Vzťahuje sa na moju spoločnosť smernica NIS2?
To determine whether your company falls under the NIS2 Directive depends on two things: the sector in which you operate and the size of your organization. The Directive identifies in two annexes sectors that it considers important for society or the economy, ranging from energy and transport to digital infrastructure and wastewater management. If your company operates within such a sector and meets the size threshold that the Directive uses, you are likely a 'critical' or 'important' entity yourself, with all the associated obligations.
But the answer does not stop there. Many more companies fall outside the sector and size criteria, yet still face the requirements: as a supplier, installer or service provider of a company that is subject to the Directive. Those subject organizations must assess their own supply chain, and this translates into questionnaires and contractual requirements for companies that themselves never need to register with a competent authority.
Sector: Annex I and II
The Directive lists sectors in two annexes. Annex I names the sectors considered critical: including energy, transport, banking, drinking water, digital infrastructure and public administration. Annex II names sectors considered important, such as postal and courier services, waste management, chemicals, food and certain digital services. An installation company, an IT service provider or a consulting firm is usually not mentioned by name in those annexes, but the descriptions are broader than the names suggest. Anyone in doubt whether their activity falls under one of these sectors is well advised to read the description in the official text itself, not just the sector name.
Size: when your company counts
In addition to the sector, the Directive looks at the size of the organization, using the standard EU classification of micro, small, medium and large enterprises based on staff and turnover or total assets. For most sectors, the rule is: the larger the enterprise, the more likely it falls within the scope. There are also exceptions where size matters less, for example when an organization is the only provider of a particular service in a country. These exceptions are precisely defined in the Directive and in the national law based on it; an exact assessment for your own situation is for you, your legal advisor or the competent authority to make.
The largest group falls outside, and faces the requirements anyway
The part of the Directive that attracts the most attention concerns the security obligations: subject organizations must implement appropriate measures and also assess their suppliers in doing so. This is precisely where the largest group of companies is affected. An installation company maintaining building management systems for an energy company, a cleaning company working for a hospital, or an IT partner of a municipality: none of them need to register themselves, but all of them may receive a questionnaire. In practice, this is often called 'supply chain-affected': you do not fall under the Directive yourself, but a customer who does is still asking you to demonstrate that your security is in order.
Whether this applies to your company depends on who your customers are and how important your service is to them. That is difficult to estimate without an overview of sector, size and supply chain role all at once. In a few questions you see where your company roughly stands, with an explanation of why and a suggestion for the next step.
Financial institutions: a separate arrangement
Banks, insurers and other financial institutions do not fall under NIS2 but under a separate regulation on digital operational resilience, aimed specifically at the financial sector. Anyone active in that sector typically recognizes this from the first intake question about the sector.
What to do if the answer is not clear
Sector and size together give a good first indication, but the precise boundary between 'critical', 'important', 'supply chain-affected' and 'not affected' requires tailored analysis. The knowledge base with all topics per situation poskytuje vysvetlenie ku každému pojmu a odkazuje na miesto v oficiálnom texte. Ak máte aj po jej prečítaní pochybnosti, na posúdenie vašej špecifickej situácie je príslušná osoba právnik alebo orgán dohľadu vo vašej krajine; secria.eu sa na túto otázku vedomie nevyjadruje.
Chcete najprv vedieť, odkiaľ pochádzajú informácie na tejto platforme a ako sa udržiavajú aktuálne? Prečítajte si tu, ako udržiavame zdroje. Odpovede na praktické otázky týkajúce sa používania platformy nájdete v prehľade často kladených otázok.
Krátku odpoveď na otázku "spadá môj podnik pod NIS2" teda získate porovnaním sektora, veľkosti a úlohy v reťazci vedľa seba. Vykonajte bezplatnú kontrolu a prečítajte si knižnicu vedomostí; bez účtu vám už poskytnú prvý podložený obraz o tom, kde sa váš podnik nachádza.