Assessment · NIS2 compliance
The European NIS2 directive significantly broadens the range of companies subject to cybersecurity obligations, and many executives discover only late that it applies to them. It no longer targets only large critical operators: many small and mid-sized businesses are now in scope, either directly because they operate in a regulated sector, or indirectly as a link in a critical supply chain.
This self-assessment helps you place your organisation. In five questions about your type of establishment, your sector, your headcount and your financials, it indicates whether you likely fall into the "essential entity" or "important entity" category, or appear to be out of scope. The reasoning follows the French transposition currently under way, and it is returned to you point by point.
One methodological note, because it matters: this result is provided strictly for guidance. It is neither legal advice nor a decision by the competent authority, and it does not replace the analysis of a qualified adviser. It gives you a reliable starting point to open the right internal conversation, not a binding verdict.
Select the answer that best matches your situation. Nothing is stored until you request the detailed report.
This self-assessment tool is provided for information only and constitutes neither legal advice nor a decision of the competent authority. The final classification of an entity under NIS2 depends on the applicable regulations and, where relevant, on ANSSI (the French national cybersecurity agency). The French transposition of Directive (EU) 2022/2555 is still under way and continues to evolve: this content, which reflects the stated reference date, must be confirmed with an official source or legal counsel before drawing any conclusion.