Sectors of high criticality Energy Electricity generation/distribution, district heating, oil pipelines/refineries, gas networks, hydrogen production and storage. Transport Airlines, airports, air traffic control, railways, maritime/inland shipping, port operators, road ITS operators. Banking Credit institutions as defined by EU Regulation 575/2013. Note: entities subject to DORA are exempt from NIS2 risk management/reporting. Financial market infrastructures Stock exchanges, trading venues, and central counterparties (CCPs) for clearing. Health Hospitals, clinics, pharmaceutical manufacturers (NACE C21), medical device makers, EU reference laboratories. Drinking water Public water supply and distribution utilities providing water intended for human consumption. Wastewater Urban and industrial wastewater collection, disposal, and treatment operators. Digital infrastructure IXPs, DNS providers, TLD registries, cloud services, data centres, CDNs, trust service providers, telecom networks and services. ICT service management (B2B) Companies providing managed IT services (MSP) or managed cybersecurity services (MSSP) to other businesses. Public administration Federal government entities (Bundesverwaltung). Municipal institutions are excluded in Germany. Space Operators of ground-based infrastructure supporting space-based services (not telecom network providers).
Other critical sectors Postal and courier services Postal service providers, courier services, and parcel delivery companies. Waste management Waste collection, treatment, and disposal companies (must be primary business activity). Chemicals Manufacturing, production, and distribution of chemical substances and mixtures (NACE C20). Food Wholesale distribution, industrial food production, and processing companies. Not individual restaurants or small retailers. Manufacturing Medical devices, computers/electronics (C26), electrical equipment (C27), machinery (C28), motor vehicles (C29), transport equipment (C30). Digital providers Online marketplaces (e.g. Amazon, eBay), search engines, and social networking platforms. Research Applied research organizations focused on commercial exploitation (e.g. Fraunhofer). Does not include universities.