Who's in scope

Is your organisation in scope?

Scope is generally determined by sector and size. Medium and large organisations in a covered sector are in scope — broadly, those with 50 or more staff, or an annual turnover or balance sheet total above €10 million — split into two enforcement tiers.

TIER 1

Essential entities

Large organisations in high-criticality sectors. Subject to proactive supervision — audits, inspections, and the highest penalties.

EXAMPLE SECTORS (ANNEX I)

  • Energy
  • Transport
  • Banking
  • Financial markets
  • Health
  • Drinking water
  • Waste water
  • Digital infrastructure
  • ICT service management
  • Public administration
  • Space

TIER 2

Important entities

Medium organisations, plus other critical sectors. Subject to reactive supervision — authorities act only when there is evidence of non-compliance.

EXAMPLE SECTORS (ANNEX II)

  • Postal & courier
  • Waste management
  • Chemicals
  • Food
  • Manufacturing
  • Digital providers
  • Research

The size test

  • Large: 250 or more employees, or a turnover above €50M and a balance sheet total above €43M.
  • Medium: 50–249 employees, or a turnover / balance sheet total above €10M (up to the large ceilings).
  • Below these thresholds, entities are generally out of scope — subject to the exceptions below.

How the tier is set

Your tier depends on sector (Annex I high-criticality vs Annex II other critical) and size. Broadly: large entities in Annex I sectors are essential; medium entities in Annex I, and entities of any qualifying size in Annex II, are important. Some entity types are always essential, regardless of size.

Annex I — sectors of high criticality

  • Energy
  • Transport
  • Banking
  • Financial market infrastructures
  • Health
  • Drinking water
  • Waste water
  • Digital infrastructure
  • ICT service management (business-to-business)
  • Public administration
  • Space

Annex II — other critical sectors

  • Postal and courier services
  • Waste management
  • Manufacture and distribution of chemicals
  • Production, processing and distribution of food
  • Manufacturing (medical devices, electronics, machinery, vehicles and more)
  • Digital providers (online marketplaces, search engines, social platforms)
  • Research organisations

In scope regardless of size

Some entities are covered whatever their size, because of the criticality of what they do:

  • DNS service providers
  • Top-level domain (TLD) name registries
  • Providers of public electronic communications networks or services
  • Trust service providers
  • Certain public administration bodies
  • Sole providers of a critical service in a member state

Think you might be in scope?

The readiness assessment estimates your tier and scores your preparedness in about a minute.

Start free assessment →