NIS-2 Compliance, Platform-Driven Implementation

Are you in scope of NIS-2?

Scope follows from the BSIG, not from your industry alone. It is decided in four steps. Size alone obliges nobody, and sector alone does not either: both must come together, unless one of the size-independent special cases applies. The legally binding classification remains a matter for a law firm; we provide the professional basis for it.

• Step 1, activity: does your concrete activity fall under Annex 1 or Annex 2 BSIG? What counts is the activity, not the industry label.
• Step 2, size under § 28 BSIG: at least 50 employees OR annual turnover and balance sheet total each above €10M. For the higher class: at least 250 employees OR turnover above €50M AND balance sheet total above €43M.
• Step 3, size-independent special cases: operators of critical installations, qualified trust service providers, TLD registries, DNS service providers and certain public telecommunications providers qualify regardless of size.
• Step 4, sector exemptions under § 28(5) and (6) BSIG: they do not remove the classification as an entity, they exempt from specific provisions. For DORA financial entities §§ 30, 31, 32, 35, 36, 38 and 39 BSIG fall away; telecommunications and energy supply networks and the telematics infrastructure follow their own regimes, but activity by activity and with counter-exceptions: whoever additionally operates critical installations falls back under the BSIG to that extent.
• Result: essential entity, important entity, or out of scope. Supplier status alone does not oblige you; whether you are in scope follows from your own activity and size under steps 1 to 3. Independently of that, the requirements reach you contractually, because § 30 BSIG requires your customer to manage supply chain risk.