Are you in scope for NIS2?
Annex I: energy, transport, banking, financial markets, health, drinking and waste water, digital infrastructure, managed ICT, public administration, space. Annex II: postal, waste, chemicals, food, manufacturing, digital providers and research.
Result
Important entity
Supervision
Reactive, on report or incident
Maximum fine
Up to 1.4% of worldwide turnover
Size is not the last word: a small company is still in scope if it is the sole provider of an essential service, if its failure would have systemic impact, or if the authority names it directly. When in doubt, check the national register, not the table.
Frequently asked questions
Who falls under NIS2 and what changes
What is the difference between an essential and an important entity?
The security duties are the same; supervision and fines differ. Essential entities face proactive supervision, meaning audits and inspections with no incident required, and fines up to 2% of worldwide turnover. Important entities are supervised after a report or an incident, with a 1.4% ceiling.
Can a small company still be in scope?
Yes. Size thresholds are the general rule, not the only criterion. Sole providers of an essential service in an area, entities whose disruption would have systemic effects, public communication network providers and trust service providers are in scope regardless, along with anyone the authority names directly.
We supply a NIS2 entity: does it affect us?
Indirectly, almost always. The directive requires entities in scope to manage supply chain risk, so the requirements reach you through contracts: questionnaires, security clauses, incident notification deadlines. You are not the one fined, but your customer will ask you to comply.
What do you actually have to do?
Register with the national authority, adopt proportionate risk management measures, and report significant incidents within the directive tight deadlines, an early warning within hours and a fuller report later. Management bodies are personally accountable for the adequacy of the measures.
We supply an entity in scope: does it reach us?
Indirectly, nearly always. The directive makes entities in scope manage supply chain risk, so the requirements arrive through contracts: questionnaires, security clauses, notification deadlines. The fine is not yours, but the business can be.
Does my data stay private?
Yes, and not because we promise it: this tool runs entirely inside your browser. What you type or upload never leaves your device, so it never reaches a server of ours and there is nothing we could keep, read or lose. You can check it yourself: open the page, disconnect from the internet, and the tool keeps working.
Do you store what I enter?
No. There is no database behind this tool: we do not store your files, your text or your results. When you close the tab nothing is left — not here with us, because it never arrived, and not anywhere else.
Do you profile me? Are you GDPR compliant?
We do not profile you: there is no account to create, we never ask for your email to use a tool, and we keep no profile of what you do. We are an Italian company and we work under the GDPR and the other European rules, with the privacy notice and the consent request in plain sight. One thing we say in full rather than hiding it behind a slogan: the ads on the page are Google's, and Google may use cookies to personalise them. You decide from the consent banner: if you say no the ads stay, but they are not personalised, and the tool works exactly the same.
If it is free, how do you make money?
From the ads on the page, and that is all. We do not sell your data, there is no hidden paid plan, there is no limit that eventually asks for your card, and you do not have to sign up. The ads pay for the servers and for the time we spend writing the tools: that is how we can keep them open to everyone.