      NIS2/Am I in scope?
    

Are you in scope of NIS2?

Two questions - your sector and your size - give you a first indication of whether NIS2 likely applies to your organisation. Not legal advice.

1 · YOUR SECTOR

2 · YOUR SIZE

FIRST INDICATION

Pick a sector and a size

Choose above to see whether NIS2 likely applies to you.

Check your attack surface - free → What NIS2 requires

ANNEX I + LARGE

Essential entity

Large organisations in high-criticality sectors. The strictest obligations and proactive supervision.

MEDIUM+ IN SCOPE SECTOR

Important entity

Medium-sized and large organisations in a covered sector that are not essential. Reactive supervision, same core measures.

Important: some entities are in scope regardless of size - for example DNS service providers, TLD registries, trust service providers, certain telecom providers and parts of public administration. If that could be you, assume you are in scope and clarify the specifics.

This check is a general orientation and not legal advice. The exact classification depends on your specific case and the national implementation law. Athorion covers the external, technical side of NIS2 risk management and does not by itself establish compliance.