NIS2 Scope & Entity Classification Assessment
Determines whether an organisation is in scope and whether it is an essential or important entity, with the reasoning recorded.
Available soon
Answer it online instead: Does NIS2 apply to us?About 10 minutes, free, and nothing is stored.
- Format
- Excel
- Size
- 69 KB
- Length
- 11 sheets
- Version
- 1.1
- Updated
What's inside
What changed
- 1.1
Test cases TC-21 to TC-23 answer SQ-03 with Annex I, as the Assessment sheet's check requires of every SQ-04 type; classifications unchanged.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Gather the facts first, with Legal: the latest approved accounts, the group structure, the activities you are registered for and any letter from a Member State authority. The NIS2 lead ([[e.g. Head of Information Security]]) owns the assessment. |
| 2 | On the Assessment sheet, enter the entity's details and answer SQ-01 to SQ-10 in order, from the drop-down lists. For each, record the fact and where it comes from (the accounts, the company register, a letter), then your reasoning. The Check column says what is still missing. |
| 3 | SQ-03: find what the entity does in Annex I or Annex II of NIS2 and name the sector, the type of entity and the activity it rests on. If activities fit both annexes, answer Annex I, which the table tests first and which gives the stricter result, record the other in the fact column, and ask counsel. |
| 4 | SQ-08: enter staff in annual work units, turnover and balance sheet total, counting partner and linked enterprises. The size is calculated from the ceilings on the Decision Table sheet. Under 250 staff, give turnover or balance sheet or both: the size depends on them. |
| 5 | Read the Result sheet: the classification, the row of the decision table that decided it and what it means. The Decision Table sheet shows every row and which match your answers. Rows are read from the top and the first match decides. |
| 6 | Have counsel confirm the result, and check it against your Member State's law (NR-12). Then the management body approves it. Record both in the sign-off on the Result sheet (NR-01). |
| 7 | Use the result in the NIS2 Competent Authority Registration Data Sheet (sector, type and Member States) and in the NIS2 Readiness Self-Assessment (item SR-01). Reassess at least once a year and on any trigger listed on the Result sheet. |
| 8 | To clear the EXAMPLE, delete the word EXAMPLE in E5 of the Assessment sheet and replace every yellow cell there and in the sign-off. The 23 cases on the Test Cases sheet stay: they show how the table decides typical cases. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule NR-01: "The scope decision must be recorded in writing, with the facts and reasoning behind each answer, confirmed with counsel and approved by the management body. It must be reviewed at least once a year and whenever a scope trigger occurs."
Rule NR-12: "The national law, the competent authority and its forms must be checked against the Member State's official text, and with counsel, before this pack is relied on and at each annual review."
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its wholesale distribution of food and catering supplies to businesses makes it a food business engaged in wholesale distribution (Annex II, point 4), and at about 900 staff it is large. Row ST-13 decides: an important entity. Assessed on 2026-05-08, confirmed by counsel and approved by the board on 2026-05-21.
Counting the size (Commission Recommendation 2003/361/EC, which NIS2 applies):
• Use the figures of the latest approved accounting period, on an annual basis; turnover excludes VAT and other indirect taxes (Recommendation, Annex, Article 4(1)).
• Count staff in annual work units: full-time staff for the whole year count as one, part-time and seasonal staff as fractions (Article 5).
• Add the figures of partner enterprises in proportion to the holding, and all the figures of linked enterprises (Articles 3 and 6). A subsidiary of a large group is usually large.
• The rule that an enterprise 25% or more controlled by public bodies cannot be an SME (Article 3(4)) does not apply for NIS2 (NIS2 Article 2(1)).
• A move across a ceiling changes the size only once it has lasted two consecutive accounting periods (Article 4(2)).
• Answer every question with a fact and its source, such as the company's accounts, its registered activities or a letter from the authority.
• Where a sector-specific EU act sets duties at least equivalent to NIS2's, the matching NIS2 provisions do not apply to the entity (Article 4(1)); for financial entities this is DORA (P09 records DORA Article 1(2)).
• The digital providers that Implementing Regulation (EU) 2024/2690 names (among them cloud, data centre and managed service providers) must also meet the detailed requirements in its Annex. For every other entity it does not apply.
• The Member State where the entity is established has jurisdiction, except for electronic communications providers, the digital providers of Article 26(1)(b) and public administration (Article 26(1)).
Tailoring — group of companies: NIS2 applies to each legal entity. Complete one workbook for each entity in the group that carries out an Annex I or II activity, and count the group's figures in each one's size.
Tailoring — small organisation: under 50 staff with turnover or balance sheet within €10 million, most entities are out of scope. Answer SQ-01 to SQ-07 all the same: several of the cases they test apply whatever the size.
Tailoring — operations in several Member States: the Member State where the entity is established usually has jurisdiction. Record every Member State where you provide services in scope (SQ-10), and ask counsel where Article 26(1) points elsewhere.
Limitations: This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it. The Member State details on this workbook are placeholders: [[national law transposing NIS2: title, number and date]]; [[competent authority designated under that law]].
Assessment
Scope assessment
Answer every question from the list, and record the fact, its source and your reasoning. Yellow cells are yours; grey cells are calculated.
| Worked example | EXAMPLE | Delete EXAMPLE here, and replace every yellow cell, to record your own assessment. | ||||
| Entity (legal name) | [[registered name of the distributor]] | |||||
| What it does | EXAMPLE — wholesale distribution of food and catering supplies to businesses | |||||
| Member State where it is established | [[Member State where the entity is established (Article 26(1))]] | |||||
| Date of the assessment | 8 May 2026 | |||||
| Assessed by | Head of Information Security, with Legal | |||||
| ID | Question | NIS2 article | Your answer | Fact and its source | Reasoning | Check |
|---|---|---|---|---|---|---|
| SQ-01 | Is the entity a public administration entity working in national security, public security, defence or law enforcement? | Article 2(7) | No | A private company: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. | Not a public administration entity, so the exclusion does not apply. | OK |
| SQ-02 | Has it been identified as a critical entity under Directive (EU) 2022/2557? | Article 2(3) | No | [[No letter from the authority for critical entities; checked with Legal]]. | None of the size-independent cases applies, and the Member State has identified the firm neither as essential nor as important. | OK |
| SQ-03 | Which Annex I or Annex II sector, subsector and type of entity describes what it does, if any? Name the sector, the type and the activity it rests on. | Article 2(1); Annexes I and II | Annex II | Production, processing and distribution of food (Annex II, point 4): a food business engaged in wholesale distribution | The firm sells food and catering supplies wholesale to businesses: a food business engaged in wholesale distribution, the type of entity in Annex II, point 4. No Annex I sector describes what it does. | OK |
| SQ-04 | Is it one of the types NIS2 treats whatever their size: a public electronic communications network or service provider, a trust service provider (qualified or not), a top-level domain name registry, a DNS service provider, or a public administration entity of central or regional government? | Article 2(2)(a) and (f) | None of these | Its activity is wholesale distribution of food and catering supplies to businesses; it provides none of the services listed. | None of the size-independent cases applies, and the Member State has identified the firm neither as essential nor as important. | OK |
| SQ-05 | Has the Member State identified it as essential or important because it is a sole provider, because its disruption would have a significant effect, or because of its national or regional importance? | Article 2(2)(b) to (e); Article 3(1)(e) and 3(2) | Not identified | [[No identification received from the competent authority]]. | None of the size-independent cases applies, and the Member State has identified the firm neither as essential nor as important. | OK |
| SQ-06 | Was it an operator of essential services under the earlier NIS Directive before 16 January 2023, and does the Member State keep that status? | Article 3(1)(g) | No | [[Not identified as an operator of essential services under the earlier NIS Directive]]. | None of the size-independent cases applies, and the Member State has identified the firm neither as essential nor as important. | OK |
| SQ-07 | Does it provide domain name registration services? | Article 2(4) | No | It registers no domain names for others. | None of the size-independent cases applies, and the Member State has identified the firm neither as essential nor as important. | OK |
| SQ-08 | What is its size, on staff, turnover and balance sheet, counting partner and linked enterprises? | Article 2(1); Recommendation 2003/361/EC, Annex, Articles 2 to 6 | Large | [[Latest approved accounts]], with the group's figures added. | About 900 staff, counted in annual work units with the group's figures, is above the 250-staff ceiling, so the firm is large whatever its balance sheet. | OK |
| Staff, in annual work units | 900.0 | |||||
| Annual turnover (€, excluding VAT) | €104,000,000 | |||||
| Annual balance sheet total (€) | Not needed: staff alone put the firm above the medium-sized ceiling. | |||||
| SQ-09 | Does a sector-specific EU act, such as DORA for financial entities, set cybersecurity or reporting duties at least equivalent to NIS2's? | Article 4(1) | No | None: not a financial entity, so DORA does not apply (P09) | No sector-specific act displaces NIS2's duties, so all of them apply. | OK |
| SQ-10 | In which Member State is it established, and in which does it provide services in scope? | Article 26(1); Article 3(4)(d) | [[Member State where the entity is established (Article 26(1))]] only | [[Member State where the entity is established (Article 26(1))]] only | Established and providing its services in one Member State, whose law and authority apply (Article 26(1)). | OK |
Decision Table
The scope decision table
NIS2's scope test as 16 rows, built from the Directive's own words. Rows are read from the top, and the first that matches the answers decides. Nothing on this sheet is yours to change.
| Row | When | NIS2 articles | Classification | Matches the answers? | Decides? |
|---|---|---|---|---|---|
| ST-01 | Public administration entity working in national security, public security, defence or law enforcement | Article 2(7) | Out of scope | No | |
| ST-02 | Identified as a critical entity under Directive (EU) 2022/2557, whatever its size | Article 2(3); Article 3(1)(f) | Essential | No | |
| ST-03 | Qualified trust service provider, top-level domain name registry or DNS service provider, whatever its size | Article 2(2)(a)(ii) and (iii); Article 3(1)(b) | Essential | No | |
| ST-04 | Identified by the Member State as essential under Article 2(2)(b) to (e) | Article 2(2)(b) to (e); Article 3(1)(e) | Essential | No | |
| ST-05 | Public administration entity of central government | Article 2(2)(f)(i); Article 3(1)(d) | Essential | No | |
| ST-06 | Operator of essential services identified before 16 January 2023, where the Member State keeps that status | Article 3(1)(g) | Essential | No | |
| ST-07 | Public administration entity at regional level, where the Member State's risk-based assessment brings it in | Article 2(2)(f)(ii) | Ask the authority | No | |
| ST-08 | Annex I type of entity above the ceilings for medium-sized enterprises (large), including a trust service provider that is not qualified (a type of entity in Annex I, point 8, whatever the answer to SQ-03) | Article 2(1) and (2)(a)(ii); Article 3(1)(a); Annex I, point 8 | Essential | No | |
| ST-09 | Public electronic communications network or service provider of medium size, or large (a type of entity in Annex I, point 8, whatever the answer to SQ-03) | Article 2(2)(a)(i); Article 3(1)(a) and (c); Annex I, point 8 | Essential | No | |
| ST-10 | Public electronic communications provider or trust service provider (not qualified) that is small or micro | Article 2(2)(a)(i) and (ii); Article 3(2) | Important | No | |
| ST-11 | Identified by the Member State as important under Article 2(2)(b) to (e) | Article 2(2)(b) to (e); Article 3(2) | Important | No | |
| ST-12 | Annex I type of entity of medium size, including a trust service provider that is not qualified (Annex I, point 8, whatever the answer to SQ-03) | Article 2(1) and (2)(a)(ii); Article 3(2); Annex I, point 8 | Important | No | |
| ST-13 | Annex II type of entity of medium size or large | Article 2(1); Article 3(2) | Important | Yes | Decides |
| ST-14 | Provides domain name registration services, and no row above applies | Article 2(4); Article 3(3); Article 27 | In scope | No | |
| ST-15 | Annex I or II type of entity that is small or micro, and no row above applies | Article 2(1) | Out of scope | Yes | |
| ST-16 | No Annex I or II type of entity, and no row above applies | Article 2(1); Article 2(5) | Out of scope | Yes |
| Position of the first row that matches | 13 | |
What each classification means
| Classification | What it means and what to do | ||||
|---|---|---|---|---|---|
| Essential | In scope as an essential entity. All of NIS2's duties apply, and the competent authority may supervise at any time (Article 32). | ||||
| Important | In scope as an important entity. The same duties apply; supervision is after the event (Article 33). The maximum fine national law must allow is lower: at least €7 million or 1.4% of worldwide annual turnover, where it is at least €10 million or 2% for an essential entity (Article 34(4) and (5)). | ||||
| In scope | In scope. Registration and the Member State's list apply (Article 3(3) and Article 27); ask the competent authority which other duties it applies. | ||||
| Ask the authority | In scope only if the Member State's risk-based assessment brings it in. Ask the competent authority for its decision and classification, and record the answer. | ||||
| Out of scope | Out of scope today. Record the reasoning, and reassess on any trigger: the Member State may still identify the entity, or extend NIS2 to local public administration or education (Article 2(5)). | ||||
Size ceilings (Recommendation 2003/361/EC, Annex, Article 2)
| Size | Staff fewer than | Turnover up to (€) | or balance sheet up to (€) | ||
|---|---|---|---|---|---|
| Micro | 10 | €2,000,000 | €2,000,000 | ||
| Small | 50 | €10,000,000 | €10,000,000 | ||
| Medium | 250 | €50,000,000 | €43,000,000 | ||
| Above the medium-sized ceilings the entity is Large. The smallest class wins whose staff limit the entity is under and whose turnover or balance sheet limit it is within. A figure left blank counts as not within its limit. | |||||
Result
Result and the reasoning recorded
The classification the decision table gives, the row that decided it and why, what to confirm before you rely on it, and the sign-off. Everything above the sign-off is calculated.
EXAMPLE: the example organisation's assessment, dated 2026-05-08. Clear the EXAMPLE on the Assessment sheet to record your own.
The result
| Classification | Important | |||
|---|---|---|---|---|
| Row that decided it | ST-13 | |||
| That row reads | Annex II type of entity of medium size or large | |||
| NIS2 articles | Article 2(1); Article 3(2) | |||
| What it means | In scope as an important entity. The same duties apply; supervision is after the event (Article 33). The maximum fine national law must allow is lower: at least €7 million or 1.4% of worldwide annual turnover, where it is at least €10 million or 2% for an essential entity (Article 34(4) and (5)). | |||
| Size | Large | |||
| Sector-specific EU act | None: every NIS2 duty that follows from the classification applies. | |||
| Reasoning recorded | Complete: every answer has its fact, source and reasoning | |||
| Next review due | 8 May 2027 | |||
Review at least once a year (NR-01), and at once on any of the triggers below.
The reasoning, as recorded on the Assessment sheet
| Question | Answer | Fact and its source | Reasoning | |
|---|---|---|---|---|
| SQ-01 | No | A private company: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. | Not a public administration entity, so the exclusion does not apply. | |
| SQ-02 | No | [[No letter from the authority for critical entities; checked with Legal]]. | None of the size-independent cases applies, and the Member State has identified the firm neither as essential nor as important. | |
| SQ-03 | Annex II | Production, processing and distribution of food (Annex II, point 4): a food business engaged in wholesale distribution | The firm sells food and catering supplies wholesale to businesses: a food business engaged in wholesale distribution, the type of entity in Annex II, point 4. No Annex I sector describes what it does. | |
| SQ-04 | None of these | Its activity is wholesale distribution of food and catering supplies to businesses; it provides none of the services listed. | None of the size-independent cases applies, and the Member State has identified the firm neither as essential nor as important. | |
| SQ-05 | Not identified | [[No identification received from the competent authority]]. | None of the size-independent cases applies, and the Member State has identified the firm neither as essential nor as important. | |
| SQ-06 | No | [[Not identified as an operator of essential services under the earlier NIS Directive]]. | None of the size-independent cases applies, and the Member State has identified the firm neither as essential nor as important. | |
| SQ-07 | No | It registers no domain names for others. | None of the size-independent cases applies, and the Member State has identified the firm neither as essential nor as important. | |
| SQ-08 | Large | [[Latest approved accounts]], with the group's figures added. | About 900 staff, counted in annual work units with the group's figures, is above the 250-staff ceiling, so the firm is large whatever its balance sheet. | |
| SQ-09 | No | None: not a financial entity, so DORA does not apply (P09) | No sector-specific act displaces NIS2's duties, so all of them apply. | |
| SQ-10 | [[Member State where the entity is established (Article 26(1))]] only | [[Member State where the entity is established (Article 26(1))]] only | Established and providing its services in one Member State, whose law and authority apply (Article 26(1)). | |
Before you rely on it
This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it.
Rule NR-12: "The national law, the competent authority and its forms must be checked against the Member State's official text, and with counsel, before this pack is relied on and at each annual review."
National law: [[national law transposing NIS2: title, number and date]]. Competent authority: [[competent authority designated under that law]]. Anything the national law adds: [[any duty or field the national law adds to the Directive]].
For Cyprus, check the law in force with the Digital Security Authority and counsel. On 29 September 2026 the Authority's legislation page listed the Security of Networks and Information Systems Law of 2020 (N.89(I)/2020), and no law transposing NIS2.
The digital providers that Implementing Regulation (EU) 2024/2690 names (among them cloud, data centre and managed service providers) must also meet the detailed requirements in its Annex. For every other entity it does not apply.
The Member State where the entity is established has jurisdiction, except for electronic communications providers, the digital providers of Article 26(1)(b) and public administration (Article 26(1)).
Reassess when
• A new activity, product or service that could fall in an Annex I or II sector, or one that stops
• Staff, turnover or balance sheet crossing a ceiling for a second accounting period in a row
• A merger, acquisition or disposal that changes the group's figures
• A letter from a Member State identifying the entity, or a change in national law
• Starting to provide services in scope in another Member State
Confirmation and approval (NR-01)
| Step | Date | Who | Reference | |
|---|---|---|---|---|
| Assessed by | 8 May 2026 | Head of Information Security, with Legal | [[file reference of the assessment]] | |
| Confirmed by counsel | 8 May 2026 | [[external counsel]], by letter of the same date | [[counsel's letter reference]] | |
| Approved by the management body | 21 May 2026 | The board | [[minute reference]] | |
Test Cases
Typical cases run through the same decision table, with the classification NIS2's text gives each. Add a case of your own on a blank row to see how the table decides it.
| Case | Excluded (SQ-01) | Critical entity (SQ-02) | Annex (SQ-03) | Type in scope whatever its size (SQ-04) | Identified by the Member State (SQ-05) | Earlier operator of essential services (SQ-06) | Domain name registration (SQ-07) | Staff | Turnover (€) | Balance sheet (€) | Size | Row that decides | Classification | Expected | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TC-01 | No | No | Annex I | None of these | Not identified | No | No | 900 | Large | ST-08 | Essential | Essential | Agrees | ||
| TC-02 | No | No | Annex I | None of these | Not identified | No | No | 120 | €60,000,000 | €40,000,000 | Medium | ST-12 | Important | Important | Agrees |
| TC-03 | No | No | Annex I | None of these | Not identified | No | No | 120 | €60,000,000 | €45,000,000 | Large | ST-08 | Essential | Essential | Agrees |
| TC-04 | No | No | Annex II | None of these | Not identified | No | No | 900 | Large | ST-13 | Important | Important | Agrees | ||
| TC-05 | No | No | Annex II | None of these | Not identified | No | No | 60 | €8,000,000 | €5,000,000 | Medium | ST-13 | Important | Important | Agrees |
| TC-06 | No | No | Annex II | None of these | Not identified | No | No | 30 | €8,000,000 | €12,000,000 | Small | ST-15 | Out of scope | Out of scope | Agrees |
| TC-07 | No | No | Annex II | None of these | Not identified | No | No | 30 | €12,000,000 | €12,000,000 | Medium | ST-13 | Important | Important | Agrees |
| TC-08 | No | No | Annex I | Qualified trust service provider | Not identified | No | No | 5 | €1,000,000 | Micro | ST-03 | Essential | Essential | Agrees | |
| TC-09 | No | No | Annex I | Trust service provider (not qualified) | Not identified | No | No | 5 | €1,000,000 | Micro | ST-10 | Important | Important | Agrees | |
| TC-10 | No | No | Annex I | Public electronic communications network or service provider | Not identified | No | No | 5 | €1,000,000 | Micro | ST-10 | Important | Important | Agrees | |
| TC-11 | No | No | Annex I | Public electronic communications network or service provider | Not identified | No | No | 100 | €20,000,000 | Medium | ST-09 | Essential | Essential | Agrees | |
| TC-12 | No | No | Annex II | None of these | Essential | No | No | 20 | €1,000,000 | Small | ST-04 | Essential | Essential | Agrees | |
| TC-13 | No | No | Annex II | None of these | Important | No | No | 20 | €1,000,000 | Small | ST-11 | Important | Important | Agrees | |
| TC-14 | No | Yes | Neither | None of these | Not identified | No | No | 5 | €1,000,000 | Micro | ST-02 | Essential | Essential | Agrees | |
| TC-15 | No | No | Neither | None of these | Not identified | No | Yes | 5 | €1,000,000 | Micro | ST-14 | In scope | In scope | Agrees | |
| TC-16 | No | No | Annex I | Public administration entity of central government | Not identified | No | No | 400 | Large | ST-05 | Essential | Essential | Agrees | ||
| TC-17 | No | No | Annex I | Public administration entity at regional level | Not identified | No | No | 400 | Large | ST-07 | Ask the authority | Ask the authority | Agrees | ||
| TC-18 | Yes | No | Annex I | Public administration entity of central government | Not identified | No | No | 900 | Large | ST-01 | Out of scope | Out of scope | Agrees | ||
| TC-19 | No | No | Neither | None of these | Not identified | No | No | 900 | Large | ST-16 | Out of scope | Out of scope | Agrees | ||
| TC-20 | No | No | Annex I | None of these | Not identified | Yes | No | 30 | €5,000,000 | Small | ST-06 | Essential | Essential | Agrees | |
| TC-21 | No | No | Annex I | Public electronic communications network or service provider | Not identified | No | No | 900 | Large | ST-08 | Essential | Essential | Agrees | ||
| TC-22 | No | No | Annex I | Trust service provider (not qualified) | Not identified | No | No | 900 | Large | ST-08 | Essential | Essential | Agrees | ||
| TC-23 | No | No | Annex I | Trust service provider (not qualified) | Not identified | No | No | 120 | €20,000,000 | Medium | ST-12 | Important | Important | Agrees |
Lists
| YesNo | AnnexAnswer | SizeFreeType | IdentifiedAs |
|---|---|---|---|
| Yes | Annex I | None of these | Not identified |
| No | Annex II | Public electronic communications network or service provider | Essential |
| Neither | Qualified trust service provider | Important |
Trust service provider (not qualified)
Top-level domain name registry
DNS service provider
Public administration entity of central government
Public administration entity at regional level
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| In scope | Covered by NIS2 under its Article 2, so the duties in Articles 20, 21 and 23 apply, and registration under Article 3(4). |
| Essential entity | An entity that Article 3(1) of NIS2 classes as essential: mainly a large entity in an Annex I sector, and some entities whatever their size. Supervised both before and after an incident or complaint (Article 32). |
| Important entity | An entity of a type in Annex I or II that is in scope and is not essential (Article 3(2)). Supervised after the event, when the authority has evidence or an indication that it does not comply (Article 33). |
| Annex I sector | One of the sectors of high criticality in Annex I of NIS2, such as energy, transport, banking, health, digital infrastructure or public administration, each with the types of entity it covers. |
| Annex II sector | One of the other critical sectors in Annex II of NIS2, such as postal services, waste management, chemicals, food, manufacturing, digital providers and research. |
| Medium-sized ceilings | The ceilings for medium-sized enterprises in Commission Recommendation 2003/361/EC: fewer than 250 staff, and a turnover of no more than €50 million or a balance sheet of no more than €43 million. An entity above them is large. NIS2 uses them to decide who is in scope and who is essential. |
| Small and micro enterprises | Fewer than 50 staff, with a turnover or a balance sheet of no more than €10 million (a microenterprise: fewer than 10 staff and €2 million). Most small and micro entities are out of scope unless a size-independent case applies. |
| Annual work unit | Count staff in annual work units: full-time staff for the whole year count as one, part-time and seasonal staff as fractions (Article 5). |
| Partner and linked enterprises | Add the figures of partner enterprises in proportion to the holding, and all the figures of linked enterprises (Articles 3 and 6). A subsidiary of a large group is usually large. |
| Scope decision | The written record of whether the entity is in scope and whether it is essential or important, with the facts and the reasoning behind each answer, approved by the management body. |
| Decision table row (ST-nn) | One of the 16 rows of the scope test. Rows are read in order and the first that matches the answers decides. |
| Competent authority | The authority a Member State designates to supervise NIS2 (Article 8(1)). The entity registers with it, and it inspects, asks for evidence and enforces. |
| Management body | The body that directs the entity: the board of directors, or the management board in a two-tier structure. [[Where there is no board, the people national law makes responsible for running the entity.]] NIS2 does not define the term, so confirm with counsel what the national law counts. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, assessed on 2026-05-08. Clear it before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 4.2 — Understanding the needs and expectations of interested parties | The whole workbook: whether NIS2 is a requirement the organisation must meet |
| ISO/IEC 27001:2022 | Annex A 5.31 — Legal, statutory, regulatory and contractual requirements | The whole workbook: NIS2 identified as a legal requirement, and how it applies, recorded |
| NIST CSF 2.0 | GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed” | The whole workbook: the NIS2 requirement understood and recorded |
| NIS2 — Directive (EU) 2022/2555 | Article 2(1) — the Directive applies to public or private entities of a type referred to in Annex I or II “which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union”; Article 3(4) of that Annex does not apply | SQ-03 and SQ-08; rows ST-12, ST-13 and ST-15: the type of entity and the size test |
| NIS2 — Directive (EU) 2022/2555 | Article 2(2) — regardless of size, the Directive also applies to entities of a type referred to in Annex I or II that provide public electronic communications networks or services, trust services, or top-level domain name registry or DNS services; that are the sole provider in a Member State of a service essential for critical societal or economic activities; whose disruption could significantly affect public safety, security or health, or induce a significant systemic risk; that are critical because of their specific importance at national or regional level; or that are public administration entities of central government, or at regional level following a risk-based assessment | SQ-04 and SQ-05, rows ST-08, ST-09 and ST-12: the entities in scope whatever their size |
| NIS2 — Directive (EU) 2022/2555 | Article 2(3) — “Regardless of their size, this Directive applies to entities identified as critical entities under Directive (EU) 2022/2557.” | SQ-02, row ST-02: critical entities |
| NIS2 — Directive (EU) 2022/2555 | Article 2(4) — “Regardless of their size, this Directive applies to entities providing domain name registration services.” | SQ-07, row ST-14: domain name registration services |
| NIS2 — Directive (EU) 2022/2555 | Article 2(7) — the Directive does not apply to public administration entities that carry out their activities in the areas of national security, public security, defence or law enforcement | SQ-01, row ST-01: the exclusion |
| NIS2 — Directive (EU) 2022/2555 | Article 3(1) — essential entities are: Annex I entities that exceed the ceilings for medium-sized enterprises; qualified trust service providers, top-level domain name registries and DNS service providers, regardless of size; providers of public electronic communications networks or services that qualify as medium-sized; central government public administration entities; other Annex I or II entities a Member State identifies as essential under Article 2(2)(b) to (e); critical entities under Directive (EU) 2022/2557; and, if the Member State so provides, entities it identified before 16 January 2023 as operators of essential services | Rows ST-02 to ST-09: essential entities |
| NIS2 — Directive (EU) 2022/2555 | Article 3(2) — “entities of a type referred to in Annex I or II which do not qualify as essential entities pursuant to paragraph 1 of this Article shall be considered to be important entities”, including those a Member State identifies as important under Article 2(2)(b) to (e) | Rows ST-10 to ST-13: important entities |
| NIS2 — Directive (EU) 2022/2555 | Article 4(1) — where a sector-specific Union legal act requires entities to notify significant incidents with requirements at least equivalent in effect, the relevant provisions of NIS2 do not apply to those entities | SQ-09 and the Result: sector-specific EU acts |
| NIS2 — Directive (EU) 2022/2555 | Article 26(1) — entities fall under the jurisdiction of the Member State in which they are established, with exceptions for electronic communications providers (where they provide their services), the digital providers listed in point (b) (their main establishment in the Union) and public administration entities (the Member State that established them) | SQ-10 and the Result: which Member State has jurisdiction |
| NIS2 — Directive (EU) 2022/2555 | Annex I — sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space, each with its subsectors and types of entity | SQ-03: sector, subsector and type of entity |
| NIS2 — Directive (EU) 2022/2555 | Annex I, point 8 — digital infrastructure: Internet Exchange Point providers; DNS service providers, excluding operators of root name servers; TLD name registries; cloud computing service providers; data centre service providers; content delivery network providers; trust service providers; providers of public electronic communications networks; providers of publicly available electronic communications services | Rows ST-08, ST-09 and ST-12: the digital infrastructure providers classed from SQ-04 alone |
| NIS2 — Directive (EU) 2022/2555 | Annex II — other critical sectors: postal and courier services, waste management, manufacture, production and distribution of chemicals, production, processing and distribution of food, manufacturing, digital providers and research, each with its types of entity | SQ-03: sector, subsector and type of entity |
| Commission Recommendation 2003/361/EC | Annex, Article 2 — medium-sized enterprises employ fewer than 250 persons and have an annual turnover not exceeding €50 million and/or an annual balance sheet total not exceeding €43 million; small enterprises fewer than 50 persons and €10 million; microenterprises fewer than 10 persons and €2 million | SQ-08 and the size ceilings on the Decision Table |
| Commission Recommendation 2003/361/EC | Annex, Article 3 — autonomous, partner (25% or more of capital or voting rights) and linked (control) enterprises; NIS2 disapplies Article 3(4), the rule on enterprises 25% or more controlled by public bodies | SQ-08: partner and linked enterprises |
| Commission Recommendation 2003/361/EC | Annex, Article 4(2) — status is lost or acquired only where the headcount or financial ceilings are exceeded, or fallen below, over two consecutive accounting periods | SQ-08 and the triggers: a ceiling crossed for two accounting periods |
| Commission Recommendation 2003/361/EC | Annex, Article 6 — the data of partner enterprises are added in proportion to the holding, and 100% of the data of linked enterprises are added | SQ-08: partner and linked enterprises' figures added |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Result: the digital providers for whom the Implementing Regulation's detailed requirements apply |
Editions referenced: Directive (EU) 2022/2555 (NIS2); Commission Recommendation 2003/361/EC; Implementing Regulation (EU) 2024/2690; ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any NIS2 requirement.