Essential entity / important entity (NIS2)
Two categories of regulated parties created by the NIS2 Directive, subject to the same baseline security obligations but to different supervisory regimes according to their criticality.
Directive (EU) 2022/2555, Article 3: NIS2 sorts the entities it covers into two categories, essential and important, according to their size, sector and degree of criticality for the economy and society. Essential entities are generally large enterprises in the most sensitive sectors, such as energy, transport, health, water, public administration and digital infrastructure. They are subject to ex-ante supervision, that is, proactive and ongoing oversight by the national competent authority, which may initiate audits even in the absence of an incident. Important entities, of intermediate size or in less critical sectors, are controlled only ex post, in response to an incident or a suspicion of breach. Both categories nonetheless share the same substantive baseline of obligations derived from Article 21, covering risk management, supply chain security, strong authentication, business continuity and encryption. Sanctions differ, however: fines can reach ten million euros or 2 per cent of worldwide turnover for essential entities, seven million euros or 1.4 per cent for important ones. The distinction matters directly to insurers, who build it into their cyber and D&O underwriting questionnaires and pricing.
Textbook case: a French metropolitan authority, as a public-administration entity, is designated an essential entity by ANSSI. A mid-sized regional hospital is designated an important entity. Their shared insurer adjusts their cyber policies accordingly, requiring the metropolitan authority to provide proof of a validated NIS2 compliance plan and an audit conducted within the past twelve months, while for the hospital a simplified declaratory questionnaire suffices at underwriting. The deductibles and sub-limits applied reflect the difference in regulatory exposure between the two entities.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.