- Home
- Suite features
- NIS2 cockpit
NIS2: essential, important or out of scope, then the ten measures
The NIS2 compliance tool in the Regingada Compliance Suite follows Directive (EU) 2022/2555, the EU's cybersecurity law for 18 sectors. It indicates whether an entity is essential, important or out of scope (Arts. 2-3), then opens the ten Art. 21(2) measures, a supplier register and a fine calculator — from the Directive, not national law.
- NIS2 · Art. 3 classification
- Art. 21(2)(a)-(j) · ten measures
- Art. 34 · fine maximum
- Art. 26 jurisdiction · not modelled
- National transposition · not modelled
Is our entity in scope of NIS2, and in which tier?
Four facts decide the first pass: whether the entity provides services or carries out activities in the Union, its sector (Annex I, such as energy, banking or ICT service management; Annex II, such as manufacturing or digital providers), its size (medium-sized upwards; all three Art. 2(1)) and whether its type is caught regardless of size.
Large Annex I entities are essential (Art. 3(1)(a)); most other in-scope entities are important (Art. 3(2)). The cockpit indicates a draft badge from the last three facts; the first it leaves to you.
For non-EU companies, an EU customer's questionnaire citing Art. 21 may raise the question first. The NIS2 requirements behind it — Arts. 20, 21 and 23 — apply in both tiers; the essential vs important split changes supervision and fines. An out-of-scope badge keeps the matrix closed.
From the first click to the Art. 21 matrix
Open /suite/#nis2. Portfolio, matrix and registers sit behind the NIS2 sidebar, without URLs of their own.
- Confirm the legal notice. First visit only; it rules out legal advice and any attorney-client relationship.
- Pick the NIS2 card. Choose "NIS2 · Cyber Security" on the welcome screen; with no quick check, the cockpit opens directly.
- Add an entity. In "Entity Portfolio", enter a name, one of 18 sectors (11 Annex I, 7 Annex II), a size band and, where it fits, the box "Specific entity (size-independent · Art. 2(2)(b)-(f) NIS2)".
- Read the classification. "Classification (Art. 3)" shows the tier, the Art. 20 banner and, for banking or financial market infrastructures, a note that the Digital Operational Resilience Act (DORA) may take precedence as the more specific law.
- Work the sub-cockpits. Once the first entity in your portfolio is essential or important, four sidebar sections open: Risk Management, Incident Reporting, Supply Chain, Supervision + Fines.
What the NIS2 compliance tool records, and on which legal basis
| Capability | Legal basis | Output |
|---|---|---|
| Entity classification | Arts. 2-3, Annexes I and II | Badge per entity: essential, important, out of scope |
| Obligation cards | Arts. 20-23, 26-27, 31-34, as cited on the cards | Seven cards: legal text, tasks, GDPR, AI Act and DSA cross-references |
| Ten-measure matrix | Art. 21(2)(a)-(j) | Implemented, Partial, Open or N/A per measure, a justification, overall maturity in % |
| Supplier register | Art. 21(2)(d) and 21(3) (sidebar label: Art. 21/22) | Supplier, category, risk rating, audit status, risk overview |
| Incident register | Art. 23(4) | 24h, 72h and 30-day countdowns, all from awareness (Art. 23(4)(d) counts one month from the 72h notification); see NIS2 incident reporting |
| Supervision + fines | Arts. 3(3)-(4) and 27 (registration), 31-33, 34(4)-(5) | Six-point readiness list (the suite's own), registration status, Art. 34 figure for the tier shown |
A checklist with a status per line
A NIS2 compliance checklist usually means the NIS2 Article 21 measures. Implemented counts one, Partial half, Open zero; N/A drops out of the base. No authority recognises the percentage as a rating.
A hypothetical US managed service provider
Take a hypothetical US managed service provider: 180 staff, €35 million turnover, customers in Germany and the Netherlands, no EU establishment.
In Entity Portfolio it chooses "ICT service management (B2B)", an Annex I sector, and "Medium (≥50 staff or >€10M)": the badge reads Important entity (Art. 3(2)). "Large" would give Essential.
Its security lead marks four measures implemented, among them (j) multi-factor authentication, four partial, including (d) supply chain security, and two open, (f) and (h): the matrix shows 60%. The supplier register holds a cloud host rated high risk, a monitoring-software vendor and a network carrier.
The calculator returns €7 million, since 1.4% of €35 million is €490,000; below €500 million turnover the fixed amount prevails in both tiers.
The cockpit does not touch Art. 26(3): without an EU establishment, this managed service provider may need a representative, whose seat decides the supervising Member State. The badge stays a draft until scope is confirmed; the incident clock runs on the NIS2 incident reporting page.
What the NIS2 cockpit leaves out
- Size is self-selected from band labels with simplified thresholds; check yours against Recommendation 2003/361/EC. The classifier takes no headcount, turnover or balance-sheet figures (the calculator's turnover does not feed it) and ignores linked or partner enterprises.
- No category rules. The size-independent box cites Art. 2(2)(b)-(f) and rates every ticked entity essential, a shortcut not explained on screen. In the Directive, DNS, TLD and qualified trust service providers are essential at any size (Art. 3(1)(b)), public electronic communications providers from medium size (Art. 3(1)(c)); Art. 2(2)(b)-(e) entities follow a Member State's identification (Art. 3(1)(e), 3(2)). Unticked, a small "Digital infrastructure" entity shows as out of scope, a medium one as important.
- One tier, one set of records. With several entities, classification, cards and sub-cockpits follow the first entity entered, not the highest tier. Matrix, registers, readiness list, turnover and registration status are one set per browser, shared by all entities, kept when one is removed. Assess one entity at a time; "Delete profile" clears everything.
- No Art. 26 logic: the "Operates cross-border" flag is stored, not used; main establishment, jurisdiction and the representative duty go untested.
- The matrix stays at the ten Art. 21(2) headings, without Implementing Regulation (EU) 2024/2690 detail or a mapping to ISO/IEC 27001, NIST CSF or SOC 2.
- NIS2 supply chain security is a register here: no contract clauses, questionnaires or supplier assessments.
- No export. Entities, statuses and suppliers live in this browser only, with no account; the Trust Center sets out data handling.
Frequently asked questions
What is the difference between an essential and an important entity under NIS2?
Supervision and fines, not the core duties: both owe Arts. 20, 21 and 23. Essential entities, mainly large Annex I entities plus certain types regardless of size (Art. 3(1)), face proactive supervision (Art. 32) and a higher fine threshold (Art. 34(4)-(5)). Other Annex I or II entities in scope are important (Art. 3(2)) and supervised after the fact (Art. 33).
Which company sizes fall under NIS2?
Medium-sized enterprises and larger in Annex I or II sectors that provide services or carry out activities in the Union (Art. 2(1)): under Recommendation 2003/361/EC, 50 or more staff, or turnover and balance-sheet total both above €10 million, counting linked and partner enterprises as a rule. TLD registries, DNS, trust service and public electronic communications providers are caught at any size (Art. 2(2)(a)); the cockpit has no rule for them.
What are the ten minimum measures of NIS2 Article 21?
Points (a) to (j) of Art. 21(2): risk analysis and information system security policies; incident handling; business continuity and crisis management; supply chain security; security in acquisition, development and maintenance, including vulnerability handling; assessing effectiveness; cyber hygiene and training; cryptography; HR security, access control and asset management; multi-factor authentication and secured communications. The matrix records one status per point.
Can management be held personally liable under NIS2?
Yes — Member States must provide for it. Management bodies approve and oversee the Art. 21 measures, can be held liable for the entity's infringements of that Article (Art. 20(1)) and must be trained (Art. 20(2)). At essential entities, the authority can, as a last step, request a temporary ban on managerial functions at CEO or legal-representative level (Art. 32(5)(b)); such persons must be capable of being held liable (Art. 32(6)).
What are the maximum NIS2 fines?
For infringements of Art. 21 or 23, national maximum fines must reach at least €10 million or 2% of worldwide annual turnover for essential entities, €7 million or 1.4% for important ones, whichever is higher (Art. 34(4)-(5)); turnover is the undertaking's, for the preceding financial year. The figure the suite labels "Maximum fine (Art. 34)" is this minimum: Member States may set more, and it is not an expected fine.
Does NIS2 apply to suppliers of EU companies?
Not through the supply relationship alone: NIS2 addresses entities in scope. In-scope customers must cover supply chain security and weigh each direct supplier's vulnerabilities and practices (Art. 21(2)(d), 21(3)), which typically reaches suppliers through questionnaires and contract clauses. Whether your company is itself in scope is a legal question for the law firm Theo Funk.
Does the suite handle national NIS2 transposition?
No. NIS2 is a directive; its duties reach an entity through national law, to be adopted by 17 October 2024 and applied from 18 October 2024 (Art. 41(1)). The cockpit follows the Directive, not national portals, deadlines, fine levels or sector additions. The German route — registration with the Federal Office for Information Security (BSI) and a representative — is on our NIS2 representative page.
Three inputs give a badge; scope needs a legal finding
Your three answers each hide a judgement: does your service fit an Annex I or II description, is your group medium-sized once linked enterprises count, has a Member State identified you? Whether you serve the Union at all, the NIS2 compliance tool never asks.
If your entity is one of the Art. 26(1)(b) types, among them managed service, DNS and cloud providers, has no establishment in the Union and offers services in Germany, Regingada UG (haftungsbeschränkt), established in Bamberg, can hold the role of NIS2 representative under Article 26(3); the entity is then deemed to fall under German jurisdiction.
Those judgements call for legal assessment, which the law firm Theo Funk can provide under a separate mandate. "Mandate Packages" in the sidebar starts with package A, a scoping and classification opinion, listed even for an out-of-scope badge.