Free

In scope? And then how deep?

Seven questions take you the whole way: whether NIS2 reaches you, whether you are an essential or an important entity, which national law and framework then apply — and what depth of controls that level actually asks of you.

The classification is only half the answer. « Essential entity » is the same words in all 27 member states; what it costs you is not. In Belgium it means 218 CyberFundamentals controls. In Germany the framework has no levels tied to your class at all. In Croatia the level is assigned to you rather than chosen. This tells you which of those you are in.

No registration, no email, and nothing leaves your browser — the whole calculation runs locally, on data served with the page.

1. Which sector best describes your main activity?

2. How many staff (including linked and partner enterprises)?

Group figures, per Recommendation 2003/361/EC — not the local entity alone.

3. Annual turnover?

4. Do any of these apply, regardless of size?

Provider of public electronic communications networks or services; trust service provider; DNS service provider; TLD name registry; sole provider in your member state of an essential service; designated critical entity under Directive (EU) 2022/2557; public administration entity.

5. Do you provide services in the European Union?

6. Are you a financial entity within the meaning of DORA?

Credit institution, payment institution, investment firm, insurer, CASP, fund manager, and the other categories listed in DORA article 2.

7. Which member state's law binds you?

This is what decides which framework your supervisor reads, and how deep the controls go. If you operate in several, answer for the one you want to see — then compare.