What is the difference between essential and important entities?
NIS2 sorts in-scope organisations into two categories. Essential entities are, in general, large organisations (250+ employees, or more than €50 million turnover and €43 million balance sheet) in the high-criticality sectors of Annex I, plus certain entities regardless of size, such as qualified trust service providers and top-level domain registries. Important entities are the other medium and large organisations in Annex I and Annex II sectors. Member states can also designate specific entities.
| Aspect | Essential entities | Important entities |
|---|---|---|
| Security measures (Article 21) | Same ten measures | Same ten measures |
| Incident reporting (Article 23) | 24h / 72h / 1 month | 24h / 72h / 1 month |
| Supervision | Proactive (ex ante): audits and inspections at any time | Reactive (ex post): after evidence or indications of non-compliance |
| Maximum fine | €10 million or 2% of worldwide turnover | €7 million or 1.4% of worldwide turnover |
What must NIS2 entities do first?
- Confirm classification and register with the national authority where your country requires it.
- Brief the management body: under Article 20 it must approve the risk-management measures, oversee their implementation and follow cybersecurity training.
- Run a gap assessment against the ten Article 21(2) measures.
- Set up an incident-response process that can send an early warning within 24 hours, a notification within 72 hours and a final report within one month.
- Review critical suppliers for supply-chain security.
How can entities show they are compliant?
NIS2 does not prescribe one certification, but supervisors expect documented, proportionate measures and proof that they work. Many national authorities accept or reference established frameworks. In Belgium, the CCB's CyberFundamentals framework and ISO/IEC 27001 are recognised routes to demonstrate conformity. An ISO 27001 ISMS therefore covers much of the effort, provided incident reporting and management accountability are added.
How does ComplyPilot support NIS2 entities?
ComplyPilot (EU compliance platform) includes the NIS2 requirements as a framework overlay. Each requirement links to controls, policies, risks, suppliers and evidence, and the NIS2 dashboard shows readiness by category with clear thresholds. Management can see progress without reading spreadsheets, and auditors receive structured exports.
Because the control set is shared with ISO 27001 and DORA, entities in the financial sector or with certification goals avoid duplicate work.
Frequently asked questions
Are small companies covered by NIS2?
Usually not. NIS2 generally applies to medium and large entities, but some services — such as DNS providers, TLD registries and qualified trust service providers — are in scope regardless of size, and member states can designate smaller entities.
Who is the NIS2 authority in Belgium?
The Centre for Cybersecurity Belgium (CCB) is the national cybersecurity authority for NIS2 in Belgium, alongside sector authorities.
What counts as a significant incident?
An incident that has caused or can cause severe operational disruption or financial loss for the entity, or considerable damage to others. Implementing acts and national guidance give thresholds.