Essential Entity

Essential entities under NIS2 face the strictest cybersecurity requirements due to their importance to society and the economy.

Classification Criteria (Space Sector) An entity is essential if it:

• Provides critical space infrastructure services

• Exceeds the ceilings for medium-sized enterprises under Recommendation 2003/361/EC (Art. 3(1)(a)); in Germany, for example, at least 250 employees, or annual turnover above €50 million and balance sheet total above €43 million (BSIG § 28(1) no. 4)

• Operates systems designated as critical by member states

• Provides services essential to public safety

Enhanced Obligations Essential entities must:

• Implement comprehensive risk management

• Report significant incidents (Art. 23(4): early warning within 24 hours, notification within 72 hours of becoming aware)

• Undergo regular security audits

• Ensure supply chain security

• Handle and disclose vulnerabilities (Art. 21(2)(e))

Supervision Regime

• Proactive supervision by authorities

• Regular audits and inspections

• Security scanning

• Information requests

Penalties Non-compliance can result in:

• Fines for infringements of Art. 21 or 23 with a maximum of at least €10 million or 2% of total worldwide annual turnover, whichever is higher (Art. 34(4))

• Management liability (Art. 20(1), 32(6))

• Where earlier enforcement measures are ineffective and a deadline passes: temporary suspension of a certification or authorisation, and a temporary ban on managerial functions (Art. 32(5))

• An order to make public aspects of infringements (Art. 32(4))

Space Sector Examples

• Operators of ground-based infrastructure that support the provision of space-based services (Annex I, point 11)

• Providers of public electronic communications networks or publicly available electronic communications services (digital infrastructure, Annex I, point 8)