Is your company inside the scope of NIS2? Find out in 15 minutes.

No. NIS2Ready is not an accredited certification body, notified body or public authority, and we do not perform statutory audits. We provide a self-assessment tool and supporting documentation that helps you understand your likely NIS2 status and gaps. It does not replace an official audit, a conformity assessment, or advice from a qualified lawyer in your jurisdiction.

It depends on your sector and size. NIS2 covers 18 sectors split into Annex I ("high criticality": energy, transport, banking, health, digital infrastructure, public administration, and more) and Annex II ("other critical": food, chemicals, manufacturing, digital providers, postal services, and more). In general, medium enterprises (50+ staff or over €10M turnover) and large enterprises (250+ staff or over €50M turnover) in these sectors are in scope, regardless of whether you feel like a "critical infrastructure" company. Some entities — DNS providers, TLD registries, trust service providers, public electronic-communications providers — are in scope regardless of size. Our diagnostic applies these rules to your specific situation in about 5 minutes.

Two separate risks. First, financial penalties: essential entities face fines of up to €10,000,000 or 2% of total worldwide annual turnover, whichever is higher; important entities face up to €7,000,000 or 1.4%. Second, and often overlooked, Article 20 of the directive makes your management body personally responsible for approving and overseeing cybersecurity risk-management measures — national laws can impose personal sanctions on directors, including temporary bans from management roles, for serious or repeated non-compliance.

We would not recommend it. Several member states, including Germany and Poland, already have national NIS2 laws in force. Others, including Spain and France, were still finalising their transposition as of mid-2026, after the European Commission sent reasoned opinions to 19 member states in May 2025 for missing the original deadline. Once your national law enters into force it typically applies to your existing security posture, not to a project plan you haven't started — starting your gap-analysis now avoids a scramble later.

Enterprise GRC and compliance-automation platforms are built for large organisations with integration budgets and commonly list from roughly €7,000 to well over €100,000 per year. NIS2Ready is a self-service rules engine: you answer structured questions about your sector, size and current measures, and our engine — built directly on NIS2's Annex I/II classification rules and Article 21 risk-management measures — returns your likely classification and a prioritised gap list in minutes, from €79 one-off. It is a first-pass diagnostic, not an enterprise platform replacement.

No. Your report gives you a prioritised, plain-language list of what NIS2's Article 21 measures require and where your current setup falls short, so your own IT team, CISO or an external specialist can act on it directly. We are not a certifying or auditing body and we do not implement technical controls on your systems.

It is a structured first-pass gap-analysis built on NIS2's own classification rules (sector, size, special-case entities) and the risk-management measure categories in Article 21. It is reliable for figuring out whether you are likely in scope and which broad areas need attention. It is not a substitute for a full technical audit, a legal opinion, or a certified conformity assessment — for essential entities or complex multi-country groups, use your report as the starting brief for that deeper review, not as its replacement.