1. Policies on risk analysis and information system security
2. Incident handling 
3. Business continuity and crisis management (incl. backup and disaster recovery) 
4. Supply chain security 
5. Security in network and information systems acquisition, development and maintenance 
6. Policies and procedures to assess the effectiveness of cybersecurity measures 
7. Basic cyber hygiene practices and cybersecurity training 
8. Policies and procedures on the use of cryptography and, where applicable, encryption 
9. Human resources security, access control policies and asset management 
10. Use of multi-factor authentication, secured voice, video and text communications, and secured emergency communication systems

Annex 1 — Highly critical sectors

1. Energy
2. Transport
3. Banking
4. Financial market infrastructure
5. Health
6. Drinking water
7. Wastewater
8. Digital infrastructure
9. ICT service management (B2B)
10. Public administration
11. Space

Annex 2 — Other critical sectors

1. Postal and courier services
2. Waste management
3. Manufacture, production and distribution of chemicals
4. Production, processing and distribution of food
5. Manufacturing (medical devices, machinery, motor vehicles, electronics)
6. Digital providers (online marketplaces, search engines, social networks)
7. Research

Classification as an essential or important entity depends not only on the Annex but also on the size of the organization. Large organizations in Annex 1 are essential entities; medium-sized organizations in Annex 1 are, in most cases, important entities. The Annex therefore determines the sector, while size also helps determine the regime.