Does NIS2 Apply to You? Overview with Infographic

With the new EU NIS2 Directive, cybersecurity is moving into sharper focus for European organisations. Its goal is clear: protect critical and important entities more effectively from digital threats — not only through technical controls but also through binding legal requirements. But many organisations are currently asking themselves: Does NIS2 apply to us?

Key Takeaways

• Use this checklist to verify whether your organisation is affected by NIS2.

• NIS2 covers more sectors than ever before.

• Two categories: important and essential entities.

• Micro-enterprises are usually exempt — with important exceptions.

• Now is the time: assess your status & start building your ISMS.

The Two Main Criteria for NIS2 Applicability

Whether a company falls under NIS2 obligations depends primarily on two factors: size and sector.

1. Company Size

NIS2 generally applies to organisations that:

• employ at least 50 staff, and

• have an annual turnover or balance sheet total of at least €10 million.

These thresholds follow the EU definition of a medium-sized enterprise and apply across all sectors.

2. Company Sector

If an organisation meets the size criteria, the next question is whether it operates in one of the 18 NIS2 sectors, including:

• Energy and water supply

• Digital infrastructure

• Healthcare

• Food production

• Digital services & hosting

• Public administration (central & regional)

Only if both criteria are met does NIS2 apply.

Important and Essential Entities

NIS2 introduces a new distinction between:

• Essential entities (particularly critical sectors)

• Important entities (relevant but less critical sectors)

This classification determines the intensity of regulatory oversight.

Essential Entities

These include organisations operating in highly critical sectors such as:

• Energy

• Finance

• Digital infrastructure

• Healthcare

They are subject to proactive and regular supervision, including:

• recurrent audits

• detailed reporting obligations

• stricter enforcement and potential sanctions

Important Entities

Important entities operate in relevant but less critical sectors, e.g.:

• Postal and courier services

• Waste management

• Food retail

• Chemical production

They are monitored reactively — authorities intervene only when incidents or deficiencies indicate a risk.

This differentiation ensures efficient use of supervisory resources while maintaining a high security level across Europe.

Exemptions and Special Rules — Who Is NOT Covered by NIS2?

Despite its broad scope, NIS2 includes specific exemptions. Not every organisation that uses digital systems or provides essential services automatically falls under the directive.

Exemptions apply to:

• Micro-enterprises (<50 employees and <€10M annual turnover), unless exceptionally security-relevant

• Security and defence institutions (these fall under national security legislation)

• Certain public bodies, such as parliaments or courts, if they do not provide essential services

Special Cases

Smaller organisations may still fall under NIS2 if they play a critical role in:

• the supply chain, or

• public services

In such cases, authorities may designate them as NIS2-relevant regardless of company size.

The takeaway: It pays to look closely — systemic relevance can outweigh size.

Conclusion

NIS2 will require more organisations than ever before to take a strategic, structured approach to cybersecurity. Organisations operating in affected sectors and meeting the size criteria should not wait until national laws take effect — they should start preparing now.

Key steps include:

• determining your NIS2 status correctly

• assigning clear responsibilities internally

• establishing appropriate security measures and documented processes

Whether classified as an important or essential entity, the requirements are demanding — but also an opportunity:

• improved security processes

• greater resilience

• strengthened trust with customers and partners

With the right strategy and effective tools, NIS2 becomes a foundation for sustainable cybersecurity, not a burden.

Step by Step to a Certifiable ISMS

With the fuentis ISMS Tool, you implement current standards efficiently and with minimal effort. Our ready-to-use modules, automated workflows and expert support make building an ISMS simple — whether starting from scratch or upgrading existing structures.

Multi-Compliance ISMS

A complete ISMS solution guiding you to ISO 27001 certification while covering additional frameworks such as BSI Grundschutz, TISAX® and NIS2.

Automated Processes

Workflows that guide you step-by-step through your certification — even without prior knowledge.

Review Questionnaires

Simple, customisable questionnaires to assess protection needs quickly and transparently. Risk-based information security has never been easier.

Personal Support

Receive direct guidance from experienced consultants — from initial analysis to audit preparation.