Check your status
What it covers
- Scope: Annex I (essential — energy, transport, banking, health, digital infrastructure, public administration) vs Annex II (important — postal services, waste, chemicals, food, manufacturing, digital providers) and the size thresholds (medium: 50+ employees or €10M+ turnover)
- Obligations: risk-management measures (Art. 21), 24-hour early warning / 72-hour notification / one-month report (Art. 23), and management-body accountability (Art. 20)
- Next steps: a concrete, prioritised list of what to do first if you are in scope — and what to watch if you are not
Honest limitation: NIS2 is implemented nationally with variations (registration duties, thresholds, deadlines). This screening uses the directive text as adopted; confirm against your national law.
In scope and need to act?
The free guide NIS2 for Small Agencies: What Changes explains the obligations in plain language. For a full offline checklist with templates, get the NIS2 Compliance Kit e-book ($9.99 on Amazon).
Or read the free comparison: Free NIS2 assessment tools compared · the NIS2 readiness guide
Also try: the free NIS2 Gap Assessment · NIS2 Incident Report Generator · Cookie Consent Checker · EAA accessibility scanner · Accessibility statement generator