Free resource
Find out if NIS2 is even yours before you build anything. The two gates - the size threshold and the Article 6(30) cloud test - worked through step by step, with the reporting duties if you are in.
The actual structure of the file, straight from the template we use on live engagements.
Sheet: Start here
Read this tab first, then work through the checklist. Score honestly - a 'Partly' you can see is worth more than a 'Yes' you cannot evidence. This is a working tool, not a certificate: it shows where an assessor will push, before they do.
| Topic | Detail |
|---|---|
| What this is | NIS2 (Directive (EU) 2022/2555) is transposed into national law, so exact duties vary by member state - but whether it applies to you at all turns on two gates. Work through both before you build anything. |
| How to read scope | You are likely in scope only if you clear the size gate AND provide an in-scope service in an Annex I/II sector. The financial size test is conjunctive; aggregation can pull small companies in. |
| The #1 mistake | Two of them: reading the EUR 10 million test as either/or (it is both), and importing DORA's 4-hour clock. NIS2 reporting is 24h / 72h / one month from awareness. |
| A second pair of eyes | If you want someone who has sat on the other side of the audit table to sanity-check your scoring before it counts, that is what we do at kellwick.com. |
Sheet: Scope determination
Whether NIS2 applies turns on two gates, not on a recital. Work through both. The middle columns give the correct reading and the trap people fall into. NIS2 reporting is 24h / 72h / one month from awareness - there is no 4-hour figure (that is DORA).
| Gate | Test | Correct reading | Common trap | Your answer |
|---|---|---|---|---|
| 1. Size | Is headcount 50 or more? (If yes, you clear the size gate.) | 50+ FTE clears the size gate on its own | Counting only the local entity and ignoring group headcount | - |
| 1. Size | OR does turnover AND balance-sheet total BOTH exceed EUR 10 million? | Both figures must exceed EUR 10m - it is conjunctive, not either/or | Reading it as turnover OR balance sheet - one alone does not clear it | - |
| 1. Size | Have you applied partner / linked-enterprise aggregation (e.g. VC ownership) first? | Aggregate owned and linked entities under the SME rules before answering | A 20-person startup that is majority-owned counts the parent's figures and is in scope | - |
| 2. Service | Does the service meet Article 6(30): on-demand administration of a scalable and elastic pool of shareable computing resources? | Cloud computing per Art 6(30) - on-demand, elastic, shared | Assuming any hosted software counts - a fixed single-tenant app is arguable | - |
Preview only. The download is a fully editable .xlsx file.
Go deeper
See how this template fits the wider readiness work, and where we pick it up on a live engagement.
Explore the related serviceMore resources