NIS2 Waste Management and Postal Services: Who Is In Scope

A regional waste collector with 90 employees runs its fleet routing, weighbridge and invoicing on three connected systems. A courier depot next door depends on one parcel-sorting platform and a cloud tracking portal. Neither owner has ever filed a cybersecurity report. Both now sit in a sector the EU calls "critical", and both get asked about it by customers.

This is the NIS2 waste management and postal question. Both sectors are listed in Annex II of Directive (EU) 2022/2555, the "other critical sectors". The wording is narrower than most clients fear, and wider than most clients hope.

What Annex II actually covers

Item 1 of Annex II is postal and courier services: "postal service providers as defined in Article 2, point (1a), of Directive 97/67/EC, including providers of courier services". Courier firms are named explicitly. Parcel networks, last-mile couriers and traditional postal operators all fall into the same entry.

Item 3 is waste management: undertakings carrying out waste management as defined in Article 3, point (9), of Directive 2008/98/EC. Under that definition, waste management means the collection, transport, recovery and disposal of waste. A collector, a transporter, a sorting plant and a landfill operator can all qualify.

The carve-out that decides most waste cases

The waste entry excludes "undertakings for whom waste management is not their principal economic activity". That is the single most useful sentence for your client conversations.

A manufacturer that handles its own production scrap is not in scope for that reason. A scrap-metal trader whose main business is collecting and processing waste may be. Ask one question: is waste management the main thing this company earns its money from? Document the answer, and the evidence behind it.

The postal entry has no equivalent carve-out. If a company provides postal or courier services as a business, test it against the size rule.

The size rule: medium and above

NIS2 applies to medium-sized and large entities in the listed sectors. In practice that means at least 50 staff or more than €10 million in annual turnover or balance sheet. Micro and small firms are generally outside the baseline, although Member States can add exceptions for specific situations.

Annex II entities are classed as important entities, not essential ones. That affects supervision. Authorities can act after an incident or a complaint, rather than running routine inspections. It does not reduce the obligations.

What an important entity must do

The duties are the same as for every in-scope organisation. Article 21 requires appropriate and proportionate risk-management measures across ten areas: risk analysis policies, incident handling, business continuity, supply chain security, secure acquisition and maintenance, assessing effectiveness, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication or secured communications. See our guide to the ten Article 21 measures.

Management bodies must approve those measures and answer for them. They also need training. For a family-owned haulier or a regional postal operator, this is often the first time a director has been formally accountable for IT risk.

Where these sectors are exposed

Operational technology in waste handling is easy to overlook. Weighbridges, compactor controls, landfill gas monitoring and fleet telematics are all networked. A ransomware event that stops weighbridge invoicing stops collection revenue the same day.

In postal and courier operations, the pressure point is the sorting and tracking platform. Many couriers run on a single SaaS provider. If that provider fails, so does the depot. That is a supply chain question under Article 21(2)(d), and it is the first thing a customer questionnaire will probe.

Both sectors also depend on subcontractors: owner-driver couriers, haulage partners, third-party route-planning tools. A written inventory of those suppliers, with security terms in the contract, is cheap and rarely exists. Our post on NIS2 supply chain security shows how to build it.

Incident reporting works the same way

A significant incident triggers an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month under Article 23. Clients usually have no process for the first hour, never mind the first day. The reporting deadlines are where a short tabletop exercise pays off.

Penalties for important entities

Article 34 sets maximum administrative fines for important entities of at least €7 million or at least 1.4% of total worldwide annual turnover, whichever is higher. These are ceilings set by the Directive. National law sets the final figures. We cover the full picture in NIS2 fines.

Transposition differs by country

The Directive is the same everywhere, but the obligations your client faces depend on the national law and regulator. Some Member States have transposed NIS2 and are registering entities. Others are still behind, and the Commission has referred several to the Court of Justice. Check the live position before you advise a cross-border client. The EU implementation timeline is a good starting point.

A practical order of work for these clients

Start with scope. Write a one-page memo that states the sector entry, the principal-activity test for waste, the size figures and the conclusion. Regulators and customers both ask for exactly this.

Then run a gap analysis against the ten measures, and prioritise supplier inventory, incident contacts and backup testing. Most waste and postal clients are weakest on those three. If you want a fast baseline, the NIS2Certify quick scan gives you a readiness assessment you can walk through with the client in one meeting.

Finally, put the incident clock on paper: who decides what is significant, who calls the authority, and who writes the 72-hour notification. A tested one-page plan beats a 40-page policy nobody has read.

Scope depends on the entity, the country and the facts. Your job is to make the decision defensible. If the chemical sector taught consultants anything, it is that Annex II scope questions are won on documentation, not assumption. For a general first check, see does NIS2 apply to my organisation.