Who NIS2 covers: the size-cap rule and size-independent entities, essential versus important classification, the Annex I and II sectors, sector-specific laws that displace NIS2, and which Member State has jurisdiction.
The NIS2 scope test: the size-cap rule tied to the EU SME definition, the entity types covered regardless of size, optional extensions to local government and education, and the exclusions for national security, defense and DORA-exempted entities.
How NIS2 sorts in-scope entities into essential and important, what each category means for supervision and fines, the information entities must give authorities for the national list, and the two-week deadline for reporting changes.
When a sector-specific EU law with equivalent cybersecurity risk-management or incident reporting rules displaces NIS2, with DORA as the main example for financial entities, and the Commission's guidelines on applying the rule.
Which Member State supervises an entity: the general establishment rule, the main establishment rule for digital infrastructure and digital providers, and the duty for non-EU providers to appoint an EU representative.
The 11 Annex I sectors, from energy, transport and health to digital infrastructure, ICT service management and space, whose entities above the medium-sized ceilings are essential by default.
The 7 Annex II sectors, including manufacturing, food, chemicals, postal services, research and digital providers, whose in-scope entities are important unless a Member State designates them essential.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.