The NIS2 Directive, explained
The NIS2 Directive (Directive (EU) 2022/2555) is the EU law on a high common level of cybersecurity. It replaced the first NIS Directive, applies from 18 October 2024 and reaches far more organisations: 18 sectors instead of 7, and medium-sized companies as well as large ones. Because it is a directive, each member state transposes it into national law. This free NIS2 compliance checker helps you answer the two questions every organisation asks: are we in scope? and how far are we from compliance?
Who is in scope of NIS2?
An organisation is in scope when it carries out an activity listed in Annex I (sectors of high criticality) or Annex II (other critical sectors), provides its services or carries out its activities in the EU, and is at least a medium-sized enterprise (Article 2(1)). Some entities are in scope regardless of size (Article 2(2)): providers of public electronic communications networks or services, trust service providers, TLD name registries and DNS service providers, public administration entities, and entities a member state designates because they are the sole provider of an essential service or because a disruption would have a significant impact. Critical entities under the CER Directive are always in scope.
| Annex | Sectors |
|---|
| Annex I | Energy (electricity, district heating and cooling, oil, gas, hydrogen), transport (air, rail, water, road), banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, space |
| Annex II | Postal and courier services, waste management, chemicals, food, manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment), digital providers (online marketplaces, search engines, social networks), research |
The size test: medium-sized or larger
NIS2 uses the EU definition of SMEs (Recommendation 2003/361/EC). An enterprise is medium-sized when it has fewer than 250 staff and an annual turnover of at most €50 million or a balance sheet total of at most €43 million. It is small below 50 staff with a turnover or balance sheet of at most €10 million. So the threshold for NIS2 is, in practice, 50 staff, or more than €10 million in both turnover and balance sheet. Data of partner and linked enterprises (for example a parent company) count too, which is why a small subsidiary of a large group can be in scope.
Essential or important entity?
Article 3 sorts entities in scope into two groups. The obligations are the same; supervision and fines differ.
| Essential entity | Important entity |
|---|
| Who | Large Annex I entities; qualified trust service providers, TLD registries and DNS providers of any size; medium and large public electronic communications providers; central government; CER critical entities; entities designated by the member state | All other entities in scope, such as medium Annex I entities and medium or large Annex II entities |
| Supervision | Ex ante and ex post (Art. 32): inspections, audits and scans at any time | Ex post (Art. 33): when there are indications of non-compliance |
| Maximum fine | At least €10 million or 2% of worldwide annual turnover, whichever is higher | At least €7 million or 1.4% of worldwide annual turnover, whichever is higher |
Article 21: the ten cybersecurity measures
Entities must take appropriate and proportionate technical, operational and organisational measures, based on an all-hazards approach, that include at least: (a) risk analysis and information system security policies; (b) incident handling; (c) business continuity, backup management, disaster recovery and crisis management; (d) supply chain security; (e) security in acquisition, development and maintenance, including vulnerability handling and disclosure; (f) policies to assess the effectiveness of the measures; (g) basic cyber hygiene and training; (h) cryptography and encryption; (i) human resources security, access control and asset management; and (j) multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communications.
For DNS service providers, TLD registries, cloud, data centre and CDN providers, managed service and managed security service providers, online marketplaces, search engines, social networks and trust service providers, Commission Implementing Regulation (EU) 2024/2690 sets out these measures in detail in 13 sections, and defines when an incident is significant. It applies directly, without national transposition. For other entities it is a useful reference, which is why the checker maps each control to it.
Article 20: management is accountable
The management body must approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements. Its members must follow training, and entities are encouraged to train their staff regularly. For essential entities, authorities can even temporarily prohibit a manager from exercising managerial functions after serious failures (Art. 32(5)).
Article 23: incident reporting deadlines
A significant incident is one that has caused or can cause severe operational disruption or financial loss for the entity, or that has affected or can affect others by causing considerable material or non-material damage. For such incidents:
- Early warning within 24 hours of becoming aware, saying whether it is suspected to be malicious and whether it could have a cross-border impact.
- Incident notification within 72 hours (24 hours for trust service providers), with an initial assessment of severity and impact and indicators of compromise.
- Intermediate report when the CSIRT or authority asks for one.
- Final report within one month after the incident notification, or a progress report if the incident is still ongoing.
Recipients of your services must also be informed without undue delay when the incident is likely to affect them. The reporting clock in the tools tab calculates the deadlines and puts them in your calendar.
Registration
Member states had to draw up lists of essential and important entities by 17 April 2025 (Art. 3(3)), based on information the entities submit themselves: name, address and contact details, sector and subsector, the member states where they provide services and their IP ranges (for certain digital providers, Art. 27). Changes must be reported within two weeks, or three months for the Article 27 registry. Registration does not decide whether you are in scope: the criteria of the law do.
NIS2 in Belgium
Belgium was one of the first member states with a complete NIS2 law in force (law of 26 April 2024, in force since 18 October 2024). The Centre for Cybersecurity Belgium (CCB) is the national authority. Entities register through Safeonweb@Work; existing entities had until 18 March 2025. Significant incidents are reported to the CCB within 24 hours, with further information within 72 hours and a final report within one month. Essential entities need a regular conformity assessment based on CyberFundamentals (CyFun®) or ISO/IEC 27001, or an inspection by the CCB, with intermediate steps due by 18 April 2026 and full certification expected by 18 April 2027. Important entities can use CyFun® or ISO 27001 voluntarily to show compliance.
Transposition in other member states
Transposition was due by 17 October 2024, but most member states were late. By October 2026 most had a national law in force, including Germany (NIS2UmsuCG, December 2025), the Netherlands (Cyberbeveiligingswet, August 2026), Poland, Portugal and Luxembourg (2026). France, Ireland and Spain did not have a law in force yet. The tools tab lists all 27 with the law, the date and the authority.
NIS2, ISO 27001, CyFun and DORA
NIS2 does not require a specific standard, but ISO/IEC 27001 covers most Article 21 measures and many authorities accept it as evidence; each control in this checker shows the matching ISO 27001:2022 Annex A control. Belgium's CyberFundamentals framework does the same for Belgian entities. Banks, investment firms and other financial entities follow the Digital Operational Resilience Act (DORA) instead of the NIS2 risk-management and reporting rules, because DORA is a sector-specific act (lex specialis).
Privacy and disclaimer
The checker runs entirely in your browser. Nothing you enter is sent anywhere; answers are kept in local storage until you reset, and you can save them to a file. The result is a self-assessment based on the directive, not legal advice: national laws add details, member states can extend the scope, and your authority decides in case of doubt.
More free tools