NIS Representation EU FAQ

Question 1

Who must comply with the NIS?

Accepted Answer

The Directive on Security of Network and Information Systems (NIS2) updates the original NIS 1 to improve cybersecurity across essential and important sectors in the EU, expanding its scope to more industries and introducing stricter requirements. It addresses:

- Operators of Essential Services (OES) e.g. in the energy, banking, transport, digital infrastructure, ICT service management (B2B) sectors; and
- Operators of Important Services e.g. postal services, waste management, research, digital providers.

It applies to companies that
- meet the thresholds
- have an establishment in the EU
- are established outside the EU but are offering their services within the EU.

Question 2

What is a Digital Service Provider?

Accepted Answer

A Digital Service Provider is any legal person that offers a digital service.

**Online Marketplaces:** An online marketplace is a place that allows consumers and traders to conduct online sales or service contracts with traders, and which functions as the final destination for the conclusion of those contracts. Application stores, which operate as online stores enabling the digital distribution of applications or software programs from third parties, are a type of online marketplace. The term does not include online services that function only as an intermediary to third-party services through which a contract can be ultimately concluded.

**Online Search Engines:** An online search engine allows the user to perform searches of websites based on a query on any subject. It can also be focused on websites in certain languages. Search functions that are limited to the content of a specific website, even if the function is provided by an external search engine, are not included in the NIS-Directive. Online services that compare the price of particular products or services from different traders, and then redirect the user to the preferred trader to purchase the product, are also not included.

**Providers of social networking platforms:** An social networking platform enables end-users to connect, share, discover and communicate with each other across multiple devices, in particular via chats, posts, videos and recommendations.

Question 3

What falls under the Digital Infrastructure Sector?

Accepted Answer

## Internet Exchange Point providers
Is a network facility which enables the interconnection of more than two independent networks (autonomous systems), primarily for the purpose of facilitating the exchange of internet traffic, which provides interconnection only for autonomous systems and which neither requires the internet traffic passing between any pair of participating autonomous systems to pass through any third autonomous system nor alters or otherwise interferes with such traffic.

## DNS service providers, excluding operators of root name servers is an entity that provides:
- A publicly available recursive domain name resolution services for internet end-users; or
- An authoritative domain name resolution services for third-party use, with the exception of root name servers.

## TLD name registries
Is an entity which has been delegated a specific TLD and is responsible for administering the TLD including the registration of domain names under the TLD and the technical operation of the TLD, including the operation of its name servers, the maintenance of its databases and the distribution of TLD zone files across name servers, irrespective of whether any of those operations are carried out by the entity itself or are outsourced, but excluding situations where TLD names are used by a registry only for its own use.

## Cloud computing service providers
Cloud computing services allow access to a scalable and elastic pool of shareable computing resources such as networks, servers or other infrastructure, storage, applications, and services. The NISD mentions three properties that a cloud computing service must have in order to be qualified as a cloud service:

### Scalable Resources
Resources can be flexibly allocated by the cloud services provider, irrespective of the geographical location of the resources, in order to handle fluctuations in demand; and

### Elastic Pool of Resources
Computing resources that are provisioned and released according to demand to rapidly increase and decrease resources available depending on workload; and

### Shareable
Computing resources are provided to multiple users who share a common access to the service, but the processing is carried out separately for each user even though the service is provided from the same electronic equipment.

Different business models such as IaaS (Infrastructure as a Service), PaaS (Platform as a Service) or SaaS (Software as a Service) are included in the NISD2.

## Data centre service providers
Is a service that encompasses structures, or groups of structures, dedicated to the centralised accommodation, interconnection and operation of IT and network equipment providing data storage, processing and transport services together with all the facilities and infrastructures for power distribution and environmental control.

## Content delivery network providers
Is a network of geographically distributed servers for the purpose of ensuring high availability, accessibility or fast delivery of digital content and services to internet users on behalf of content and service providers

## Trust service providers
Offers electronical services for remuneration that includes the creation, verification, and validation of electronical signatures, seals, time stamps, registered delivery services, and related certificates; or creation, verification, and validation of certificates for website authentication; or the preservation of electronic signatures, seals, or related certificates.

## Providers of public electronic communications networks
Provides a transmission systems, whether or not based on a permanent infrastructure or centralised administration capacity, and, where applicable, switching or routing equipment and other resources, including network elements which are not active, which permit the conveyance of signals by wire, radio, optical or other electromagnetic means, including satellite networks, fixed (circuit- and packet-switched, including internet) and mobile networks, electricity cable systems, to the extent that they are used for the purpose of transmitting signals, networks used for radio and television broadcasting, and cable television networks, irrespective of the type of information conveyed.

## Providers of publicly available electronic communications services
Is a service normally provided for remuneration via electronic communications networks, which encompasses, with the exception of services providing, or exercising editorial control over, content transmitted using electronic communications networks and services, the following types of services:

- Internet access service
- Interpersonal communications service; and
- Services consisting wholly or mainly in the conveyance of signals such as transmission services used for the provision of machine-to-machine services and for broadcasting.

Question 4

What falls under the ICT Service Management (business-to-business) Sector?

Accepted Answer

**Managed service provider:** Is an entity  that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers’ premises or remotely.

**Managed security provider:** Is a managed service provider that carries out or provides assistance for
activities relating to cybersecurity risk management.

Question 5

Does my company offer services in the EU?

Accepted Answer

When determining whether a company offers their service within the EU, the important information is which markets the company is planning to offer its services to. In order to determine the intention, different factors are considered. The mere accessibility of either the entity's or an intermediary’s website or of an email address
or other contact details, or the use of a language which is generally used in the region where the entity is established, is insufficient to ascertain such intention. Instead, factors such as the use of a language or a currency generally used in one or more Member States and the possibility of ordering services in that other language, or the mentioning of customers or users who are in the Union may be an indicator that the entity is intending to offer their services within a region where it doesn’t have its main establishment.

Question 6

Are there any exemptions from this obligation?

Accepted Answer

If your company does not have an establishment in the EU but offers the mentioned digital services in these regions, you are generally obliged to appoint a NIS representative.

However, the obligation to comply with the NIS2 and to appoint a representative does not apply to companies that do not exceed a certain company size. Excluded are:

- Small Enterprises, which are defined as enterprises which employ less than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed 10 million; and
- Microenterprises, which are defined as enterprises which employ less than 10 persons and whose annual turnover and/or annual balance sheet total does not exceed 2 million

All in all, this means that if your company has less than 50 employees and the annual turnover and/or annual balance sheet total is less than 10 million, you do not have to appoint a representative.

Question 7

What are the main obligations for entities under the NIS-Directive?

Accepted Answer

When it comes to entities falling under the scope of the NIS2, the main obligations are the following:

- **Cybersecurity risk-management measures:** DSPs must identify and take appropriate and proportionate technical and organisational measures to manage risks posed to the security of network and information systems which they use in the context of offering their services within the EU.
- **Reporting Obligation:** Entities are required to follow specific reporting timelines in the event of a significant cybersecurity incident. The key obligations include:
    - Early Warning: Report within 24 hours of becoming aware of a significant incident, indicating whether it may involve unlawful acts or have cross-border impact.
    - Incident Notification: Submit a detailed incident notification within 72 hours, providing an initial assessment, severity, impact, and available indicators of compromise.
    - Intermediate Report: Provide status updates upon request from the relevant authority or CSIRT.
    - Final Report: Submit a detailed final report within one month, covering the incident description, root cause, mitigation measures, and potential cross-border impact.
- Representative: Entities that are not established in the EU but offer certain services within the EU are required to appoint a representative who acts on behalf of the entity. These entities include: 
    - DNS service providers
    - Top-level domain (TLD) registries
    - Entities providing domain name registration services
    - Cloud computing service providers
    - Data center service providers
    - Content delivery network (CDN) providers
    - Managed service providers
    - Managed security service providers
    - Providers of online marketplaces
    - Online search engines
    - Social networking services platforms

Question 8

Which NIS law do I have to comply with?

Accepted Answer

Unlike the GDPR, which is one law applicable in all Member States, the NIS2 has been implemented individually by every EU Member State into their own national laws. Which national law is applicable to your company is determined as follows, always assuming that your company is an **essential or important entity** and exceeds the relevant thresholds:

- If your company has one or more establishments within the EU, then your company is governed by the jurisdiction of the Member State in which it has its main establishment (i.e. where your head office is);
- If you are not established within the EU, but are offering your services **as an ICT Service Management Provider, Digital Infrastructure Provider or Digital Service Provider** within the EU, you will have to appoint a representative that is established in a Member State where you offer your services. Your company is then deemed to be under the jurisdiction of the Member State where the representative is established;

Question 9

Does our company have to appoint an Art. 26 (3) NIS2-Directive representative in the EU?

Accepted Answer

According to Art. 26 (3) of the NIS2-Directive (and most transpositions in national law), Digital Service Providers that:

* are not established in the EU; and
* offer certain digital services within the EU
must designate a representative in the EU who is established in one of the Member States in which the services are being offered.

After Brexit, the UK is considered a "third country" from an EU perspective. Therefore, an establishment in the UK does not count as an "establishment in a Member State" anymore. Consequently, if you are a UK based company without an establishment in the EU but you are offering your services there, you will have to appoint an Art. 26 (3) in the EU.

Question 10

What are the possible consequences of non-compliance?

Accepted Answer

Since NIS2 law is based on an EU directive which is implemented differently in each Member State, there is no universal penalty amount.

**However, the law lays down some fine frameworks for Member States for non compliance with the requirement of implementing security measures and incident responses. Following the law, essentiel entities may be fined up to EUR 10 million or 2% of their total worldwide annual turnover. Important entities may face fines up to EUR 7 million or 1,4% of their total worldwide annual turnover.**

Question 11

What are the general requirements when appointing a representative and what are the obligations of the representative?

Accepted Answer

The representative should be explicitly designated through a written mandate by the Providers of Digital Services Provider ,Digital Infrastructures and ICT Service Managaments. It should be possible for the relevant authorities or the Computer Security Incident Response Team (CSIRT) to contact the representative as the representative will act as a local contact point. The representative acts on behalf of the DSP Providers regarding the legal obligations under the NIS law, including incident reporting. The representative will have to comply with the local national laws of where they are established.

Question 12

How does Prighter comply with these requirements?

Accepted Answer

Prighter has an end-to-end digital onboarding process in which a Power of Attorney is generated and can be signed online or in paper. Prighter provides dedicated communication channels with the relevant data protection authorities.

Does my company need a NIS–Representative?

Your all in One NIS 2 Representation

Features and Services

Compliance first — Get Ready. Stay Compliant.

Appointment of a Representative

Registration and Reporting

Addressee for Authorities and CSIRTs

More than Compliance — Streamlined. Efficient. Digital.

Competent Authority – Reduce Complexity

Multiple Locations

Tech Augmented Representation

Your Safeguard — Reduce Risk. Gain Trust.

Incidence Response

Service for Recipients

Specialized Team