Does NIS 2 Apply to Your Organisation? 5-Step Scope Guide

The assumption we hear most often from mid-sized organisations sounds like this: "NIS 2 is for the big players. We're not a critical national infrastructure operator. It probably doesn't apply to us." That assumption is wrong, and it's already costing some teams the time they don't have to spare.

Member states transposed NIS 2 into national law by 17 October 2024. For most in-scope organisations, it's already a live obligation today.

NIS 2 is a significant expansion of the original NIS Directive, and pulling medium-sized organisations into scope was one of its deliberate design choices. The Directive covers 18 sectors and uses a size-threshold model that catches far more organisations than most compliance teams realise.

Size determines your classification, essential or important; sector determines whether you're covered at all. The rest of this guide walks through the five questions that settle your position.

NIS 2 organises covered sectors into two annexes. Your first job is checking whether your organisation appears in either one.

Annex I: High-Criticality Sectors

These are the sub-sectors the Directive treats as most critical to societal and economic function:

1. Energy (electricity, gas, oil, hydrogen, district heating and cooling)
2. Transport (air, rail, water, road)
3. Banking
4. Financial market infrastructure
5. Health (hospitals, pharmaceutical manufacturers, medical device makers, research labs)
6. Drinking water
7. Wastewater
8. Digital infrastructure (cloud providers, data centres, DNS, CDNs, trust service providers)
9. ICT service management, including managed service providers (MSPs) and managed security service providers (MSSPs)
10. Public administration
11. Space (ground-based infrastructure)

Annex II: Other Critical Sectors

These sectors carry the same compliance obligations, but sit in a second tier for classification purposes:

1. Postal and courier services
2. Waste management, where it's the principal economic activity
3. Chemicals (manufacture, production, distribution)
4. Food (wholesale distribution, industrial production and processing)
5. Manufacturing: medical devices, electronics, electrical equipment, machinery, motor vehicles, other transport equipment
6. Digital providers: online marketplaces, search engines, social networking platforms
7. Research organisations

Your sector sets the ceiling on your obligations. If it doesn't appear in either annex, you're out of scope and the rest of this guide won't apply to you; if it does, move to step two. One nuance worth flagging early: a handful of digital infrastructure sub-sectors, including qualified trust service providers, DNS service providers, and TLD name registries, are in scope regardless of size. For those, skip ahead to step three.

This is where the ‘large operators only’ myth falls apart. NIS 2 uses the EU's standard enterprise size definitions:

Micro and small enterprises generally sit outside NIS 2's scope. Medium and large enterprises in covered sectors sit inside it.

The size test uses ‘or’ logic on employees and turnover: meeting one criterion, 50 or more employees, or turnover exceeding €10 million, is enough to move you past the small-enterprise threshold. You don't need both. (The EU's enterprise-size test also allows an annual balance-sheet total as an alternative to turnover; most mid-sized firms clear the employee count anyway, so this rarely changes the answer.)

What this looks like in practice: a regional managed security service provider with 60 employees and €8 million turnover is in scope. An e-commerce logistics business with 120 employees and €15 million turnover is in scope. A pharmaceutical research firm with 55 employees is in scope, regardless of turnover.

Each of these is a mid-sized enterprise operating in a covered sector, exactly the profile NIS 2 was designed to catch.

One more detail on size: the thresholds apply to your organisation as a standalone entity, though group ownership can change the answer. A subsidiary that would be small on its own may be treated as medium or large if a qualifying parent owns it.

NIS 2 is an EU Directive. It applies to organisations that provide services within the EU, including those headquartered outside it.

If your organisation is based in the UK but provides services into EU member states, the Directive reaches those operations. EU-based customers, EU-based subsidiaries, or services delivered to EU-regulated clients can all create a NIS 2 obligation.

Post-Brexit, the picture carries an extra layer for UK-headquartered organisations. The UK isn't implementing NIS 2 directly; instead, government has signalled updates to the UK's own NIS Regulations. Your EU operations, EU clients, or EU data flows still fall under the Directive, wherever your headquarters sits.

Practical rule: if you have an EU entity, serve EU-regulated customers, or operate infrastructure in EU member states, treat NIS 2 as applicable to those activities and assess your obligations under the relevant member state's transposition. For purely UK-based operations with no EU presence, track the UK NIS Regulations separately; the scope and thresholds are similar but not identical.

Once you clear steps one through three, the next question is how you're classified. NIS 2 distinguishes between two types of in-scope entity under Article 2, and the distinction shapes both your obligations and the penalties you face.

Essential Entities

Large enterprises (250 or more employees, or over €50 million turnover) operating in Annex I sectors are classified as essential entities. These organisations face proactive, ex-ante supervision: regulators can audit them without waiting for an incident.

Important Entities

Medium enterprises in Annex I sectors, plus medium and large enterprises in Annex II sectors, are classified as important entities. Supervision here is reactive, or ex-post: regulators act following an incident or complaint, rather than running routine proactive audits.

The core security obligations are identical for both classifications: risk management and supply chain security under Article 21, incident reporting under Article 23, and management-body governance under Article 20. What differs is supervisory intensity and the penalty ceiling under Article 34:

Important-entity classification lowers your odds of an unprompted audit; it carries the same underlying security duties as essential-entity status. The moment an incident occurs, you're subject to the same scrutiny as an essential entity. Preparing as if you were essential is the safer posture.

The size-threshold rule has genuine exceptions under Article 2(2) of the Directive. Some organisations fall into scope even at small or micro size.

Member states can designate any entity as essential or important regardless of size, on several grounds:

1. Sole provider: the organisation is the only provider, in that member state, of a service critical to societal or economic activity.
2. Significant cross-border impact: a disruption to the organisation's services could have a significant effect across borders.
3. Critical entity designation: the organisation has been designated a critical entity under the Critical Entities Resilience Directive (the CER Directive, Directive (EU) 2022/2557), which automatically brings it into NIS 2 scope as an essential entity.

Certain digital infrastructure sub-sectors, specifically qualified trust service providers, DNS service providers, and TLD name registries, are in scope regardless of size, as flagged in step one. If you operate in any of those sub-sectors, the standard size threshold offers no protection. Full designation criteria for critical entities sit in the CER Directive, Directive (EU) 2022/2557.

The inverse holds too: meeting the size threshold in a covered sector doesn't guarantee you're in scope if your activities within that sector are incidental rather than primary. Waste management, for example, only applies where it's your organisation's principal economic activity.

Confirming you're in scope is only the starting point. NIS 2 imposes mandatory obligations on every in-scope entity, whatever your classification. At a minimum, you need to address:

1. Risk management: documented policies for identifying, assessing, and treating cybersecurity risks across your network and information systems.
2. Incident reporting: a process for reporting significant incidents to your national competent authority. Article 23 sets a 24-hour early warning, a 72-hour incident notification with an initial severity assessment, and a final report due within one month.
3. Supply chain security: assessment of the cybersecurity posture of your key suppliers and service providers. NIS 2 explicitly extends obligations upstream.
4. Governance and accountability: management bodies carry personal responsibility for approving and overseeing cybersecurity measures. IT can support this work; it can't own it alone.
5. Business continuity: plans for maintaining operations during and after a significant incident.

Most mid-sized organisations already understand what NIS 2 requires. Building the evidence that they've done it, and keeping that evidence current as the environment shifts, is where the real cost sits. A spreadsheet-and-email approach struggles to keep pace with a moving regulatory target; treating this as an ongoing execution challenge is what separates teams that stay ready from teams that scramble.

SureCloud's Business Continuity & Resilience module is built around exactly this. Aligned to DORA, NIS 2, and ISO 22301, it turns scattered plans and evidence into one auditable system that management can sign off on with confidence. For the broader picture of what's required once you're in scope, our NIS 2 Compliance: The Complete Guide for Essential and Important Entities covers risk management, incident reporting timelines, supply chain obligations, and governance accountability in full. And if you'd rather see the structured route through all of this than build it yourself, SureCloud's NIS 2 compliance framework lays out the same path start to finish.

The organisations that struggle with NIS 2 are rarely the ones that misread the Directive. They're the ones that did the scoping work, filed the answer away, and mistook that certainty for preparation. Scope is a snapshot; staying in scope safely is an ongoing practice.