The directive names sectors. It does not name the supply chain those sectors run on, which is where most of the practical burden has landed.
Scope reaches further than the sector list
An organisation outside the annexes still inherits obligations the moment an essential entity depends on it. That dependency is contractual, and the contract is where the requirement arrives: attestation clauses, incident notification windows, evidence of a management system.
We are seeing suppliers of forty people receive questionnaires written for organisations of four thousand. Answering them honestly is the work.
The 24-hour notification is the hard part
Twenty-four hours for an early warning, seventy-two for a formal notification, one month for a final report. The deadline is not the difficulty. The difficulty is having a triage process that can classify an event as significant at three in the morning without waking six people to decide.
Organisations that meet the window have three things in place: a documented severity scale, a named person per shift who can invoke it, and a pre-drafted notification form. None of that requires a tool purchase.
Management liability is the clause people miss
Article 20 puts approval of risk-management measures on management bodies, and makes them accountable for failures. This is the provision that changes budget conversations, because the person signing off is now personally exposed.
In practice it means your security programme needs a paper trail that shows what management was told and when. A quarterly posture report is no longer administrative overhead.
Where to start if you are behind
Map which of your customers are essential or important entities. Read what your contracts with them already commit you to. Then close the gap between those commitments and what you can currently evidence. That ordering matters: it is far cheaper than certifying against a standard you were never asked for.