An entity inside scope must give its national competent authority the identifying information the Member State needs to place it on the list of essential and important entities: legal name, address and current contact details including email addresses, telephone numbers and the IP ranges it uses, the Annex I or Annex II sector and subsector it falls under where one applies, and the list of Member States in which it provides services covered by the Directive. Where the entity is a domain name registration service provider it registers on that basis rather than as an Annex I or II operator. Any change to those details has to reach the authority without delay and in no case later than two weeks after the change takes effect, which makes this a standing data-maintenance duty rather than a one-off filing. Member States were required to build their lists by 17 April 2025 and to refresh them at least every two years, so an entity that reorganises, changes address, adds an IP range or begins serving a further Member State has to push that change itself rather than wait to be asked.
This control maps to 8 controls across 6 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
NIS2 Directive Art.3.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIS2 Directive your existing evidence covers. Hold DORA and 17 of 28 NIS2 Directive controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the DORA pair alone.
The graph holds this control, the 8 it maps to, and the evidence behind each claim, over MCP and REST.