Free

In scope? And then how deep?

Seven questions take you the whole way: whether NIS2 reaches you, whether you are an essential or an important entity, which national law and framework then apply — and what depth of controls that level actually asks of you.

The classification is only half the answer. « Essential entity » is the same words in all 27 member states; what it costs you is not. In Belgium it means 218 CyberFundamentals controls. In Germany the framework has no levels tied to your class at all. In Croatia the level is assigned to you rather than chosen. This tells you which of those you are in.

No registration, no email, and nothing leaves your browser — the whole calculation runs locally, on data served with the page.

1. Which type of entity listed in the annexes describes your main activity?

The annexes list types of entity, not whole industries. A software-as-a-service provider is not a digital provider unless it runs an online marketplace, search engine or social network, but it can be a cloud computing service provider (Annex I, point 8) if its service enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources (article 6(30); recital 33 lists SaaS among cloud service models). A manufacturer outside medical devices and NACE divisions 26 to 30 is not in point 5 of Annex II. If no type fits, choose “None of these”. Domain name registration services are not an annex type: they have their own option (article 2(4)).

2. How many staff (including linked and partner enterprises)?

Group figures, per Recommendation 2003/361/EC — not the local entity alone.

3. Annual turnover and annual balance sheet total?

Recommendation 2003/361/EC counts turnover or balance sheet total: an enterprise stays small or medium-sized if either one is under the ceiling. Group figures again.

4. Does one of these describe you, whatever your size?

Each case carries its own class under article 3: a qualified trust service provider is essential at any size, a non-qualified one is not. If several apply, choose the first in the list. Identification under article 2(2)(b) to (e) is made by your member state.

5. Do you provide services in the European Union?

6. Are you a financial entity within the meaning of DORA?

Credit institution, payment institution, investment firm, insurer, CASP, fund manager, and the other categories listed in DORA article 2.

7. Which member state's law binds you?

This is what decides which framework your supervisor reads, and how deep the controls go. If you operate in several, answer for the one you want to see — then compare.