Article 6 — Definitions

NIS2, Directive (EU) 2022/2555

What does NIS2 Article 6 say?

Short answer, straight from the official text

For the purposes of this Directive, the following definitions apply: (1) ‘network and information system’ means: (a) an electronic communications network as defined in Article 2, point (1), of Directive (EU) 2018/1972;

Source: NIS2, Directive (EU) 2022/2555, read 2026-08-14.

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

Jump to a point: Point 1 · Point 2 · Point 3 · Point 4 · Point 5 · Point 6 · Point 7 · Point 8 · Point 9

For the purposes of this Directive, the following definitions apply:

(1) ‘network and information system’ means:

(a) an electronic communications network as defined in Article 2, point (1), of Directive (EU) 2018/1972;

(b) any device or group of interconnected or related devices, one or more of which, pursuant to a programme, carry out automatic processing of digital data; or

(c) digital data stored, processed, retrieved or transmitted by elements covered under points (a) and (b) for the purposes of their operation, use, protection and maintenance;

(2) ‘security of network and information systems’ means the ability of network and information systems to resist, at a given level of confidence, any event that may compromise the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, those network and information systems;

(3) ‘cybersecurity’ means cybersecurity as defined in Article 2, point (1), of Regulation (EU) 2019/881;

(4) ‘national cybersecurity strategy ’ means a coherent framework of a Member State providing strategic objectives and priorities in the area of cybersecurity and the governance to achieve them in that Member State;

(5) ‘near miss’ means an event that could have compromised the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems, but that was successfully prevented from materialising or that did not materialise;

The article continues in the official text.

Open the article on EUR-Lex

• Previous article
• Next article

Other articles in this chapter

• Article 1
• Article 2
• Article 3
• Article 4
• Article 5

The same rule in other acts

These articles carry the same official heading. The wording is not identical; read each text at its own source.

• GDPR Article 4 — Definitions
• AI Act Article 3 — Definitions
• DSA Article 3 — Definitions
• DMA Article 2 — Definitions

Who does this apply to

The register names five roles. Open a role to see the duties this act places on it, each row with its article and its source.

• Cloud service provider

Does this apply to us?

• Do ai governance rules apply to a cloud provider?
• Do personal data rules apply to a cloud provider?
• Do cross-border data rules apply to a cloud provider?
• Do cybersecurity rules apply to a cloud provider?
• Do health data rules apply to a cloud provider?
• Do online platforms rules apply to a cloud provider?

All roles in the register · All questions by role

The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.

Back to the act · EU acts, read down to the national law

ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.

Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.