NIS-2 Check

Could your company fall under NIS-2?

Three questions about sector, company size and supply-chain role are enough for a solid first assessment of your NIS-2 exposure.

NIS-2 Check

Use our free NIS-2 Check.

Question 1 of 3

Which sector does your company operate in?

Multiple selection possible.

Annex I, critical sectors

Annex II, other critical sectors

Question 2 of 3

How large is your company?

Either employee count or annual turnover applies, one of the two criteria is enough.

Question 3 of 3

Do you provide services to other NIS-2-obligated companies?

As a supplier or IT service provider you can be contractually bound to NIS-2 compliance even without being directly in scope.

How we process your input is explained in our privacy policy.

Please note: The result of this check is a free, automated first assessment and therefore a rough indication only. It does not replace a review of the individual case or legal advice. We accept no liability for the accuracy or completeness of the result.

Background

NIS-2 affects many companies.

The NIS-2 Directive significantly widens the circle of regulated companies, from energy and health to waste management and digital services. In Germany it is implemented through the amended IT Security Act (BSIG).

Who is affected

  • Essential and important entities, depending on sector and company size
  • Suppliers too, via the supply-chain clauses of their clients

The core obligations

  • State-of-the-art risk-management measures (Art. 21 NIS-2)
  • Reporting of significant incidents (early warning 24 h, notification 72 h)
  • Registration with the competent authority
  • Personal responsibility and liability of management (Art. 20 NIS-2)

Assess first, then act

This NIS-2 check gives a first orientation. We support the binding classification and implementation as part of our NIS-2 consulting.

Need advice on data protection?

Result shows action is needed? We clarify the exact classification and support you in implementing NIS-2 obligations.

Call directly +49 (0)69 27 13 57 20-0
Request a callback →

From the blog

Further reading on the topic.

Frequent questions

What clients often ask.

What is the difference between essential and important entities?
Essential entities are typically large companies in Annex I sectors (e.g. energy, banking, health) and face the strictest oversight, with fines of up to €10m or 2% of worldwide annual turnover. Important entities face somewhat lower requirements, with fines of up to €7m or 1.4% of annual turnover.
I'm a small company, can I still be affected?
Micro and small companies are generally exempt. However, there are size-independent exceptions, for example for qualified trust service providers, TLD registries and DNS service providers, as well as public administrations.
What if I'm only indirectly affected via the supply chain?
Even without a direct legal obligation, clients who themselves fall under NIS-2 can contractually pass security requirements down to you as a supplier or service provider. It is worth reviewing current and future contracts.
How reliable is the NIS-2 check assessment?
The NIS-2 check gives a first orientation based on three questions about sector, size and supply-chain role. For a binding, legally sound classification we recommend our NIS-2 scope assessment service.
What should I do if the check classifies me as affected?
You should review the registration duty with the competent authority and carry out a gap analysis against the NIS-2 minimum requirements promptly. We support this as part of our NIS-2 consulting.