Czy moje przedsiębiorstwo podlega NIS2?
To determine whether your company falls under the NIS2 Directive depends on two things: the sector in which you operate and the size of your organization. The Directive identifies in two annexes sectors that it considers important for society or the economy, ranging from energy and transport to digital infrastructure and wastewater management. If your company falls within such a sector and meets the size requirements set out in the Directive, you are likely yourself a 'critical' or 'important' entity, with all the associated obligations.
But the answer does not stop there. Many more companies fall outside the sector and size criteria, yet they still face the requirements: as a supplier, installer or service provider to a company that is regulated. Those regulated organizations must assess their own supply chain, and this translates into questionnaires and contractual requirements for companies that themselves never need to register with a supervisory authority.
Sector: Annexes I and II
The Directive lists sectors in two annexes. Annex I names the sectors considered critical: including energy, transport, banking, drinking water, digital infrastructure and public administration. Annex II names sectors considered important, such as postal and courier services, waste management, chemicals, food and certain digital services. An installation company, an IT service provider or a consulting firm does not usually appear by name in these annexes, but the descriptions are broader than the name suggests. Anyone unsure whether their activities fall under one of these sectors should read the description in the official text itself, not just the sector name.
Size: when your company counts
In addition to the sector, the Directive looks at the size of the organization, using the standard EU classification of micro, small, medium and large enterprises based on staff numbers and revenue or total assets. For most sectors, the rule is: the larger the enterprise, the sooner it falls within the scope. There are also exceptions where size matters less, for example when an organization is the only provider of a particular service in a country. These exceptions are precisely defined in the Directive and in the national law on which it is based; making an exact assessment for your own situation is up to you, your lawyer or the supervisory authority.
The largest group falls outside, and still faces the requirements
The part of the Directive that attracts the most attention concerns the risk management obligation: regulated organizations must take appropriate measures and also assess their suppliers. This is exactly what the largest group of companies has to deal with. An installation company that maintains building management systems for an energy company, a cleaning company that works for a hospital, or an IT partner of a municipality: none of them need to register themselves, yet all of them could receive a questionnaire. In practice, this is often called 'supply chain exposure': you do not fall under the Directive yourself, but a customer who does may still ask you to demonstrate that your security is in order.
Whether this applies to your company depends on who your customers are and how important your service is to them. This is difficult to estimate without an overview of sector, size and supply chain role all at once. In a few questions you will see roughly where your company stands, with an explanation of why and a suggestion for the next step.
Financial institutions: a separate framework
Banks, insurers and other financial institutions do not fall under NIS2 but under a separate regulation on digital operational resilience, aimed specifically at the financial sector. Those active in that sector typically recognize this already in the first intake question about the sector.
What to do if the answer is not clear
Sector and size together give a good initial indication, but the precise boundary between 'critical', 'important', 'supply chain exposure' and 'not affected' requires tailored consideration. The knowledge base with all topics per situation podaje wyjaśnienie dla każdego pojęcia i wskazuje na jego źródło w tekście oficjalnym. Jeśli po przeczytaniu tego artykułu wciąż mają Państwo wątpliwości, właściwą stroną do oceny Twojej konkretnej sytuacji jest prawnik lub organ nadzoru w Państwa kraju; secria.eu celowo się tam nie wypowiada.
Chcesz najpierw wiedzieć, skąd pochodzą informacje na tej platformie i jak są aktualizowane? Przeczytaj tutaj, jak śledzisz źródła. Odpowiedzi na praktyczne pytania dotyczące korzystania z platformy znajdziesz w przeglądzie często zadawanych pytań.
Krótką odpowiedź na pytanie "czy moja firma podlega NIS2" otrzymasz zatem zestawiając obok siebie sektor, skalę i rolę w łańcuchu dostaw. Zrób darmową kontrolę i przeczytaj bazę wiedzy; już bez konta dadzą Ci one wstępny, uzasadniony obraz tego, gdzie stoi Twoja firma.