NIS2 Scope Assessment

A NIS 2 scope assessment is a structured review to determine whether and to what extent your organization is subject to the NIS 2 Directive. It answers: Does your company operate in one of the

18 regulated sectors? Do you meet the size thresholds (50+ employees or EUR

10 million turnover)? Which entity class do you belong to: essential or important? The outcome determines your regulatory obligations and the scope of your NIS 2 roadmap.

The NIS 2 applicability check follows three steps: 1) Sector check (is your activity listed in Annex I or II of the BSIG/NIS2?), 2) Size check (more than

50 employees OR more than EUR

10 million turnover/balance sheet?), 3) Exceptions and special rules (regardless of size: qualified trust service providers, top-level domain registries, DNS service providers, critical infrastructure). The BSI offers an online self-assessment tool, without legal binding force.

The NIS 2 implementation law (NIS2UmsuCG) in Germany distinguishes: Important entities: more than

50 employees OR more than EUR

10 million turnover and balance sheet total in a NIS 2 sector. Essential entities: more than

250 employees OR more than EUR

50 million turnover and more than EUR

43 million balance sheet. Note: corporate group structures and affiliated companies can affect the thresholds. Professional assessment avoids self-classification errors.

A professional NIS 2 scope assessment covers: 1) Corporate structure analysis (subsidiaries, affiliated companies, shareholdings), 2) Sector assignment (which activities fall under which NIS 2 sector?), 3) Size evaluation (headcount, turnover, balance sheet of all relevant entities), 4) Entity classification (essential/important/not affected), 5) Scope documentation (which systems, locations and processes fall under NIS2?) and a recommended action plan.

Classification depends on sector and size: Essential entities (EE) come from high-risk sectors (Annex I: energy, transport, banking, health, water, digital infrastructure) and exceed the essential entity size thresholds. Important entities (IE) come from lower-risk sectors (Annex II: postal, chemicals, food, manufacturing, digital services). Both classes share the same Art.

21 obligations but face different supervisory regimes: essential entities face proactive oversight, important entities only reactive.

An initial assessment is possible using the BSI self-assessment tool, without legal binding force. For a robust, authority-defensible scope determination, professional consulting is recommended especially for: corporate group structures (consolidation questions), mixed-activity companies with multiple business lines, unclear sector classification, or potential essential entity status (proactive supervisory oversight). Self-classification errors can lead to missed registration deadlines and regulatory exposure.