Free tool
NIS2 Scope Checker
Does the NIS2 directive apply to your organization? Answer 6 questions and get an instant verdict: Essential, Important, or Out of Scope. No signup required.
Where is your organization primarily established?
How NIS2 scoping works
The NIS2 Directive (EU 2022/2555) applies to organizations based on three criteria:
- Sector: You must operate in one of the 18 sectors listed in Annex I (high criticality) or Annex II (other critical). Annex I covers energy, transport, banking, health, water, digital infrastructure, and public administration. Annex II covers manufacturing, waste, chemicals, food, digital providers, and research.
- Size: NIS2 generally applies to medium and large enterprises. Medium = 50+ employees, or more than EUR 10M on both turnover and balance sheet. Large = 250+ employees, or more than EUR 50M turnover together with more than EUR 43M balance sheet. Small enterprises are usually exempt.
- Size-independent types: Public electronic communications providers, trust service providers, TLD registries and DNS providers are in scope regardless of size (Article 2(2)(a)). Cloud providers, data centres and CDNs are not: the size test applies to them.
If you meet these criteria, you're classified as either an Essential Entity (Annex I organizations above the medium ceilings; qualified trust service providers, TLD registries, DNS providers and central government at any size; public electronic communications providers from medium size, Article 3(1)) or an Important Entity (every other entity in scope: medium organizations in Annex I, and organizations in Annex II, Article 3(2)).
Essential entities face stricter supervision and higher fines (up to EUR 10M or 2% of turnover). Important entities face slightly lower fines (up to EUR 7M or 1.4% of turnover) and lighter ex-post supervision.
What NIS2 requires once you're in scope
Being in scope is only the first answer. NIS2 then imposes three layers of obligation: technical and organisational risk-management measures, incident-reporting duties on a strict clock, and registration plus management accountability.
The ten Article 21(2) risk-management measures
Every in-scope entity must implement these baseline measures, proportionate to its size and risk exposure:
- Risk-analysis and information-system security policies.
- Incident handling (detection, response and recovery).
- Business continuity — backup management, disaster recovery and crisis management.
- Supply-chain security, including the security of relationships with direct suppliers and service providers.
- Security in network and information system acquisition, development and maintenance, including vulnerability handling and disclosure.
- Policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
- Basic cyber hygiene practices and security training.
- Policies on the use of cryptography and, where appropriate, encryption.
- Human-resources security, access-control policies and asset management.
- Multi-factor authentication, secured communications and secured emergency communications where appropriate.
Incident reporting on a 24h / 72h / 1-month clock
For a significant incident, Article 23 requires an early warning within 24 hours, a fuller incident notification within 72 hours, and a final report within one month. Several transpositions add national specifics — Italy benchmarks significance against ACN-published thresholds; qualified trust providers in France face a tighter 24-hour intermediate window.
Registration and management accountability
In-scope entities must register with their national authority (for example within three months of becoming in-scope in Germany) and the management body must approve and oversee the cybersecurity measures. Under Article 20, directors can be held personally liable and, in some Member States, temporarily banned from management functions. See our guide to NIS2 fines, enforcement and director liability.
Frequently asked questions
- What is the NIS2 50 employees threshold?
- NIS2 applies to medium and large enterprises. Under Recommendation 2003/361/EC the headcount ceiling is decisive and only one of the two financial ceilings has to be respected: you stop being a small enterprise when you have at least 50 employees, or when both your turnover and your balance sheet exceed EUR 10 million. Turnover alone above EUR 10 million does not make a company with fewer than 50 employees medium.
- Does NIS2 apply to SaaS companies?
- It depends on size, not on being SaaS. Cloud computing services (IaaS, PaaS, SaaS) are Annex I digital infrastructure and follow the ordinary size test: in scope from the medium-enterprise size, as an Important Entity, and Essential only above the medium ceilings. Cloud is not one of the size-independent types of Article 2(2)(a). Online marketplaces, search engines and social networks are Annex II digital providers; managed service providers are Annex I ICT service management, size-tested too.
- What if my supplier asks me to prove NIS2 compliance even though I'm not in scope?
- This is increasingly common. NIS2 Article 21(2)(d) requires in-scope entities to manage supply chain risk, which means they push compliance requirements down to their suppliers. Even if you're not directly in scope, you may face indirect compliance pressure. Reglyze helps you demonstrate security posture to your customers without needing full NIS2 certification.
- I have ISO 27001 — am I automatically NIS2 compliant?
- No, but you're ~80% of the way there. ISO 27001 Annex A maps heavily to NIS2 Article 21. However, NIS2 has specific requirements around incident reporting timelines, management accountability, and registration with national authorities that ISO 27001 doesn't cover. See our NIS2 vs ISO 27001 crosswalk.