NIS2
Is my company in NIS2 scope?
NIS2 applies to organisations in 18 critical sectors. Answer 7 questions to find out if you are in scope and what obligations you face.
Last updated: 1 May 2025
Do NIS2 applicability need to comply with NIS2?
NIS2 applies to organisations in 18 critical sectors. Answer 7 questions to find out if you are in scope and what obligations you face. If yes: In NIS2 scope — incident response plan required. If not: Below NIS2 size thresholds — generally exempt. Use the interactive tree below t…
- Yes path: In NIS2 scope — incident response plan required
- No path: Below NIS2 size thresholds — generally exempt
- Use the step-by-step decision tree below for your exact situation
NIS2 · Question 1
Does your company operate in an EU member state?
NIS2 applies to entities providing services in the EU. Non-EU entities that provide services to EU entities may also be in scope through supply chain obligations.
For informational purposes only. Consult qualified legal counsel before making compliance decisions.
Decision Criteria & Full Path Breakdown
Review all branch conditions, regulatory criteria, and outcomes assessed by this decision tree.
- 1
Does your company operate in an EU member state?
NIS2 applies to entities providing services in the EU. Non-EU entities that provide services to EU entities may also be in scope through supply chain obligations.
If Yes: Proceeds to: Does your company operate in one of these sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, or public administration?If No: Outside NIS2 scope — no EU operations - 2
Does your company operate in one of these sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, or public administration?
These are Annex I 'highly critical' sectors. Annex II adds: postal, waste management, chemicals, food, manufacturing, digital providers, and research. Answer yes if you're in either list.
If Yes: Proceeds to: Does your company have at least 50 employees OR an annual turnover or balance sheet of at least €10 million?If No: Outside NIS2 sector scope — not in scope - 3
Does your company have at least 50 employees OR an annual turnover or balance sheet of at least €10 million?
NIS2 applies to medium and large enterprises. Micro (< 10 employees, < €2M) and small (< 50 employees, < €10M) companies are generally exempt, unless they are critical infrastructure or named by member states.
If Yes: Proceeds to: Do you operate in an Annex I highly critical sector with more than 250 employees OR turnover/balance sheet exceeding €50M?If No: Proceeds to: Is your company critical infrastructure regardless of size — e.g. a sole provider of a critical service in a member state, or a critical infrastructure operator named by your national authority? - 4
Do you operate in an Annex I highly critical sector with more than 250 employees OR turnover/balance sheet exceeding €50M?
If yes, you are likely an 'essential entity' with stricter obligations. If you're just above the 50/€10M threshold, you are probably an 'important entity' with lighter requirements.
If Yes: Proceeds to: Do you have a documented incident response plan covering cybersecurity incidents that affect your services?If No: In NIS2 scope as important entity - 5
Do you have a documented incident response plan covering cybersecurity incidents that affect your services?
NIS2 requires essential and important entities to have incident response capabilities, including a plan for detecting, containing, and reporting significant incidents.
If Yes: In NIS2 scope — check your full compliance postureIf No: In NIS2 scope — incident response plan required - 6
Is your company critical infrastructure regardless of size — e.g. a sole provider of a critical service in a member state, or a critical infrastructure operator named by your national authority?
Member states can impose NIS2 on small and micro enterprises if they are the sole provider of a service essential to the economy or society.
If Yes: In NIS2 scope — critical infrastructure exceptionIf No: Below NIS2 size thresholds — generally exempt