Who does NIS2 apply to?

Annex I or Annex II activity. Annex I covers energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space. Annex II covers the other critical sectors, including digital providers, manufacturing, food, chemicals, research, postal and courier services, and waste management. Size, using the EU SME definition in the Annex to Recommendation 2003/361/EC rather than a NIS2-specific threshold. The limb is met by an entity that is medium-sized or larger — that is, one that is not micro or small. Each category has a headcount ceiling and a financial ceiling, and the two work differently. Crossing the headcount ceiling moves an enterprise up on staff alone. The Annex asks whether turnover and/or balance sheet total stays within the financial ceiling, so a financial ceiling has to be breached on both figures before it moves an enterprise anywhere. Micro therefore runs to fewer than 10 annual work units and €2 M; small to fewer than 50 annual work units and €10 M; and medium to fewer than 250 annual work units with €50 M of turnover or a €43 M balance sheet total. Headcount is measured in annual work units and can be fractional, so the boundaries are stated as the Annex states them. Worked case, for an autonomous Annex-sector company: 30 annual work units with €12 M of turnover and an €8 M balance sheet total is still small, so the size limb is not met. Worked case: the same company at €12 M on both figures is not small, is medium-sized, and is inside the scope test. Worked case: the same company at 120 annual work units is past the small headcount ceiling on staff alone, so it is medium-sized even at €3 M of turnover and a €2 M balance sheet total. All three cases are subject to the period, group and exception rules below. Two details the SME definition adds and NIS2 inherits: the figures are those of the latest approved accounting period, and a ceiling counts as exceeded only once it has been exceeded over two consecutive accounting periods. Group figures can count. Where an enterprise is linked to or partnered with others, headcount and financial data are aggregated — all of a linked enterprise's figures and a proportionate share of a partner enterprise's, from consolidated accounts where they exist. Public-ownership figures can count too, but do not disqualify you: NIS2 disapplies Article 3(4) of the Annex to that Recommendation, so holding 25% or more of the capital or voting rights in public hands does not stop an enterprise qualifying as medium-sized here. Exceptions are narrow and specific. Public administration entities working in national security, public security, defence or law enforcement are outside the directive, as are entities a Member State has exempted from the scope of the DORA regulation. Member States may extend the directive to local public administration and to education institutions. In scope regardless of size: providers of public electronic communications networks or services, trust service providers, top-level domain registries and DNS service providers, and entities a Member State identifies individually for their criticality. The directive reaches critical entities under Directive (EU) 2022/2557 and entities providing domain name registration services whatever their size too. Landing here settles scope rather than classification — the duties below are the ones NIS2 places on essential and important entities, and which of the two an entity is, or whether it is neither, is decided separately. A customer's NIS2 questionnaire is a contractual request, not direct legal applicability. Many suppliers answer one without being in scope themselves. The binding text where you operate is your Member State's transposition, not the directive itself — in Finland the Kyberturvallisuuslaki (124/2025), in force since April 2025.

What do teams need to do for NIS2?

Risk management, incident handling, business continuity, supply-chain security, and management accountability. Security governance that can be shown to customers, auditors, and national authorities. Evidence that controls are current, not just documented once.

What belongs in a NIS2 compliance checklist?

Start with scope and national registration, then cover the ten Article 21 risk-management areas, management approval and training under Article 20, and significant-incident reporting under Article 23.

Does ISO 27001 certification establish NIS2 compliance?

Treat shared controls as a starting point. NIS2 also has its own scope, governance and reporting requirements. ENISA publishes implementation guidance, evidence examples and mappings for the digital-provider categories covered by Implementing Regulation (EU) 2024/2690; check the applicable national requirements too.

Framework reference

NIS2 compliance checklist and requirements.

NIS2 applies to organisations whose activity is of a type listed in Annex I or Annex II of the directive and that are medium-sized or larger, plus a set of categories that are in scope regardless of size. Whether it reaches you is decided by your sector and by the EU SME size test — your headcount together with your turnover and balance sheet total — not by how your security programme looks.

Reviewed on 2026-11-11

Kaamos support: Supported in Kaamos
Category: Binding EU regulations
Obligation: Binding
Last updated: November 11, 2026

The obligation, in the act's words

Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems…

Article 21(1), Directive (EU) 2022/2555 (NIS2)

The measures have to be proportionate to the risk in the systems you run, which is a judgement you can only defend from an inventory of what you actually have.

NIS2 compliance checklist

An EU-level starting checklist for essential and important entities. Confirm your national implementing rules and sector guidance before using it as your work plan. Official, openly published sources checked on 2026-11-11. NIS2 Directive

Confirm sector and size. Check whether your activity appears in Annex I or II and meets the medium-sized-or-larger test. Review size-independent categories and national designations before ruling yourself out.
NIS2 Article 2 and Annexes I–II
Calculate the enterprise size. Use annual work units, turnover and balance sheet figures, including the partner and linked-enterprise rules. Headcount alone is not the whole test.
EU SME definition, Annex Articles 2–6
Confirm classification and national rules. Determine whether you are an essential or important entity. Check the national implementing law and competent authority for your activities; sector-specific EU rules can displace equivalent NIS2 duties.
NIS2 Articles 3, 4 and 41

Article 21 risk-management measures

Cover all ten areas using an all-hazards approach, with measures proportionate to your risks. Article 21(1)–(2). For your work plan, assign an owner, current evidence and a next action to each area.

Risk analysis and system security. Maintain policies for analysing risk and securing information systems.
Article 21(2)(a)
Incident handling. Prepare how incidents will be detected, handled and escalated.
Article 21(2)(b)
Continuity and recovery. Cover backups, disaster recovery and crisis management.
Article 21(2)(c)
Supply-chain security. Address security in relationships with direct suppliers and service providers, considering their vulnerabilities and cybersecurity practices.
Article 21(2)(d) and 21(3)
Secure acquisition and development. Cover system acquisition, development and maintenance, including vulnerability handling and disclosure.
Article 21(2)(e)
Measure effectiveness. Set policies and procedures for evaluating whether risk-management measures work.
Article 21(2)(f)
Cyber hygiene and training. Include basic cyber hygiene practices and cybersecurity training.
Article 21(2)(g)
Cryptography. Set policies and procedures for cryptography and, where appropriate, encryption.
Article 21(2)(h)
People, access and assets. Cover human resources security, access control policies and asset management.
Article 21(2)(i)
Authentication and communications. Use multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communications within the entity, where appropriate.
Article 21(2)(j)

Article 23 incident reporting deadlines

Decide whether the incident is significant. Article 23 covers incidents causing or capable of causing severe service disruption or financial loss, or considerable material or non-material damage to others. Notify the CSIRT or competent authority.
Article 23(1) and 23(3)
Within 24 hours of awareness. Send an early warning without undue delay after becoming aware of a significant incident. Where applicable, indicate suspected unlawful or malicious acts and possible cross-border impact.
Article 23(4)(a)
Within 72 hours of awareness. Send the incident notification without undue delay, with an initial assessment of severity and impact and available indicators of compromise. For trust service providers, significant incidents affecting trust services require this notification within 24 hours instead.
Article 23(4)(b) and trust-service derogation
Intermediate and final reports. Provide an intermediate update if requested. Submit the final report within one month after the incident notification, covering impact, likely root cause, mitigation and any cross-border effects. If the incident is ongoing, provide a progress report then and the final report within one month after handling it.
Article 23(4)(c)–(e)

Registration and management duties

Register with the relevant national authority. Check the national filing mechanism and deadline. Article 3 requires identifying and contact information for the entity list, with changes reported without delay and within two weeks. Article 27 adds a registry for specified digital providers, with its own information requirements and update rules. These are distinct provisions, not one universal company registration deadline.
Articles 3(3)–(4), 26 and 27
For entities in Finland. Traficom directs entities to register with their sector's supervisory authority and maintain an up-to-date risk-management procedure. Its guidance lists the required registration information and a two-week limit for reporting changes.
Traficom: NIS2 obligations in Finland
Get management approval and oversight. Management bodies must approve the Article 21 measures, oversee implementation and can be held liable for infringements. Management-body members must follow training.
Article 20

NIS2 compliance checker

Looking for a NIS2 compliance checker? Start with our regulation check to explore whether NIS2 may apply to your company. It screens applicability from your answers; it does not audit your controls or establish legal compliance. Then use this checklist to plan the requirements with your team and relevant authority.

Check whether NIS2 may apply

NIS2 checklist questions

What belongs in a NIS2 compliance checklist?
Start with scope and national registration, then cover the ten Article 21 risk-management areas, management approval and training under Article 20, and significant-incident reporting under Article 23.
Articles 2, 3, 20, 21, 23 and 27
Does ISO 27001 certification establish NIS2 compliance?
Treat shared controls as a starting point. NIS2 also has its own scope, governance and reporting requirements. ENISA publishes implementation guidance, evidence examples and mappings for the digital-provider categories covered by Implementing Regulation (EU) 2024/2690; check the applicable national requirements too.
ENISA technical implementation guidance

Read the ISO 27001 guide when planning evidence you can reuse.

Who it applies to

Annex I or Annex II activity. Annex I covers energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space.
Annex II covers the other critical sectors, including digital providers, manufacturing, food, chemicals, research, postal and courier services, and waste management.
Size, using the EU SME definition in the Annex to Recommendation 2003/361/EC rather than a NIS2-specific threshold. The limb is met by an entity that is medium-sized or larger — that is, one that is not micro or small.
Each category has a headcount ceiling and a financial ceiling, and the two work differently. Crossing the headcount ceiling moves an enterprise up on staff alone.
The Annex asks whether turnover and/or balance sheet total stays within the financial ceiling, so a financial ceiling has to be breached on both figures before it moves an enterprise anywhere.
Micro therefore runs to fewer than 10 annual work units and €2 M; small to fewer than 50 annual work units and €10 M; and medium to fewer than 250 annual work units with €50 M of turnover or a €43 M balance sheet total.
Headcount is measured in annual work units and can be fractional, so the boundaries are stated as the Annex states them.
Worked case, for an autonomous Annex-sector company: 30 annual work units with €12 M of turnover and an €8 M balance sheet total is still small, so the size limb is not met.
Worked case: the same company at €12 M on both figures is not small, is medium-sized, and is inside the scope test.
Worked case: the same company at 120 annual work units is past the small headcount ceiling on staff alone, so it is medium-sized even at €3 M of turnover and a €2 M balance sheet total. All three cases are subject to the period, group and exception rules below.
Two details the SME definition adds and NIS2 inherits: the figures are those of the latest approved accounting period, and a ceiling counts as exceeded only once it has been exceeded over two consecutive accounting periods.
Group figures can count. Where an enterprise is linked to or partnered with others, headcount and financial data are aggregated — all of a linked enterprise's figures and a proportionate share of a partner enterprise's, from consolidated accounts where they exist.
Public-ownership figures can count too, but do not disqualify you: NIS2 disapplies Article 3(4) of the Annex to that Recommendation, so holding 25% or more of the capital or voting rights in public hands does not stop an enterprise qualifying as medium-sized here.
Exceptions are narrow and specific. Public administration entities working in national security, public security, defence or law enforcement are outside the directive, as are entities a Member State has exempted from the scope of the DORA regulation.
Member States may extend the directive to local public administration and to education institutions.
In scope regardless of size: providers of public electronic communications networks or services, trust service providers, top-level domain registries and DNS service providers, and entities a Member State identifies individually for their criticality.
The directive reaches critical entities under Directive (EU) 2022/2557 and entities providing domain name registration services whatever their size too.
Landing here settles scope rather than classification — the duties below are the ones NIS2 places on essential and important entities, and which of the two an entity is, or whether it is neither, is decided separately.
A customer's NIS2 questionnaire is a contractual request, not direct legal applicability. Many suppliers answer one without being in scope themselves.
The binding text where you operate is your Member State's transposition, not the directive itself — in Finland the Kyberturvallisuuslaki (124/2025), in force since April 2025.

What you need to do

Risk management, incident handling, business continuity, supply-chain security, and management accountability.
Security governance that can be shown to customers, auditors, and national authorities.
Evidence that controls are current, not just documented once.

How Kaamos helps

Maps NIS2 work to assets, vendors, risks, and live control evidence.
Turns customer pressure into a prioritized roadmap instead of a spreadsheet.
Keeps management-facing risk and compliance status current.

Sources

Company profiles this applies to

EU B2B SaaS company with 15-100 employees — plans for NIS2 supply-chain pressure now.
Finnish public-sector software supplier — plans for NIS2 supply-chain pressure now.
EU fintech or software supplier to financial customers — watches NIS2 as it grows.
EU SaaS company building or embedding AI — watches NIS2 as it grows.

Supported in Kaamos

Manage NIS2 controls, owners and evidence in Kaamos. Talk to us about the framework scope and connected systems you need.

Book a meeting Run the check