ENISA NIS360 2026: cyber maturity and criticality of NIS2 high-criticality sectors

In two minutes

• Cyber maturity across EU sectors of high criticality has improved since the last edition, but progress is uneven across and within sectors (executive summary, p. 10).
• ENISA places banking, electricity and telecommunications in the high maturity, high criticality group. Trust services, aviation and financial market infrastructures moved into the high maturity band. Gas, road, maritime and health improved within the moderate band (executive summary).
• The report defines a risk zone: sectors with lower-than-average maturity whose criticality exceeds it. Rail, drinking water and waste water are now inside it. Health, maritime, ICT service management, space and public administrations remain there. Gas has started moving out (pp. 8, 12).
• Criticality changes slowly by design. Space joined the most-critical group, and railway criticality was revised upward because of its role in military logistics and heightened exposure to cyber threat (p. 9).
• ENISA ties the gains to legislation such as DORA and NIS2, more political attention, and progress in information sharing and operational preparedness (pp. 10-11).
• Recurring weak points are legacy systems and OT, skills shortages, third-party and supply chain exposure, and thin supervisory expertise at national authorities. SMEs report more difficulty than larger firms on all dimensions (p. 14).
• The report names AI, supply chain risk and geopolitical volatility as the three forces shaping all sectors (p. 15).
• Each sector section ends with 'next steps' for support, such as OT visibility and supplier access in energy, more regular response testing in digital infrastructure, and management training in public administrations (sections 2.1 to 2.9).

Key numbers

• 70%: Share of surveyed organisations naming regulatory compliance as the main driver of cybersecurity investment (NIS Investments 2025 study) (p. 10).
• 90%: Share of surveyed organisations reporting controls to manage supply chain risk (p. 11).
• 55% and 47%: Entities citing ransomware and supply chain attacks as top future concerns (p. 11, footnote 10).
• 50%, 49%, 37%: Organisations naming patch management, business continuity and disaster recovery, and supply chain risk management as the most challenging NIS2 areas (p. 11, footnote 9).
• 35% and 26%: Organisations reporting faster incident detection and improved response and recovery (p. 11, footnote 14).
• About two in five: Transport companies that still exclude OT from cybersecurity assessments (p. 27).
• About half: Cloud and data centre providers that only record risks without systematically prioritising or treating them (p. 22).
• 69% and 24%: Share of attacks on public administrations hitting central government and local administrations (p. 37).

What to do with it

• Compare your sector's position (high maturity, upper-moderate, risk zone, other) with your own view of where you stand, using the groupings on pp. 12-14.
• If you run OT, check the energy and transport next steps: OT asset visibility, governance of remote and supplier access, non-disruptive testing, and including OT in assessments (pp. 20, 27).
• Review how you prioritise and treat recorded risks, and how often you test incident response and BCP/DR plans, as the digital infrastructure section advises (p. 23).
• Treat MSP and MSSP dependence as a supply chain exposure. The report flags the sector's moderate maturity as a concern for its clients (p. 36).
• Check management-level cyber expertise and training, which the report finds weak in public administrations and FMIs (pp. 29, 38).
• Use the sector 'next steps' lists as a checklist when briefing your board or engaging your national authority.

Read the full document if

• you work in or supply energy, transport, health, water, space, public administration, finance, digital infrastructure or managed services and want ENISA's sector view
• you need EU-level evidence on how NIS2 and DORA are changing maturity
• you brief a board on where sectoral risk concentrates and why

What it relies on

ENISA's own NIS360 methodology, which assesses whole sector ecosystems (legislation, companies, authorities, sector structures). It draws on annual surveys of national authorities and companies, sectoral reports, Eurostat and other EU data, and the ENISA NIS Investments 2025 study. Sample sizes are not given in the pages supplied. Hydrogen and district heating were not assessed because of very few responses (p. 14). ENISA says findings are generalised to the EU and may not fit individual entities or Member States (p. 8). Incident examples cite outside press and vendor reports. The supplied text ends partway through section 2.9, so the annexes and full methodology were not reviewed. ENISA is an EU agency and sells nothing the report recommends.

Our read

A sector-by-sector reference for EU regulatory context. It shows where ENISA sees maturity gaps and what support it proposes. Results appear as bands and charts, with few tables of figures, and sample sizes are not stated in the pages we read. Useful for benchmarking and board briefings, less so as a technical control guide.