Digital infrastructure is the layer every other sector rests on: internet exchange points, DNS services, top level domain registries, cloud providers, data centres, content delivery networks, trust service providers and public electronic communications networks. An incident at this level is never local. The unavailability of a DNS provider or of a data centre translates immediately into stopped services at hospitals, banks, public administration and utility operators, that is, at exactly the entities that depend on it without controlling it.
Directive (EU) 2022/2555 (NIS 2) treats digital infrastructure as a sector of high criticality in Annex I and imposes obligations proportionate to that propagation effect: risk analysis, proportionate technical and organisational measures, incident reporting and service continuity. For these operators, their own security is in practice a condition of their customers security.
Legal framework
At European level:
- Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex
At national level (Romania):
- GEO no. 155/2024: Official Gazette no. 1332/2024
- Law no. 124/2025: Official Gazette no. 638/2025
- DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
- Order on disruption criteria and risk assessment: Official Gazette no. 776/2025
The Digital infrastructure sector
Essential entities:
Internet exchange point providers, DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, trust service providers, and providers of public electronic communications networks and services.
- Internet exchange point operators
- DNS service providers and top level domain name registries
- Cloud computing and data centre service providers
- Content delivery network operators
- Qualified and non-qualified trust service providers
- Providers of public electronic communications networks and services
Sector-specific cyber threats
- Distributed denial of service against DNS and exchange infrastructure
- DNS cache poisoning and hijacking of routing announcements
- Compromise of hypervisors or management planes in cloud environments
- Physical and logical attacks on data centre access control systems
- Compromise of certificate issuance and trust service processes
- Supply chain attacks through infrastructure automation tooling
NIS 2 requirements for the digital infrastructure sector
Mandatory measures:
- Inventory and classification of critical IT and OT assets
- Security policies approved at management level, with explicit responsibilities
- Network segmentation and separation of OT and IT communication channels
- Traffic monitoring and anomaly detection (IDS/IPS)
- Access control and multi-factor authentication, including for remote supplier access
- Incident response and business continuity plans, tested annually
- Cybersecurity training for operations and maintenance teams
- External security audits and attack simulations
- Monitoring of equipment and IT service suppliers
Critical interdependencies
- Every other essential sector depends on these services without controlling them
- Concentration of many customers on a small number of providers
- Dependency on electricity supply and on cooling for data centres
- Cross-border effects, since a single provider serves multiple Member States
For digital infrastructure operators, resilience is not an internal matter. NIS 2 imposes a heightened responsibility on them precisely because a single incident propagates across sectors and borders, and complying with the directive means protecting the backbone of the European digital society.
The other sectors in this series
The NIS 2 Directive covers eleven sectors of high criticality. Each has its own essential entities, specific threats and mandatory measures.