NIS2 Checker: Does the NIS2 Directive Apply to Your Company?
This free NIS2 checker tells you whether the NIS2 Directive (EU) 2022/2555 applies to your company and, if it does, whether you count as an essential or an important entity. Pick your sector and country, enter your size, and you get the result, the penalties that go with it and the first steps to take, all calculated in your browser.
- Free
- No signup
- Runs in your browser
- Essential or important entity
- Sector and size test
How it works
- 1Pick your sectorChoose the Annex I or Annex II sector that matches what your company does.
- 2Enter your sizeAdd employees, turnover and balance sheet total. Include linked and partner companies.
- 3Get your resultSee whether NIS2 applies, which class you fall into, the penalties and the first steps.
How this NIS2 checker decides if NIS2 applies
The NIS2 checker applies three tests in the order the Directive does. First it asks whether you are established in the EU, or offer one of the digital services that reach non-EU providers. Second it looks at your sector against Annex I and Annex II. Third it measures your size under Commission Recommendation 2003/361/EC. A medium or large company in a listed sector is in scope, and a handful of entity types are in scope at any size.
The answer also depends on the national law that transposes the Directive. NIS2 replaced the original NIS Directive (EU) 2016/1148, and Member States had to adopt their national laws by 17 October 2024. Several countries were late, so check your country's current status with its competent authority.
NIS2 size thresholds
Company size under NIS2 follows the EU definition of small and medium-sized enterprises. Headcount and financial figures of partner and linked companies are added in, so a small subsidiary of a large group is usually measured as part of that group.
| Size | Employees | Turnover or balance sheet total | In scope of NIS2? |
|---|---|---|---|
| Micro | Fewer than 10 | Up to EUR 2 million | Only in the any-size cases |
| Small | Fewer than 50 | Up to EUR 10 million | Only in the any-size cases |
| Medium | Fewer than 250 | Turnover up to EUR 50 million, or balance sheet total up to EUR 43 million | Yes, in an Annex I or II sector |
| Large | 250 or more | Turnover above EUR 50 million and balance sheet total above EUR 43 million | Yes, in an Annex I or II sector |
NIS2 sectors: Annex I and Annex II
NIS2 lists 18 sectors. Annex I holds the sectors of high criticality, and Annex II holds other critical sectors. The checker above uses these lists, and entities marked "any size" are covered even if they are small.
| Annex I sector | Types of entity |
|---|---|
| Energy | Electricity (generation, supply, distribution, transmission, trading); District heating and cooling; Oil (production, refining, pipelines, storage); Gas (supply, distribution, storage, LNG); Hydrogen (production, storage, transmission) |
| Transport | Air transport (airlines, airports, air traffic control); Rail transport (infrastructure managers, railway undertakings); Water transport (shipping companies, ports, vessel traffic services); Road transport (road authorities, intelligent transport systems) |
| Banking and financial markets | Banking (credit institution); Financial market infrastructure (trading venue, central counterparty) |
| Health | Healthcare provider (hospital, clinic, laboratory); EU reference laboratory; Pharmaceutical research and development; Manufacturer of basic pharmaceutical products and preparations; Manufacturer of medical devices critical in a public health emergency |
| Drinking water | Drinking water supplier or distributor |
| Waste water | Waste water collection, disposal or treatment |
| Digital infrastructure | Internet exchange point (IXP) provider; DNS service provider (any size); Top-level domain (TLD) name registry (any size); Cloud computing service provider; Data centre service provider; Content delivery network (CDN) provider; Trust service provider (qualified) (any size); Trust service provider (non-qualified) (any size); Public electronic communications network or service provider (telecom, ISP) (any size) |
| ICT service management (business to business) | Managed service provider (MSP); Managed security service provider (MSSP) |
| Public administration | Central government public administration (any size); Regional public administration |
| Space | Space (operator of ground-based infrastructure supporting space services) |
| Annex II sector | Types of entity |
|---|---|
| Postal and courier services | Postal or courier service provider |
| Waste management | Waste management (collection, transport, treatment, disposal) |
| Chemicals | Manufacture, production or distribution of chemicals |
| Food | Food production, processing or distribution (including wholesale and industrial production) |
| Manufacturing | Manufacture of medical devices and in vitro diagnostic medical devices; Manufacture of computer, electronic and optical products; Manufacture of electrical equipment; Manufacture of machinery and equipment; Manufacture of motor vehicles, trailers and semi-trailers; Manufacture of other transport equipment (ships, trains, aircraft) |
| Digital providers | Online marketplace; Online search engine; Social networking services platform |
| Research | Research organisation |
Essential entity or important entity?
An essential entity is a large company in an Annex I sector, or one of the types named as essential at any size. An important entity is any other company in scope. Both must meet the same security and reporting duties, but supervision and penalties differ.
| Aspect | Essential entity | Important entity |
|---|---|---|
| Who | Large Annex I companies; qualified trust service providers, TLD registries, DNS providers; central government bodies; CER critical entities | Medium Annex I companies; medium and large Annex II companies; non-qualified trust service providers |
| Supervision | Proactive: audits, inspections and security scans, before and after incidents | Reactive: after evidence or an incident points to a breach |
| Maximum fine | At least EUR 10 million or 2% of worldwide annual turnover | At least EUR 7 million or 1.4% of worldwide annual turnover |
| Management | Must approve measures and take training; can be held liable | Same duty and liability |
What NIS2 requires once you are in scope
Once you are in scope, NIS2 requires cybersecurity risk-management measures, incident reporting and management accountability. Article 21(2) lists ten areas that your measures must cover.
- Risk analysis and information system security policies.
- Incident handling.
- Business continuity, backup management, disaster recovery and crisis management.
- Supply chain security, including the security of direct suppliers.
- Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure.
- Policies to assess how well your measures work.
- Basic cyber hygiene and cybersecurity training.
- Cryptography and, where relevant, encryption policies.
- Human resources security, access control and asset management.
- Multi-factor or continuous authentication, secured communications and emergency communications.
Incident reporting runs on three clocks under Article 23: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month. Measures five and six are where technical testing fits. Finding exposed services, known vulnerabilities and weak email settings before an attacker does is how you show the measures work. The free CVE Priority Checker, firewall rule generator and email security checker help with parts of that.
Does NIS2 apply to companies outside the EU?
NIS2 applies to non-EU companies in two ways. Providers of DNS, TLD registry, cloud, data centre, CDN, managed service, managed security service, online marketplace, search engine and social network services must appoint a representative in a Member State if they offer services in the EU, and that Member State gets jurisdiction over them. Other non-EU companies are covered through their EU subsidiaries, which are assessed on their own, and through customers that pass requirements down their supply chain.
NIS2 and your supply chain
Even when NIS2 does not apply to you, it may apply to your customers, and they have to manage the cyber risk of their suppliers under Article 21(2)(d). Expect security questionnaires, contract clauses, and requests for evidence such as scan results, an incident response plan or ISO/IEC 27001 certification. ISO/IEC 27001 is not a NIS2 requirement, but its controls map to many of the Article 21 measures.
What this checker cannot decide
The checker gives a first indication and cannot replace legal advice. It does not know how your country transposed the Directive, whether your authority has designated you in a way the Directive does not require, how DORA or other sector rules apply to you, or whether your group structure changes your size. For those questions, ask your national competent authority or a qualified lawyer.
Frequently asked questions
Does NIS2 apply to my company?
NIS2 applies if your company is based in the EU (or offers certain digital services in it), works in a sector listed in Annex I or Annex II, and is at least medium-sized. Medium-sized means 50 or more employees, or annual turnover or balance sheet total above EUR 10 million. A few types of entity are covered at any size, such as DNS service providers, TLD registries, trust service providers and public electronic communications providers. Use the NIS2 checker above to test your own case.What size company must comply with NIS2?
Medium and large companies in the listed sectors. Under Commission Recommendation 2003/361/EC a medium enterprise has fewer than 250 staff and turnover up to EUR 50 million or a balance sheet total up to EUR 43 million. Anything above that is large. Micro and small enterprises, with fewer than 50 staff and turnover or balance sheet total up to EUR 10 million, are outside the general rule. Partner and linked companies count towards your size.What is the difference between an essential entity and an important entity?
Both must meet the same security and reporting duties. The difference is supervision and fines. Essential entities, such as large energy, transport, banking, health and digital infrastructure companies, face proactive supervision and fines of at least EUR 10 million or 2% of worldwide turnover. Important entities, such as medium companies in Annex I and all covered companies in Annex II, face reactive supervision and fines of at least EUR 7 million or 1.4% of turnover.Does NIS2 apply to small businesses?
Not directly in most cases. Micro and small enterprises are outside the size-cap rule. They are still covered if they are, for example, a DNS service provider, a TLD registry, a trust service provider, a public electronic communications provider, the sole provider of an essential service in their country, or a CER critical entity. Small companies that supply NIS2-regulated customers often face NIS2-style requirements through contracts.What are the penalties for not complying with NIS2?
For essential entities, fines can reach at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities, at least EUR 7 million or 1.4%. National authorities can also order audits, issue binding instructions, and temporarily ban managers from their roles in essential entities. Member States set the exact rules in their national law.How fast must incidents be reported under NIS2?
A significant incident needs an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report no later than one month after the notification. You send these to your national CSIRT or competent authority. An intermediate report can be requested in between.Does NIS2 apply to companies outside the EU?
Mostly through their EU presence. NIS2 attaches to the Member State where an entity is established. Providers of DNS, TLD registry, cloud, data centre, CDN, managed service, managed security service, online marketplace, search engine and social network services that are based outside the EU but offer services in it must appoint a representative in a Member State. Other non-EU companies may feel NIS2 through EU customers.Is my information sent to ScanTitan?
No. The checker runs entirely in your browser. The sector, country and size you enter are not sent anywhere, and nothing is stored. It gives guidance, not legal advice, so confirm important decisions with your national competent authority or a lawyer.NIS2 expects you to find and fix vulnerabilities in your own systems. See what an attacker can see from outside.
Run a free scanSee pricing