Tools · NIS2 Implementation & Readiness
Does NIS2 apply to us?
Answer 9 questions about what your organisation is and does. NIS2's own scope test, as 16 rows read from the top, gives the classification, the row that decided it and what it means. Free, no account, and nothing is stored.
Part 1 of 2 · 0 of 9 answered
What the entity is and does
The cases NIS2 decides whatever the entity's size, then its sector.
Gather the facts first: the latest approved accounts, the group structure, the activities you are registered for and any letter from a Member State authority.
You can move on with questions unanswered: the result says which it still needs. Nothing is saved, so reloading the page starts again.
- About 10 minutes
- Nothing is stored, not even in your browser: reloading starts again
- Also as a workbook: NIS2 Scope & Entity Classification Assessment
How this is worked out, and what it is not
- NIS2's scope test as 16 rows, built from the Directive's own words. Rows are read from the top, and the first that matches the answers decides.
- SQ-03: find what the entity does in Annex I or Annex II of NIS2 and name the sector, the type of entity and the activity it rests on. If activities fit both annexes, answer Annex I, which the table tests first and which gives the stricter result, note the other, and ask counsel.
- SQ-08: give staff in annual work units, turnover and balance sheet total, counting partner and linked enterprises. The size is worked out from the ceilings of Recommendation 2003/361/EC. You choose a band for each figure, not the figure itself: the size test only compares each figure with these ceilings, so the band gives the same result and nothing more about your organisation is asked. Under 250 staff, give turnover or balance sheet or both: the size depends on them.
- For a group of companies: NIS2 applies to each legal entity. Answer once for each entity in the group that carries out an Annex I or II activity, and count the group's figures in each one's size.
The result is a statement of what applies, in the workbook's words, never a score. The questions, the answers to choose from and the rule are the workbook's: the same answers give the same result in both. It is not legal advice.
- This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it.
- Rule NR-12: "The national law, the competent authority and its forms must be checked against the Member State's official text, and with counsel, before this pack is relied on and at each annual review."
- For Cyprus, check the law in force with the Digital Security Authority and counsel. On 29 September 2026 the Authority's legislation page listed the Security of Networks and Information Systems Law of 2020 (N.89(I)/2020), and no law transposing NIS2.
- The digital providers that Implementing Regulation (EU) 2024/2690 names (among them cloud, data centre and managed service providers) must also meet the detailed requirements in its Annex. For every other entity it does not apply.
- The Member State where the entity is established has jurisdiction, except for electronic communications providers, the digital providers of Article 26(1)(b) and public administration (Article 26(1)).