NIS2
NIS2 applicability check: essential or important entity
A screening for whether the organisation should be treated as an essential entity, an important entity, an ICT supplier, or outside the direct scope. It prepares registers and evidence. It does not replace the competent authority.
An indicative aid for compliance work. It is not legal advice, a filing with an authority, or a certification.
How to read NIS2 scope
NIS2 sorts entities by sector and size. Annex I (energy, transport, health, water, digital infrastructure, banking and financial markets, public administration) and Annex II (postal services, waste, chemicals, food, manufacturing, digital providers and research) do not lead to the same result.
As a rule, a large Annex I undertaking points to an essential entity, and a medium one to an important entity. Annex II medium and large undertakings usually point to important entities. Micro and small enterprises stay out, with exceptions such as DNS providers, TLD registries, qualified trust services and some public bodies.
An ICT supplier outside the direct scope can still receive security, notification and evidence requests from in-scope customers. The tool flags that indirect supply-chain impact.
What CISOs, IT and compliance prepare
An essential or important result means article 21 measures: risk analysis, incident handling, continuity, supply chain, development security, cyber hygiene, cryptography, access control and training. Each one needs an owner, a date and proof.
An “out of scope” result does not close GDPR, AI systems or contractual duties toward regulated customers.
From the result to an audit-ready plan
Use the outcome to decide which proof to collect first: service inventory, supplier list, incident log, backup and restore tests, appointments and minutes. Then attach the same material to GDPR, DORA or ISO/IEC 27001 if those regimes are already open.
FAQ
Does this say I am an essential NIS2 entity?
No. It screens sector, size and known exceptions. Formal qualification depends on NIS2, national transposition and the competent authority.
Which size thresholds does it use?
Small: under 50 staff and up to €10 million. Medium: 50–249 staff or €10–50 million. Large: 250 staff or above €50 million. The higher band wins when only one criterion is met.
Is an out-of-sector supplier ignored?
No. If you sit in the ICT supply chain of an essential or important customer, the tool flags indirect impact: clauses, evidence and incident notice periods arrive through the contract.
What should I do with the result?
Fix the service perimeter, name an owner for the article 21 measures and collect the proof an auditor can ask for. AuditReady keeps controls, suppliers and evidence in one register.