Home / Cybersecurity / NIS2 check

Is your company in scope of NIS2?

Five questions. You get an immediate answer for the Netherlands, Belgium or Luxembourg — essential entity, important entity, supplier of an in-scope customer, or out of scope — with the next steps and the deadline that applies to you.

How the rules work

• Annex I sectors (high criticality): energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, space. Large companies → essential; medium companies → important.
• Annex II sectors (other critical): postal and courier, waste management, chemicals, food, manufacturing, digital providers, research. Medium and large companies → important.
• Some providers are in scope whatever their size (qualified trust services, TLD registries, DNS providers); public electronic communications providers are in scope whatever their size, and essential from medium size.
• Medium company: 50 to 249 staff, or more than €10 million annual turnover and balance sheet. Large company: 250+ staff, or more than €50 million turnover and €43 million balance sheet.

Significant incidents: early warning within 24 hours, notification within 72 hours, final report within one month.

Frequently asked questions

How reliable is this check?

It applies the NIS2 size and sector rules as transposed in the Netherlands, Belgium and Luxembourg. National authorities can also designate entities individually, so treat the result as a first indication and confirm with the official register.

Is my data stored?

The answers are computed in your browser. Nothing is stored unless you send the contact form.

We have several companies in a group. How do we count?

Size is assessed per legal entity, taking partner and linked companies into account under the EU SME definition. When in doubt, ask us.