CER Sectors

The CER Directive covers 11 critical sectors. It is within these sectors that national authorities may designate critical entities subject to the directive's requirements for resilience and incident notification.

Back to Dictionary

What are the CER sectors?

The CER Directive defines 11 sectors of high criticality whose functioning is essential for the maintenance of vital societal functions, public health, safety or economic and social wellbeing. National authorities in each EU member state must identify critical entities within these sectors based on a national risk assessment.

The 11 CER sectors

The following sectors are covered by the CER Directive:

Energy: Electricity, district heating and cooling, oil, gas and hydrogen. Covers generation, transmission, distribution and storage.
Transport: Air, rail, water and road transport, including operators, infrastructure managers and traffic management services.
Banking: Credit institutions as defined by the Capital Requirements Regulation.
Financial market infrastructures: Operators of trading venues and central counterparties.
Health: Healthcare providers, EU reference laboratories, entities carrying out research and development of medicinal products, and entities manufacturing basic pharmaceutical products.
Drinking water: Suppliers and distributors of water intended for human consumption.
Wastewater: Entities collecting, treating or discharging urban wastewater, domestic wastewater or industrial wastewater.
Digital infrastructure: Internet exchange point providers, DNS service providers, TLD name registries, cloud computing providers, data centre providers and content delivery networks.
Public administration: Central government entities as defined by member states.
Space: Operators of ground-based infrastructure supporting the provision of space-based services.
Food: Entities engaged in food distribution and large-scale food production and processing.

Overlap with NIS2 sectors

There is significant overlap between the CER sectors and the sectors covered by NIS2. Digital infrastructure, energy, transport, banking, financial market infrastructures, health, drinking water, wastewater and space are covered by both directives. An entity designated as critical under CER that also falls within the scope of NIS2 must comply with both sets of requirements.

Sector-specific rules may apply: Some sectors — notably banking, financial market infrastructures and digital infrastructure — are subject to additional sector-specific EU legislation (such as DORA for financial entities). Where sector-specific rules are at least equivalent to CER requirements, the CER obligations may not apply directly.

Frequently Asked Questions about CER Sectors

How many sectors does CER cover?

The CER Directive covers 11 sectors: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space and food.

Are the CER sectors the same as the NIS2 sectors?

There is significant overlap but not a complete match. Both cover energy, transport, banking, financial markets, health, drinking water, wastewater, digital infrastructure and space. CER additionally covers food and public administration, whilst NIS2 covers additional sectors such as postal services, waste management and manufacturing.

How are critical entities identified within CER sectors?

National competent authorities in each EU member state carry out a national risk assessment every four years and use the results to designate specific entities within the 11 sectors as critical based on their importance for essential service delivery.

Does being in a CER sector automatically make an organisation a critical entity?

No. Operating within a CER sector does not automatically make an organisation subject to the directive. A national authority must specifically designate the entity as critical based on the national risk assessment.

What happens if a sector is covered by both CER and sector-specific legislation?

Where sector-specific EU legislation sets requirements at least equivalent to those of CER, the CER obligations may not apply directly. This is the case for certain aspects of banking and financial market infrastructure regulation.