Precise Determination of Your NIS2 Application Scope

NIS2 Scope Assessment

An accurate assessment of the NIS2 application scope is the first critical step for successful compliance.

  • 01Legally secure determination of NIS2 application scope
  • 02Optimized compliance costs through precise scope definition
  • 03Strategic recommendations for implementation
  • 04Foundation for efficient NIS2 implementation
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

NIS2 Scope Assessment

The NIS2 Directive defines complex criteria for determining which organizations fall under its scope. A professional scope assessment is essential to avoid compliance risks and optimize implementation costs. We conduct a systematic analysis that considers all relevant factors and ensures legally secure classification.

Our NIS2 Scope Assessment provides a comprehensive and systematic evaluation of your company to determine the applicability of the NIS2 Directive. We analyze all relevant aspects and deliver clear recommendations for action.

2 service modules

Service scope

01

Comprehensive Scope Analysis

We conduct a detailed assessment of your company to determine the exact NIS2 application scope.

  • Systematic data collection and organizational analysis
  • Assessment of size criteria and sectoral classification
  • Identification of critical and essential entities
  • Analysis of digital services and their NIS2 relevance
02

Strategic Recommendations

Based on the scope assessment, we develop concrete recommendations for action for your NIS2 compliance.

  • Prioritized roadmap for NIS2 implementation
  • Cost estimation and resource planning
  • Identification of quick wins and critical paths
  • Legally secure documentation for supervisory authorities

5 phases

Our Approach

Together with you, we develop a precise and legally secure determination of the NIS2 application scope for your company.

  1. Comprehensive data collection on organizational structure and business activities

  2. Systematic assessment based on NIS2 criteria

  3. Sectoral classification and criticality assessment

  4. Documentation of scope determination with legal justification

  5. Strategic recommendations for further implementation

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn
A precise scope assessment is the foundation of every successful NIS2 implementation. Our systematic analysis ensures legally secure classification and optimal resource allocation for our clients.
ADVISORI expert opinion

Our Scope Assessment Expertise

  • 01Deep expertise in NIS2 criteria and sectoral classifications
  • 02Proven methodology for legally secure scope determination
  • 03Experience across all NIS2-regulated sectors
  • 04Strategic recommendations for cost-optimized implementation

Critical Success Factor

An inaccurate scope determination can lead to incomplete compliance or unnecessary costs. Professional assessment ensures legally secure classification and optimal resource allocation.

6 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about NIS2 Scope Assessment

What is a NIS2 scope assessment?

A NIS2 scope assessment is a structured review to determine whether and to what extent your organization is subject to the NIS2 Directive. It answers: Does your company operate in one of the 18 regulated sectors? Do you meet the size thresholds (50+ employees or EUR 10 million turnover)? Which entity class do you belong to: essential or important? The outcome determines your regulatory obligations and the scope of your NIS2 roadmap.

How do I check whether my company is affected by NIS2?

The NIS2 applicability check follows three steps: 1) Sector check (is your activity listed in Annex I or II of the BSIG/NIS2?), 2) Size check (more than 50 employees OR more than EUR 10 million turnover/balance sheet?), 3) Exceptions and special rules (regardless of size: qualified trust service providers, top-level domain registries, DNS service providers, critical infrastructure). The BSI offers an online self-assessment tool, without legal binding force.

What size thresholds apply under NIS2?

The NIS2 implementation law (NIS2UmsuCG) in Germany distinguishes: Important entities: more than 50 employees OR more than EUR 10 million turnover and balance sheet total in a NIS2 sector. Essential entities: more than 250 employees OR more than EUR 50 million turnover and more than EUR 43 million balance sheet. Note: corporate group structures and affiliated companies can affect the thresholds. Professional assessment avoids self-classification errors.

What does a professional NIS2 scope assessment include?

A professional NIS2 scope assessment covers: 1) Corporate structure analysis (subsidiaries, affiliated companies, shareholdings), 2) Sector assignment (which activities fall under which NIS2 sector?), 3) Size evaluation (headcount, turnover, balance sheet of all relevant entities), 4) Entity classification (essential/important/not affected), 5) Scope documentation (which systems, locations and processes fall under NIS2?) and a recommended action plan.

Essential vs. important entity: how is the classification determined?

Classification depends on sector and size: Essential entities (EE) come from high-risk sectors (Annex I: energy, transport, banking, health, water, digital infrastructure) and exceed the essential entity size thresholds. Important entities (IE) come from lower-risk sectors (Annex II: postal, chemicals, food, manufacturing, digital services). Both classes share the same Art. 21 obligations but face different supervisory regimes: essential entities face proactive oversight, important entities only reactive.

Can you perform the NIS2 scope assessment yourself?

An initial assessment is possible using the BSI self-assessment tool, without legal binding force. For a robust, authority-defensible scope determination, professional consulting is recommended especially for: corporate group structures (consolidation questions), mixed-activity companies with multiple business lines, unclear sector classification, or potential essential entity status (proactive supervisory oversight). Self-classification errors can lead to missed registration deadlines and regulatory exposure.