NIS2: essential vs important entities

NIS2 splits regulated entities into two tiers: essential and important. Essential entities cover sectors like energy, transport, banking, health, and digital infrastructure—think of these as the backbone of society where a breach could cause widespread disruption. Important entities include postal services, waste management, chemicals, food production, and manufacturing; these are still critical but with a lower systemic risk. The key contrast is that essential entities face stricter supervision, including proactive ex-ante checks, while important entities get lighter ex-post oversight.

To avoid mixing them up, remember the 'essential' sectors are those where a failure would halt daily life: power cuts, no transport, no hospitals. For important sectors, think of services that are vital but have more redundancy, like food supply or waste collection. A common exam trick is to list a sector like 'digital providers' as important—it's actually essential. Another trap: 'public administration' is essential only at national level, not local. If a question gives you a sector, first ask: 'Would a major outage here make the news and stop people working?' If yes, it's likely essential.

Test yourself with a quick mental sort: energy, health, banking—essential; postal, chemicals, manufacturing—important. If you get stuck, the mnemonic 'E-BIT' helps: Essential sectors are Banking, Infrastructure (digital), Transport. Everything else in NIS2 is important. This one contrast is the most common point of confusion in exam questions on NIS2 scope.