Application and classification under NIS2: Exploring Linked and Partner enterprises

Why should I read this?

In our interconnected digital age, the security of information and communication systems has become paramount. With the rise of cyber threats, protecting critical infrastructure and essential services has emerged as a crucial task for governments and organizations alike. The NIS2 Directive, a significant step forward in the realm of cybersecurity, addresses these concerns by focusing on enhancing the security and resilience of network and information systems across the European Union. An important concept in the directive is that of linked and partner enterprises. In this article, we will delve into how potential essential or important companies - within for example a corporate concern or group of companies - should take so called ‘partner’ and/or ‘linked’ enterprises into account and thus still fall within the scope of application of NIS2, where they do not exceed the ‘size cap’ on the basis of their own data.[1]

What do I need to know about linked and partner enterprises?

Understanding the NIS2 Directive

The NIS2 Directive, short for the Network and Information Security 2 Directive, is a legislative framework introduced by the EU to strengthen the cybersecurity of critical infrastructure and essential services. The Directive entered into force in January 2023 and requires Member States to transpose the Directive into national legislation by October 2024. As a successor of the NIS Directive, NIS2 contains stronger requirements for a broader scope of actors, including a broader set of mandatory cybersecurity risk-management measures and new incident reporting requirements. Management bodies will be responsible for establishing a culture of risk management, approving sufficient cybersecurity risk-management measures and oversee their implementation. In the case of essential entities, management can face personal liability for non-compliance or suspension from its tasks. Non-compliance may also be punished with fines up to EUR 10 million or 2% of global annual revenue, whichever is higher.

The NIS2 introduces uniform rules for medium-sized and large entities operating in critical sectors. There is a distinction between ‘sectors of high criticality', such as energy, transport, banking, financial market infrastructure, healthcare, drinking and waste water, digital infrastructure, ICT service management (B2B), government and aerospace and 'other critical sectors', such as mail and courier services, waste management, chemicals, food, manufacturing, digital providers and research. In principle, all medium and large companies in these sectors will be covered by NIS2.

Medium-sized and large entities explained

For the definition of medium-sized and large entities the Directive refers in Article 2 to the so-called ‘SME Recommendation’[2]. The Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (2003/361/EC) is a EU document that provides guidelines for defining and categorizing businesses based on their size. The recommendation sets out criteria in terms of employment and financial indicators to classify enterprises as micro, small, or medium-sized enterprises (SMEs). This classification is important for various EU policies and regulations, as it helps tailor support and regulatory measures to the specific needs of businesses at different stages of development.

The key definitions and criteria outlined in the SME Recommendation are:

1. Micro Enterprises: Micro-enterprises are defined as businesses employing fewer than 10 people, and having an annual turnover or total annual balance sheet not exceeding €2 million.
2. Small Enterprises: Small enterprises are those with less than 50 employees, and either an annual turnover of not more than €10 million or an annual balance sheet total not exceeding €10 million.
3. Medium-sized Enterprises: Medium-sized enterprises are those that employ fewer than 250 people and either have an annual turnover of no more than €50 million or an annual balance sheet total not exceeding €43 million.
4. Large Enterprises: Large enterprises are enterprises that employ 250 people or more and either an annual turnover of more than €50 million or an annual balance sheet total of more than €43 million.

The NIS2 Directive refers to this Recommendation when defining the terms ‘important’ and ‘essential’ entities. In the Directive, medium-sized organizations operating in very important areas are considered important, as well as other large and medium-sized organizations in critical sectors. Only large organizations that exceed the limits of medium-sized organizations and fall into very critical sectors are considered essential. Some organizations are automatically considered essential, regardless of their size, if a discontinuing service would have serious consequences for society or if they are the country's sole essential supplier. This includes organizations that provide network and public communications services, trust service providers, DNS and top-level domain name registries. 

Why linked and partner enterprises matter

If an entity has received outside investment from another enterprise, the latter could be classified as a linked or partner enterprise. ‘Linked’ or ‘partner’ enterprises are terms that the European Commission uses to define the relationship between a common shareholder and an entity it has invested in. If a company has received outside investment, and therefore classifies as either a linked or partner enterprise, this could have an impact on whether the company qualifies as a micro, small, medium-sized or large enterprise in the light of the SME Recommendation.

Linked and partner enterprises are terms that come into play within the context of the NIS2 Directive. For potential essential/important entities it is of big importance to determine the size of their entity as it helps them define whether they fall under the definition of ‘important’ or ‘essential’ under the Directive.

Linked and partner enterprises defined

Linked enterprises: These are enterprises that are closely connected to a potential important or essential entity in terms of ownership, control, or operation. They might share resources, networks, or systems that, if compromised, could affect the security of the entity concerned.

There are four alternative ways to determine whether an enterprise is linked to a potential important/essential entity:

1. The enterprise has a majority, i.e. owns more than 50% of the shares and the important/essential entity’s voting rights.
2. The enterprise has the power to appoint or remove the management, administrative or supervisory body from the important/essential entity.
3. The enterprise has the ability to exercise a “dominant influence” over the important/essential entity.
4. The enterprise is an individual shareholder in, or member of, another enterprise pursuant to an agreement with other shareholders in, or members of, that enterprise and has more than 50% of shareholders’ or members’ voting rights in the important/essential entity.

Following qualification of a ‘linked enterprise’, the entity needs to include 100% of the ‘data’ of the linked enterprise, including employee headcount, revenue, balance sheet, and that of any other company the enterprise is ‘linked’ to on its part. This consequently means that the data of such  enterprises the potential essential or important entity is linked to, has an influence on its classification as micro, small, medium-sized or large enterprise and thus ‘essential’ or ‘important’ under the NIS2 Directive.

Partner enterprises: Partner enterprises are companies (upstream companies) that own, alone or together with one or more linked enterprises, 25% or more of the capital or voting rights of an potential essential or important entity (downstream company). 

This is not a ‘linked enterprise’ because the partner enterprise does not have a majority share. But there are some exceptions to the rule. Even if the 25% threshold is reached or surpassed by the enterprise, it may not be classified as a linked or partner enterprise when it concerns one of the following:

• public investment corporations and VCs
• individuals or groups of individuals with a regular venture capital investment activity who invest equity capital in unquoted businesses (‘business angels’), provided the total investment of those business angels in the same enterprise is less than €1.25 million
• universities or non-profit research centres
• institutional investors, including regional development funds
• autonomous local authorities with an annual budget of less than €10 million and fewer than 5,000 inhabitants

Businesses can remain autonomous enterprises while having one or more ‘investors’ listed above. However, each of them must not have a stake of more than 50%, and they must not be linked to each other.

If a potential important or essential entity has a partner enterprise according to aforementioned criteria the partner enterprise data, including assets, balance sheet and employee count will proportionately contribute to its own. As a result, the amount contributed is determined by how much of the business the partner enterprise owns. This similarly means that the data of the partner enterprise, has an influence on a company’s classification as micro, small, medium-sized or large enterprise. On top of the data of the partner enterprise, would add 100% of the data of the linked enterprises which are linked to these partner enterprises, unless the data is already included through consolidation. So again, for potential important or essential entities, having a partner enterprise is of important for the classification as one or the other.

Linked and partner enterprises under NIS2

In addition to the importance of linked and partner enterprises for the classification of an entity as important or essential, there are also a number of substantive reasons why it is important for important or essential entities to be aware of their linked and partner enterprises:

• Cybersecurity Ecosystem: Today's digital landscape is highly interconnected, with various organizations relying on each other for seamless services. As a result, a security breach in one entity can lead to a domino effect, impacting numerous others.
• Risk Mitigation: By addressing linked and partner enterprises, the NIS2 Directive seeks to mitigate the risks associated with cybersecurity incidents. A coordinated approach that considers the security of interconnected entities is crucial for maintaining a robust cybersecurity posture.
• Collaborative Defence: Recognizing the potential ripple effects of a cyber incident, the directive encourages collaboration among linked and partner enterprises. This collective approach helps in proactive threat detection, response and recovery.

What are the implications for businesses?

In an era where digital interdependence is the norm, the NIS2 Directive is a way of executing the EU’s commitment to strengthening cybersecurity across the region. By acknowledging the complex relationships between various entities and fostering collaboration, the directive aims to create a more secure and resilient digital landscape.

For businesses falling under the scope of the NIS2 Directive, understanding the nuances of linked and partner enterprises is crucial. Compliance with the directive involves not only safeguarding their own systems, but also considering the potential impact of their operations on interconnected enterprises. Implementing measures to ensure the security and resilience of linked and partner enterprises is integral to fulfilling the obligations set forth by the directive.

The data of linked and partner enterprises, along with their interconnected counterparts, collectively contribute to shaping the classification of an entity as important or essential and in addition in the realm of micro, small, medium-sized, or large enterprises. This complex web of interdependence urges for careful consideration of the adequate classification of an entity and subsequent cybersecurity compliance efforts.

Thanks to Isabel Schuurs for her research on the subject matter and text drafts.

[1]                 See Article 2 for the scope of application of the NIS2, introducing the so-called ‘size cap’.

[2]                 The SME Recommendation was introduced to standardize the definition of SMEs across the EU member states, ensuring consistency in the application of various policies and regulations that are aimed at supporting small and medium-sized enterprises. This standardization helps in creating a level playing field for businesses across different countries within the EU and allows for better targeting of support measures.

Further reading on the NIS2 Directive

Everything you need to know about the NIS2 Directive

For more information about the NIS2 Directive