NIS2 Space Sector: Which Ground Infrastructure Operators Are In Scope

A satellite operator's mission control room sits in an office park outside a mid-sized European city. Forty staff, a rented antenna field, and a managed IT provider that has had domain admin rights for six years. The satellite is in orbit and outside NIS2. The room that commands it is not.

That gap catches consultants out. The NIS2 space sector is narrow, and most of what people assume is "space" falls outside it.

What the NIS2 space sector actually covers

Annex I, point 11 of Directive (EU) 2022/2555 lists one entity type: operators of ground-based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space-based services. Providers of public electronic communications networks are excluded. They fall under the digital infrastructure sector instead.

Recital 37 explains the logic. The Directive covers space only in so far as services depend on ground-based infrastructure. Nothing in the text regulates the spacecraft itself.

In practice, the ground segment means:

• ground stations and antenna sites
• mission control and satellite operation centres
• telemetry, tracking and command (TT&C) facilities
• gateway sites and dedicated payload data processing centres

Satellite manufacturers, launch providers and in-orbit assets are not in this entity type. A manufacturer may still be in scope through another Annex II sector, but that is a separate question.

Size and classification: who is essential, who is important

The general size-cap rule in Article 2(1) applies. Medium-sized enterprises and above are in scope. Small and micro operators are not, unless a national law or Article 2(2) criteria pull them in.

Space is an Annex I sector. A large operator is classified as an essential entity under Article 3(1). A medium-sized one is an important entity. The difference matters for supervision: essential entities face proactive audits, important entities mostly reactive supervision after an incident or complaint.

Many space operators are small. A ground station operator with 30 staff is typically outside the directive. The same company, owned by a group that exceeds the thresholds and sharing its network, may not be. Check group structure before telling a client they are exempt.

The obligations are the standard NIS2 set

There is no space-specific rulebook in NIS2. A ground segment operator in scope owes the same Article 21 measures as everyone else: risk analysis, incident handling, business continuity, supply chain security, secure development, access control, cryptography and MFA.

Three areas deserve extra attention for this client type:

• Access control on command links. TT&C uplinks are the highest-value target. Privileged access to command systems needs phishing-resistant MFA and session logging.
• Supplier concentration. Antenna time, cloud processing and managed IT often come from two or three vendors. Article 21(2)(d) requires you to assess each one.
• OT-style systems. Antenna controllers and scheduling systems run old software. Segmentation matters more than patching speed.

Incident reporting follows Article 23: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month. Our guide to the reporting deadlines covers the mechanics.

Which regulator supervises a space operator

Each Member State designates its own competent authority. National space agencies such as CNES, ASI or the Netherlands Space Office are policy partners, not NIS2 supervisors. ESA is an intergovernmental organisation and has no NIS2 supervisory role.

Under Article 26(1), a space operator falls under the Member State where it is established. An operator with ground sites in several countries can therefore answer to several regulators. Our post on which regulator supervises your client explains the jurisdiction rules. Registration is a separate duty in most countries, so also read the registration deadlines overview.

National status differs sharply

Germany transposed NIS2 through the NIS2UmsuCG, in force since 6 December 2025, with the space sector in Anlage 1 of the BSIG and the BSI as supervisor. Poland's amended KSC law has applied since 3 April 2026, and the registration deadline was 3 October 2026. Italy's D.Lgs. 138/2024 has applied since October 2024 with ACN as the single authority. The Netherlands applies the Cyberbeveiligingswet from 15 August 2026.

France and Spain have not completed transposition. The Commission announced a referral of both to the Court of Justice on 8 July 2026. In France the Assemblée nationale has postponed examination of the resilience bill again. In Spain only a draft law exists, and the older RDL 12/2018 regime still applies.

The EU Space Act could change who regulates the cybersecurity of space operators

The Commission proposed the EU Space Act on 25 June 2025 (COM(2025) 335 final). It is a proposal, not law. The three institutions disagree on how it relates to NIS2.

The Commission wants the Space Act to act as lex specialis. For NIS2 entities, its cybersecurity chapter would replace the general Article 21 obligations, including threat-led penetration testing before launch and at least every three years, and a 12-hour early warning for Union-owned assets.

The Council's compromise text goes the other way. NIS2 entities would keep following NIS2, and the Space Act obligations would apply mainly to operators outside NIS2, such as small and third-country operators. The Parliament's ITRE draft report from March 2026 rejects a separate regime altogether and would add space activities to NIS2 itself.

Trilogues have not started. One law-firm analysis expects adoption not before late 2027 and application around 2030. Do not build a client programme around a proposal. Build it on NIS2 and treat the Space Act as a watch item.

What to do with a space-adjacent client

Start with scoping, not controls. Ask three questions: does the client operate or manage ground infrastructure that supports space-based services, does it meet the size threshold including its group, and is it an electronic communications provider?

If the answer is yes, yes, no, the client is in scope. Map the ground segment as an asset inventory, then run a gap analysis against Article 21 with TT&C and command access first. If you want a baseline before the first client call, run the NIS2Certify quick scan.

The Space Act will take years. The registration, incident reporting and audit duties under NIS2 apply now.