Am I in scope of the Cybersecurity Act? How to work it out

The most common question about NIS2 is also the simplest: does it apply to me? The answer depends on two things, your sector and your size, with a third factor that is often forgotten: your position in the supply chain.

Step 1: your sector

The law designates sectors seen as essential or important. Think of energy, transport and logistics, drinking water and waste water, digital infrastructure, healthcare, government, postal and courier services, waste management, chemicals, food and parts of manufacturing and digital services.

If you fall outside that list, the law does not apply to you directly. That is not the same as having nothing to do with it. See step 3.

Step 2: your size

Within the designated sectors a threshold applies that in practice works out at roughly 50 staff or 10 million euro in turnover and balance sheet total. Large organisations fall in the heaviest category, medium-sized ones in the lighter one. For some types of organisation the threshold does not apply and you are in scope regardless of size, for example with certain digital infrastructure.

Important: you look at the whole enterprise, including group structures. A small company within a larger group can still count.

Step 3: your position in the chain

This is where practice lives. Organisations in scope have to assess their supply chain, and they pass that on contractually. If you supply a hospital, a grid operator, a large logistics company or a government body, you get questionnaires and clauses, even at twenty staff.

Anyone who cannot answer those questions drops out of tenders. That is a more direct effect than a regulator's fine will ever be.

The outcomes and what to do

There are three outcomes:

• Applies directly. Start with a baseline assessment and an action plan, and set up the incident process with the 24- and 72-hour deadlines.
• Applies indirectly. Record your measures so you can answer questionnaires and sign clauses without risk.
• Does not apply. Keep the basics in order (MFA, backup with tested recovery, patch management, awareness) and reassess annually; sector lists and thresholds can change.

Borderline cases we see often

A manufacturer supplying the food industry: not designated itself, but a chain partner is. An IT service provider with 30 staff: covered by digital services, but below the threshold, while customers demand evidence regardless. A healthcare practice with 15 staff: sector designated, size below, but with patient data the GDPR already weighs heavily.

In all those cases the conclusion is the same: the measures make sense, the recording is the work.