is each area mapped to the specific implementation steps relevant to research environments. Use this as a gap-assessment tool against your current posture.

Governance and Risk

☐ Article 21(2)(a) — Risk Analysis and Information System Security Policy
Document a formal information security policy covering research data specifically. The risk assessment should classify data by sensitivity tier: published data; pre-publication results (highest sensitivity); export-controlled data; and data generated under classified or restricted-access funding conditions. Generic risk templates designed for financial or manufacturing environments will not capture the primary risks for a research institution without adaptation.

☐ Article 21(2)(f) — Effectiveness Assessment
Establish an annual security review with documented sign-off from management or the governing board. For Track B universities, verify that your national transposition instrument specifies which organisational tier carries this obligation — some member state implementations assign it to the central IT security function, others to each faculty conducting critical research.

Incident and Continuity

☐ Article 21(2)(b) — Incident Handling
Maintain a written incident handling procedure specifying the 24-hour early warning notification to your national CSIRT and the 72-hour detailed incident report [2]. The notification covers the nature and scope of the incident — the systems affected, type of attack, estimated impact — not the content of the research data involved. Institutions that delay reporting to protect unpublished results are misreading the obligation; the CSIRT does not receive research data in this process. See our research sector incident response guide for a detailed walkthrough of the notification requirements.

☐ Article 21(2)(c) — Business Continuity, Backup, and Crisis Management
Research data, including instrument outputs, experimental datasets, and computational model results, must be covered by the backup policy. Many organisations back up administrative systems but exclude laboratory management systems (LIMS), sequencing outputs, or simulation data. A single on-premises backup location is insufficient — off-site or cloud-replicated copies are the practical standard. The backup policy should specify recovery time objectives for research systems, not only for administrative infrastructure.

Supply Chain and Technical Controls

☐ Article 21(2)(d) — Supply Chain Security
Map all direct suppliers and service providers including consortium research partners, cloud infrastructure providers hosting research data, and instrument manufacturers with remote service access. Article 21(2)(d) applies to each direct relationship [2]. For research consortia, this means incorporating minimum cybersecurity requirements into consortium agreements as contractual obligations traceable to NIS2 — not as optional good practice. The requirement applies whether the consortium partner is a university, a private company, or a public research body.

☐ Article 21(2)(e) — Acquisition, Development, and Vulnerability Management
Network-connected laboratory equipment — including sequencing machines, mass spectrometers, industrial sensors, and any device running embedded firmware with external connectivity — falls within the scope of vulnerability management [2]. Vendor patch timelines for laboratory instruments are often measured in years. Document accepted-risk positions for unpatched equipment explicitly, including justification and compensating controls such as network isolation. This is the article 21 area most likely to produce findings in a research environment.

☐ Article 21(2)(h) — Cryptography and Encryption
Encrypt data in transit to consortium partners and external collaborators. Pre-publication datasets transferred to partner institutions must use end-to-end encrypted channels. Transmission of unencrypted research data via standard email is a common audit finding in the research sector and is inconsistent with Article 21(2)(h).

People and Access

☐ Article 21(2)(g) — Cyber Hygiene and Training
Establish mandatory security awareness training with documented completion records. Visiting researchers and external collaborators accessing institutional systems require security briefings before access is provisioned; their training completion should be logged alongside permanent staff records. Many documented incidents in the research sector involve compromised visiting researcher or postdoctoral credentials.

☐ Article 21(2)(i) — Access Control, Human Resources Security, and Asset Management
Implement access tiering for research data based on sensitivity classification. Pre-publication results and export-controlled data should require explicit authorisation for access beyond the originating research group. Maintain an asset register covering all systems processing research data, including researcher-managed servers and cloud environments not provisioned through central IT. Offboarding procedures for departing staff and visiting researchers must include verified access revocation.

☐ Article 21(2)(j) — Multi-Factor Authentication
Enforce MFA for remote access to research networks and all cloud research platforms. Legacy laboratory control systems that cannot support MFA should be network-isolated rather than granted broad exemptions. Document any exceptions with written justification and compensating controls.

Where Article 21 Gets Complicated in Research Environments

Four specific tensions arise in research contexts that generic compliance guidance does not address. Each has a practical resolution.

Incident notification versus pre-publication IP protection

Article 21(2)(b) and Article 23 require incident notification within 24 to 72 hours. Research institutions frequently ask whether this timeline requires disclosing unpublished research findings to the national CSIRT. It does not. The notification covers the nature and scope of the incident — systems affected, attack type, estimated scale — not the content of the data involved. Institutions can structure notifications that fully satisfy the reporting obligation without exposing pre-publication results. Work with legal counsel and the CSIRT before an incident occurs to agree on the notification format.

Consortium supply chain requirements

Article 21(2)(d) requires security measures addressing vulnerabilities specific to each direct supplier. In practice, research institutions cannot assume that consortium partners — including other universities, funding agencies, or specialist subcontractors — apply equivalent security controls. Consortium agreements negotiated without NIS2 cybersecurity clauses now create compliance gaps that are straightforward to remediate at the agreement stage but expensive to address retroactively. The minimum requirement is a written obligation on each direct consortium partner to notify the lead institution of significant security incidents affecting shared systems or data.

Dual-use research and export control intersection

Research involving technologies with civil-military dual-use potential — quantum computing, advanced AI systems, certain materials science outputs, chemical synthesis tools — intersects with EU dual-use export control regulations. NIS2 Article 21(2)(d) supply chain provisions and Article 21(2)(i) access control both apply directly to how dual-use research results are shared with external parties. Organisations conducting dual-use research should assess their NIS2 compliance posture alongside their export control framework. The two are complementary: access controls required for export compliance generally satisfy the NIS2 Article 21(2)(i) threshold for the same data categories.

Visiting researcher and temporary access management

Article 21(2)(i) includes human resources security — covering contractors, consultants, and third parties with system access, not only permanent staff. Visiting researchers present a recurring gap: access typically begins before a formal security induction is completed, and ends without a structured offboarding process. A policy specifying maximum provisioning lead time (48 hours post-induction), a defined access scope limited to project-relevant systems, and mandatory revocation on the departure date addresses both the NIS2 requirement and the practical risk.

Frequently Asked Questions

Does NIS2 apply to our university if our member state has not transposed Article 2(5)(b)?

Not under the NIS2 Directive directly. However, if you have NIS2-obligated partners or institutional suppliers, they may impose security requirements on your institution through contractual clauses as part of their own Article 21(2)(d) supply chain obligations. Review consortium agreements and major supplier contracts for any pass-through cybersecurity requirements.

Our R&D centre is a non-commercial public body with 250 staff — are we in scope?

Both public and private entities fall under NIS2 if they meet the sector and size criteria [1]. A public research organisation whose primary function is applied research is likely covered under Annex II. The commercial exploitation element in the Track A definition is assessed as the primary orientation of the research function, not a requirement for profit motive. Confirm your status with your national competent authority, which maintains the official register of covered entities.

When must we register with the national competent authority?

Member states were required to establish lists of essential and important entities by 17 April 2025. Self-registration obligations vary by member state. Germany’s NIS2UmsuCG (December 2025) and Italy’s ACN framework include registration mechanisms — check your national authority’s official guidance for the applicable process and deadline. Our NIS2 compliance checklist includes registration as one of the first implementation steps.

Does NIS2 apply to individual research projects or to the institution as a whole?

NIS2 obligations apply to the institution as a legal entity. However, the security policies required under Article 21(2) must cover all network and information systems used in the entity’s operations — which includes project-specific infrastructure, cloud environments, and externally managed systems processing institutional data. There is no exemption for systems used only in specific research projects.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Sources

[1] NIS2 Directive — Article 2: Scope. nis-2-directive.com.
[2] NIS2 Directive — Article 21: Cybersecurity Risk-Management Measures. nis-2-directive.com.
[3] NIS2 Directive — Article 34: Administrative Fines. nis-2-directive.com.
[4] NIS2 Annex II — Other Critical Sectors. StreamLex.
[5] NIS2 Applicability: Essential vs Important Entities. Glocert International.
[6] NIS2 Education Guide: Is Your Institution Affected?. Guardey.
[7] NIS2 for Research: Who’s In Scope, What Changes. ISMS.online.