ENISA NIS360 2026 — public administration, health and water sit in the NIS2 "risk zone"

ENISA published its third annual NIS360 sectoral-maturity assessment on 2026-05-28, scoring all 18 NIS2 Annex I high-criticality sectors on legislation effectiveness, organisational preparedness, authority capacity and ecosystem maturity. The risk-zone sectors — criticality exceeding maturity — are health, railway (newly entered), maritime, ICT management services, space, public administrations, drinking water (newly entered) and wastewater (newly entered); gas exited after targeted investment. Trust services, aviation and financial-market infrastructures sit in the higher-maturity band, while banking, electricity and telecom are scored among the most critical sectors. The defender-relevant read for this audience: the sectors a Swiss/EU public-sector SOC most often is or serves — public administration, health, water — are precisely the ones ENISA flags as under-resourced relative to their societal importance, which signals where NIS2 supervisory and investment pressure will concentrate next. Use the report as leverage for sector-specific funding and as a benchmark for the maturity axes your own programme is weakest on.