To scope NIS2, first decide whether your entity type is listed in Annex I or II of Directive 2022/2555 and meets the size rule, then decide which network and information systems and suppliers the Article 21 measures must cover. Your member state's national law applies the Directive, so check it for the final rules.
Are you in scope at all?
Article 2 says the Directive applies to public or private entities of a type referred to in Annex I or II that are medium sized enterprises or exceed those ceilings. Regardless of size, it also applies to certain listed entities in specific cases, for example where the entity is the sole provider in a member state of a service essential for critical activities. Some public administration entities are excluded. The recitals divide in-scope entities into essential and important, with different supervision and enforcement regimes, and say financial entities covered by DORA are generally governed by that regulation's ICT provisions rather than NIS2's risk management and reporting rules.
Limits of this guide: we read the Directive on EUR-Lex through the recitals and Articles 2, 21 and 23, but we did not confirm the transposition deadline or the Annex lists in detail. Each member state transposes the Directive, so read your national law and ask a lawyer where you are unsure.
What are the steps to scope?
- Identify your sector and entity type. Compare your services with the Annex I and II lists as transposed in each country where you operate. A company with entities in several member states may have several registrations.
- Check size. Apply the medium enterprise ceilings, remembering group and linked company rules in the EU definition.
- Check the size exceptions. Look at whether you are the sole provider of a critical service or in a category covered regardless of size.
- Classify as essential or important under national law, since supervision differs.
- Define the services. List the services you provide that put you in scope.
- Draw the system boundary. List the network and information systems that deliver those services, including development, administration and support paths. Recital 83 says obligations apply whether systems run in house or are outsourced.
- Map suppliers. Supply chain security is Article 21(2)(d) and the recitals call out suppliers' cybersecurity practices and secure development. List direct suppliers and managed service providers that can affect the in scope systems.
- Record the group structure and who in management is accountable.
What do the measures cover once scope is set?
Article 21(2) says measures must include at least these ten areas: risk analysis and system security policies, incident handling, business continuity including backup and crisis management, supply chain security, security in acquisition, development and maintenance, ways to assess the effectiveness of measures, basic cyber hygiene and training, cryptography and encryption policy, human resources security, access control and asset management, and multi-factor or continuous authentication with secured communications. Article 23(4) sets reporting of significant incidents with an early warning within 24 hours of awareness, an incident notification within 72 hours and a final report within one month after the notification.
What mistakes are common?
- Assuming a small headcount puts you out of scope without checking the exceptions.
- Treating the group as one entity when national registration is per entity.
- Scoping only production and leaving out management tooling and supplier access.
- Ignoring that DORA may apply to you instead for ICT rules.
- Waiting for the national law to settle before doing the hygiene basics.
What to do
- Match your services to the sectors in the national transposition for each country.
- Check size and the exceptions, and record the reasoning.
- Decide your essential or important status with counsel.
- List in scope systems, administration paths and suppliers.
- Map each Article 21(2) area to an owner and current evidence.
- Set up the 24 hour, 72 hour and one month reporting workflow.
Quick check
What are the NIS2 incident reporting deadlines?
Article 23(4) sets an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, and a final report within one month of the notification.
Does size alone decide if NIS2 applies?
No. Entity type matters, and some listed entities are covered regardless of size.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. Once scope is clear, evidence for the technical measures is collected from connected systems and code instead of by screenshot, and monitoring runs between reviews. For supply chain security and secure development, technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Supervisory authorities judge compliance, and Safeguard does not give legal advice. It helps you prepare and keep evidence ready. Book a call to see it.
Sources
- Directive (EU) 2022/2555 (NIS2), EUR-Lex, fetched 18 October 2026, recitals and Articles 2, 21 and 23
Last reviewed: 18 October 2026.
