Art. 1 Subject matter | Cybersecurity measures and significant incidents for relevant entities | NIS 2

This is the foundational scoping article of the Regulation.

It identifies the specific categories of digital and ICT service providers that fall within its scope, collectively referred to as "relevant entities", and sets out the Regulation's two core purposes: establishing technical and methodological requirements for cybersecurity risk-management measures, and defining when an incident must be considered significant.

Both purposes directly implement obligations under NIS2 (Directive (EU) 2022/2555), meaning this Regulation acts as a technical implementing act that gives concrete shape to the broader requirements laid down in that Directive.

Important points:

Understand whether your organisation falls within one of the listed categories of relevant entities, as this determines whether the Regulation applies to you.
The Regulation serves two distinct functions: specifying cybersecurity risk-management requirements and defining the threshold for a significant incident.
Both functions derive their legal basis from NIS2, specifically Articles 21(2) and 23(3) of Directive (EU) 2022/2555.

With regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers as covered by Article 3 of Directive (EU) 2022/2555 (the relevant entities), this Regulation aims to lay down the technical and the methodological requirements of the measures referred to in Article 21(2) of Directive (EU) 2022/2555 and to further specify the cases in which an incident should be considered to be significant as referred to in Article 23(3) of Directive (EU) 2022/2555.

Article 1 Subject matter

Relevant recitals