You Are Probably Not Affected by NIS2

Your organization is not headquartered or operating within the European Union. The NIS2 Directive generally applies to EU-based entities or those providing critical services in the EU.

If you serve clients in the EU or plan to expand into the EU market, future compliance may become relevant.

Learn About EU Cyber Requirements

You Are Most Likely Affected by NIS2 as a KRITIS Operator

Your organization operates in a sector classified as critical infrastructure under the German IT Security Act (BSIG §2 Abs. 10) and the BSI-KritisV regulation. This classification applies regardless of employee count or turnover.

As a KRITIS operator, you are automatically subject to enhanced cybersecurity obligations under both national (BSIG) and EU-wide (NIS2 Directive) regulations. Specific reporting, risk management, and governance requirements will apply.

Get NIS2 Readiness Advice

You Are Likely an Essential Entity under NIS2

Your organization operates in a high-criticality sector and meets the size thresholds that qualify it as an Essential Entity under the NIS2 Directive.

This means you are subject to strict cybersecurity obligations, proactive supervision by national authorities, and potentially significant penalties for non-compliance.

Book NIS2 Consultation

You May Not Meet the Size Criteria for NIS2

Your organization operates in a high-criticality sector, but based on your size and turnover, you may fall below the formal NIS2 thresholds for Essential Entities.

However, national authorities may still designate smaller operators, or you may be indirectly affected through supply chain obligations.

Request a Compliance Check

You May Not Meet the Size Criteria for NIS2

Your organization operates in a high-criticality sector, but based on your size and turnover, you may fall below the formal NIS2 thresholds for Essential Entities.

However, national authorities may still designate smaller operators, or you may be indirectly affected through supply chain obligations.

Request a Compliance Check

You May Not Meet the Size Criteria for NIS2

Your organization operates in a high-criticality sector, but based on your size and turnover, you may fall below the formal NIS2 thresholds for Essential Entities.

However, national authorities may still designate smaller operators, or you may be indirectly affected through supply chain obligations.

Request a Compliance Check

You Are Likely an Important Entity under NIS2

Your organization operates in a critical sector and meets the size thresholds defined for Important Entities under the NIS2 Directive.

While supervision may be less direct than for Essential Entities, you are still required to implement full cybersecurity and risk management measures.

Plan Your NIS2 Compliance

You May Not Meet the Size Criteria for NIS2

Your organization is in a sector covered by NIS2, but your size or turnover appears to fall below the defined thresholds for Important Entities.

However, you may still be designated by national authorities or indirectly impacted through partnerships and contracts with in-scope organizations.

Get NIS2 Readiness Advice

You May Not Meet the Size Criteria for NIS2

Your organization is in a sector covered by NIS2, but your size or turnover appears to fall below the defined thresholds for Important Entities.

However, you may still be designated by national authorities or indirectly impacted through partnerships and contracts with in-scope organizations.

Get NIS2 Readiness Advice

You May Not Meet the Size Criteria for NIS2

Your organization is in a sector covered by NIS2, but your size or turnover appears to fall below the defined thresholds for Important Entities.

However, you may still be designated by national authorities or indirectly impacted through partnerships and contracts with in-scope organizations.

Get NIS2 Readiness Advice

You Are Probably Not Affected by NIS2

Based on your answers, your organization is not operating in a sector currently covered by the NIS2 Directive.

However, best practices in cybersecurity are recommended for all organizations — and future regulations may expand in scope.

Learn About Cybersecurity Essentials

You Are Most Likely Affected by NIS2 as a Digital Infrastructure Provider

Organizations operating as qualified trust service providers, DNS service providers, or TLD registries are directly in scope under the NIS2 Directive—regardless of company size or turnover. These entities are considered vital to digital infrastructure and must meet strict cybersecurity, monitoring, and reporting requirements.

Get NIS2 Readiness Advice