NIS2: are you in scope? The 3-step test

The NIS2 Directive moves regulated cybersecurity from a small circle of operators to thousands of companies — between 15,000 and 18,000 in France alone, according to available estimates. Many discover they are concerned through a customer, a tender or a letter from their trade association. This guide helps you find out where you stand.

Where does France stand? At the end of October 2026, the French transposition law (the “Resilience” bill) has not yet been finally adopted, and the European Commission has referred France to the EU Court of Justice for late transposition. ANSSI already offers pre-registration on MonEspaceNIS2 and published its Référentiel Cyber France (ReCyF) in March 2026. The criteria below are those of the directive; check the national details of your country’s law and decrees.

What NIS2 changes

The first NIS Directive (2016) mainly targeted a few hundred “operators of essential services” per country. NIS2 changes the scale:

• 18 sectors instead of 7;
• two categories of entities, essential and important, with different supervision regimes;
• a simple size threshold: in principle, all medium-sized and large companies in the sectors concerned;
• detailed obligations (governance, security measures, incident reporting) and fines of up to €10 million or 2% of worldwide turnover;
• personal accountability of management, who must approve the measures and be trained.

Step 1: is your activity listed in the annexes?

Annex I — sectors of high criticality: energy (electricity, district heating, oil, gas, hydrogen), transport (air, rail, water, road), banking, financial market infrastructure, health (healthcare providers, laboratories, pharmaceutical manufacturers…), drinking water, waste water, digital infrastructure (DNS, data centres, cloud, communication networks…), business-to-business ICT service management (managed services and managed security services), public administration, space.

Annex II — other critical sectors: postal and courier services, waste management, manufacture and distribution of chemicals, production and distribution of food, manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment), digital providers (online marketplaces, search engines, social networks), research.

Think in terms of your actual activities, not your industry code: a software vendor operating its customers’ systems may count as a “managed service provider”; a manufacturer may produce electrical equipment covered by Annex II.

Step 2: your size

In principle, the directive targets companies above the small-enterprise ceilings of EU Recommendation 2003/361/EC: at least 50 employees, or annual turnover and balance sheet above €10 million. Headcounts and amounts of partner or linked enterprises (your group) may have to be aggregated.

Some entities are in scope whatever their size: providers of public electronic communications networks or services, trust service providers, top-level domain registries and DNS providers, the sole provider of an essential service in a country, or an entity whose disruption would have a significant impact.

Step 3: essential or important entity?

Simplifying:

• large companies in Annex I sectors are in principle essential entities;
• medium-sized companies in Annex I and companies in Annex II are in principle important entities.

The difference mainly concerns supervision (ex ante for essential entities, ex post for important ones) and the maximum fines. The substantive obligations are the same.

What you will have to do

1. Register with the authority (ANSSI in France) and keep the information up to date.
2. Involve management (Article 20): approval of the measures, oversight, training of executives.
3. Implement risk-management measures (Article 21): risk analysis and security policies, incident handling, business continuity and backups, supply chain security, secure development and vulnerability handling, assessing the effectiveness of measures, cyber hygiene and training, cryptography, human resources security and access control, multi-factor authentication.
4. Report significant incidents (Article 23): early warning within 24 hours, incident notification within 72 hours, final report within one month.

What if you supply an entity in scope?

Even out of scope, you will be affected: your customers must secure their supply chain. Expect security questionnaires, contractual clauses (incident notification, audit, minimum measures) and requests for evidence. Being ready becomes a commercial argument.

Where to start now

• Take the scope test (MonEspaceNIS2 in France) and document your conclusion.
• Build an inventory of your systems, data, critical suppliers and privileged accounts.
• Carry out a simple risk analysis, shared with management.
• Apply the hygiene measures of the ANSSI guide: updates, offline backups, MFA on remote access and email, separate administration accounts.
• Write an incident handling and reporting procedure with the 24 h / 72 h / 1-month deadlines, and test it on a scenario.
• Organise an awareness session for management.

How OK-GRC helps

OK-GRC links the NIS2 requirements to shared controls also used by ISO 27001 and the ANSSI hygiene guide: every control you implement moves all three forward. The incident register computes the NIS2 deadlines, the governance policy and notification procedure templates are ready to tailor, and the AI assistant helps you prioritise.