NIS2 is the European directive that sets requirements for cybersecurity in organizations in certain sectors. Whether the directive applies directly to your business depends on two things: the sector in which you operate and the size of your enterprise. If you do not fall under that combination, you are likely not a direct target group of the directive, but that does not mean NIS2 will never affect you.
Many businesses that fall outside the scope themselves nonetheless receive questions about cybersecurity from a customer who does fall under NIS2. That customer must demonstrate that its entire supply chain is sufficiently secure, and therefore sends a questionnaire to its suppliers. In that case, the directive does not apply to you, but the contractual agreement that your customer links to it does.
Sector and size determine direct obligation
The directive focuses on what it calls "essential" and "important" entities: organizations in sectors such as energy, transport, drinking water, digital infrastructure, banking and healthcare, supplemented by a number of other sectors listed in the directive itself. In addition, size criteria apply, which may differ by sector and by category. A small installation business with no role in any of these sectors typically falls outside the direct scope of NIS2. The exact sector list and the way in which Member States have transposed this into national legislation can be found in the official text and with the supervisory authority designated in your country; in the Netherlands, this is the Dutch Digital Infrastructure Inspectorate.
Also outside the sector: the request from your customer
A business that does fall under NIS2 must, among other things, assess how secure the organizations are with which it collaborates. This is called supply chain risk or supplier risk, and the directive explicitly mentions this as a point of attention. In practice, this translates into a questionnaire or a contractual provision from your customer: do you have a point of contact for incidents, do you report a data breach within a certain timeframe, have you arranged access controls. These are often the same kind of measures as the ten that the directive itself mentions for businesses that fall directly under it. For more information on what these questions precisely mean and how they relate to existing obligations such as the GDPR, you can read the explanation per topic in the knowledge base.
How to assess this for yourself
Whether NIS2 applies directly to you is a factual question that you can best answer by referring to the official sector classification and size criteria as transposed in your country. If you are in doubt, the competent supervisory authority or a lawyer is the appropriate party to make that assessment; this article cannot replace that assessment. What you can quickly assess yourself is whether you are receiving signals that point to indirect involvement: a customer who has just sent a questionnaire on cybersecurity, a contract that refers to reporting obligations, or a tender in which security measures are requested. These are practical indications, not a legal judgment.
What if you do receive questions, regardless of direct obligation
Whether you fall directly under NIS2 or only encounter the consequences through a customer, the questionnaire itself does not change much: you are asked to describe what measures you have taken and to substantiate this. This often overlaps with what you have already documented for other purposes, such as access controls for GDPR compliance or emergency procedures for business continuity. It is this overlap that means businesses must repeatedly submit the same kind of supporting documents, each time in yet another format. You can find answers to frequently asked questions about how these kinds of questionnaires work in the frequently asked questions about questionnaires, and an explanation of where the information on this site comes from can be found on the page on how it works.
There is no authority that determines for you whether NIS2 applies to your business; that remains an assessment that rests with you, your legal advisor or the supervisory authority. What you can do quickly, however, is check whether the signals you recognize match a direct or indirect involvement. If you want to see that clearly side by side, you can get an indication in a few questions of where you stand, or calmly review the topics that may apply to your situation.