NIS2 scope check
Three questions, an initial steer. It points to whether you are likely in scope directly, indirectly via your customers, or not at all. The formal assessment is made by a lawyer or authority. Based on the Swedish Cybersecurity Act, the transposition of NIS2.
About the NIS2 scope check
What it does
Three things are weighed: size, sector under Annexes I and II, and whether you sell to entities that are themselves in scope. The outcome points to direct, indirect or out of scope, with next steps.
Essential or important entity
Essential entities (Annex I, 250+ employees) face proactive supervision and the highest penalties. Important entities (50–249, or Annex II) have the same requirements but reactive supervision.
What it is not
A quick test, not legal advice. The formal assessment is made by a lawyer or authority. The check stores no data.
Common questions
What is the difference between an essential and an important entity?
Both must meet the same security requirements under Article 21(2). The difference is supervision: essential entities (Annex I sectors, 250+ employees) face proactive supervision and higher penalties; important entities (50–249 employees, or Annex II sectors) face reactive supervision.
Are we in scope with fewer than 50 employees?
Generally not directly. But customers in regulated sectors can require documented security from you through the supply-chain rule in Article 21(2) d, so it is worth being prepared.
What is the Cybersecurity Act?
It is the Swedish transposition of the EU NIS2 Directive (2022/2555). It sets cybersecurity and incident-reporting obligations for essential and important entities.
Is this legal advice?
No. This is a guidance check, not legal advice. Consult a lawyer for the formal answer.