Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Is it…

Is our organisation in scope of NIS2, and as essential or important?

10 decision pointsThe pack behind this answer: NIS2 Implementation & Readiness

Add to board memo

The short answer

Recommendation
Apply NIS2's scope tests to each legal entity in their fixed order, and let the first test that matches decide. Record the fact, source and reasoning behind each answer, have counsel confirm the result against your national law, and have the management body approve it.
Reasoning
NIS2 decides scope with a short list of tests applied in order, and getting the order wrong is how organisations reach the wrong answer. A few cases settle it whatever the size: the public administration exclusion comes first, then the cases that make an entity essential at any size. After that it turns on the annex the activity falls in and the entity's size, counted with partner and linked enterprises. Most small and micro entities are out of scope unless a size-independent case applies. The written reasoning is the first thing a supervisor or customer asks for (NR-01).
Considerations
  • The tests and size ceilings are NIS2's and Commission Recommendation 2003/361/EC's as the pack states them. National law may add to them or define terms more closely (NR-12). This is not legal advice.
  • Unknowns take the stricter branch: activities that fit both annexes count as Annex I, a blank size figure counts as over its limit, and an unclear identification is planned as essential until the authority answers.
  • Where DORA or another sector act sets at least equivalent duties, the matching NIS2 duties give way to it. Confirm this with counsel; keep every NIS2 duty until they do.
  • The management body is the board, or the management board in a two-tier structure; where there is no board, the people national law makes responsible. NIS2 does not define it, so confirm with counsel.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartWe need to know whether NIS2 applies to usStepGather the facts with Legal, one legal entity at a timeDecisionIs it public administration in security, defence or law enforcement?DecisionDoes a case make it essential whatever its size?DecisionWhat does it do, in NIS2's annexes?DecisionIs the communications provider medium-sized or large?DecisionIs the trust service provider large?DecisionHow large is the Annex I entity, with its group's figures?DecisionIs the Annex II entity medium-sized or large?DecisionHas the Member State identified it as important?DecisionDoes it provide domain name registration services?OutcomeEssential entityOutcomeImportant entityOutcomeIn scope for domain name registrationOutcomeAsk the authority for its decisionOutcomeOut of scope todayDecisionDoes DORA or another sector act set equivalent duties?StepRecord which NIS2 duties give way to the sector actStepHave counsel confirm it against your national lawOutcomeManagement body approves; reassess yearly and on triggers

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 20 steps.

  1. Start

    We need to know whether NIS2 applies to us

    NIS2 decides scope with a short list of tests applied in order, and the first test that matches decides. Getting the order wrong is how organisations reach the wrong answer. Record each answer with the fact it rests on, where that fact comes from, and your reasoning: the written reasoning is the first thing a supervisor or a customer asks for.

    In the pack

  2. Step

    Gather the facts with Legal, one legal entity at a time

    Collect the latest approved accounts, the group structure, the activities you are registered for and any letter from a Member State authority. NIS2 applies to each legal entity, so a group assesses each entity that carries out an Annex I or II activity. A small organisation answers every test all the same: several apply whatever the size.

    In the pack

  3. Decision

    Is it public administration in security, defence or law enforcement?

    A public administration entity working in national security, public security, defence or law enforcement is outside NIS2. This test comes first, so it decides even for central government. A private company answers no.

    In the pack

  4. Decision

    Does a case make it essential whatever its size?

    Yes if any of these holds: it is identified as a critical entity under Directive (EU) 2022/2557; it is a qualified trust service provider, a top-level domain name registry or a DNS service provider; the Member State has identified it as essential; it is central government public administration; or it was an operator of essential services before 16 January 2023 and the Member State keeps that status. A letter from the authority usually settles the identification questions. If you cannot tell, ask the authority. Until it answers, the cautious course is to plan as essential.

    In the pack

  5. Decision

    What does it do, in NIS2's annexes?

    Find the activity in Annex I (sectors of high criticality, such as energy, transport, banking, health and digital infrastructure) or Annex II (other critical sectors, such as postal services, waste, chemicals, food, manufacturing, digital providers and research). Name the sector, the type of entity and the activity it rests on. Some providers are tested on their type alone. If activities fit both annexes, or you are not sure which, answer Annex I, which is stricter, and ask counsel.

    In the pack

  6. Decision

    Is the communications provider medium-sized or large?

    A provider of public electronic communications networks or services counts as an Annex I type whatever the rest of its business, and it is in scope whatever its size. Medium or large makes it essential; small or micro makes it important. Count size as for any other entity, with partner and linked enterprises. A figure left blank counts as not within its limit, so an unknown size takes the yes branch.

    In the pack

  7. Decision

    Is the trust service provider large?

    A trust service provider that is not qualified counts as an Annex I type whatever the rest of its business, and it is in scope at any size. Large makes it essential. Medium, small or micro makes it important. A figure left blank counts as not within its limit, so an unknown size takes the yes branch.

    In the pack

  8. Decision

    How large is the Annex I entity, with its group's figures?

    The pack uses the EU's size classes. Micro: fewer than 10 staff, and turnover or balance sheet up to €2 million. Small: fewer than 50 staff, and turnover or balance sheet up to €10 million. Medium: fewer than 250 staff, and turnover up to €50 million or balance sheet up to €43 million. Above that it is large. Use the latest approved accounts, count staff in annual work units, and add partner enterprises in proportion and linked ones in full. A move across a ceiling counts only after two accounting periods in a row. A figure left blank counts as not within its limit.

    In the pack

  9. Decision

    Is the Annex II entity medium-sized or large?

    An Annex II entity of medium size or above is important. Use the same size classes: under 50 staff, it stays small while either its turnover or its balance sheet is within €10 million. A subsidiary of a large group is usually large, because linked enterprises count in full. A figure left blank counts as not within its limit, so an unknown size takes the yes branch.

    In the pack

  10. Decision

    Has the Member State identified it as important?

    A Member State can bring in a smaller entity because it is a sole provider of an essential service, because its disruption would have a significant effect, or because of its national or regional importance. That identification makes it important. It normally arrives as a letter from the competent authority. If you do not know, ask the authority before you conclude you are out.

    In the pack

  11. Decision

    Does it provide domain name registration services?

    An entity that registers domain names for others is in scope whatever its size, even with no other Annex I or II activity. The table tests this only after every row above it, so it changes the result only for an entity that would otherwise be out of scope.

    In the pack

  12. Outcome

    Essential entity

    All of NIS2's duties apply, and the competent authority may supervise at any time, not only after an incident or complaint. The duties are the management body's approval, oversight and training, the ten risk-management measures, incident reporting and registration. Cloud, data centre, managed service and the other digital providers the Implementing Regulation names must also meet its detailed requirements.

    In the pack

  13. Outcome

    Important entity

    The same duties apply as for an essential entity. Supervision comes after the event, when the authority has evidence or an indication that you do not comply. The maximum fine national law must allow is lower: at least €7 million or 1.4% of worldwide annual turnover, against €10 million or 2% for an essential entity. Cloud, data centre, managed service and the other digital providers the Implementing Regulation names must also meet its detailed requirements.

    In the pack

  14. Outcome

    In scope for domain name registration

    Registration and the Member State's list of entities apply. Ask the competent authority which of NIS2's other duties it applies to you, and record its answer with the scope decision.

    In the pack

    See also

  15. Outcome

    Ask the authority for its decision

    A public administration entity at regional level is in scope only if the Member State's risk-based assessment brings it in. Ask the competent authority for its decision and the classification it gives, and record the answer with your scope decision.

    In the pack

  16. Outcome

    Out of scope today

    Record the reasoning all the same: it is what a supervisor or customer will ask for. Out of scope is not permanent. The Member State may still identify you, or extend NIS2 to local public administration or education. Reassess on any trigger, such as a new activity or a size ceiling crossed for a second accounting period.

    In the pack

  17. Decision

    Does DORA or another sector act set equivalent duties?

    Where a sector-specific EU act sets duties at least equivalent to NIS2's, the matching NIS2 provisions do not apply to you. For a financial entity this is DORA: the pack says DORA applies instead of NIS2's risk-management and reporting duties, and to confirm that with counsel. If you are not sure, keep every NIS2 duty until counsel confirms otherwise.

    In the pack

  18. Step

    Record which NIS2 duties give way to the sector act

    Say in the scope decision which sector act applies and which NIS2 duties it matches, with counsel's view. Work to that act's requirements for those duties; for a financial entity that means DORA's. The NIS2 duties it does not match still apply.

    In the pack

  19. Step

    Have counsel confirm it against your national law

    The tests are the Directive's. National law may add to them or define terms more closely, so counsel confirms the result against the Member State's official text, with the national law and competent authority named. Jurisdiction usually follows where you are established; electronic communications providers, some digital providers and public administration are the exceptions.

    In the pack

  20. Outcome

    Management body approves; reassess yearly and on triggers

    The management body approves the written decision: the board, or the management board in a two-tier structure; where there is no board, the people national law makes responsible for running the entity. NIS2 does not define the term, so confirm with counsel what your national law counts. Review the decision at least once a year, and at once on a new or dropped activity, a ceiling crossed for a second period, a merger or disposal, a letter from an authority or a change in national law, or services in another Member State.

    In the pack

    See also

Practical checklist

  1. Gather the facts with Legal for each legal entity: approved accounts, group structure, registered activities and any authority letter.
  2. Test the public administration exclusion first, then the cases that make an entity essential whatever its size.
  3. Find the activity in Annex I or Annex II, naming the sector, the type of entity and the activity.
  4. Work out the size with the group's figures, and read off essential, important or out of scope.
  5. Check for Member State identification as important, and for domain name registration services.
  6. Record which NIS2 duties give way to DORA or another sector act, with counsel's view.
  7. Have counsel confirm the result against national law, with the law and competent authority named.
  8. Have the management body approve the written decision, and review it yearly and on any trigger.

Evidence to have ready

  • The written scope decision: each answer with its fact, source and reasoning, and the row of the decision table that decided it.
  • The accounts and group figures the size is counted from, including partner and linked enterprises.
  • Any letter from a Member State authority on identification or classification.
  • Counsel's confirmation against national law, and the management body's approval of the decision.
  • The record of each annual review and of any review a trigger caused.

Assumptions

  • You answer for one legal entity at a time. In a group, each entity that carries out an Annex I or II activity is assessed on its own, with the group's figures counted in its size.
  • The tests and size ceilings are NIS2's and Commission Recommendation 2003/361/EC's as the CISO Times NIS2 pack states them. National law may add to the Directive or define terms more closely.
  • The national law, the competent authority and its forms are yours to confirm with counsel. The pack leaves them as placeholders.

Not covered here