Does the enterprise itself fall under the NIS2 Directive or its national transposition?

Sector and size together determine the outcome

Whether the enterprise falls under the Cybersecurity Act depends on two things: the sector in which it operates and its size. The act works with a list of sectors — including energy, transport, drinking water, digital infrastructure, healthcare and a number of industrial and digital services — and within those sectors there is a classification by size: medium-sized or larger generally counts, with the number of employees and annual turnover or total assets as the measure. If the enterprise falls outside the designated sectors, the Cybersecurity Act is generally not applicable, regardless of size.

There are two aspects that are often confused. The first is: does the enterprise fall directly under it, as a so-called essential or important entity. The second is: is it indirectly affected, because a customer who is themselves subject to the act imposes requirements in the supply chain. The latter can also apply to companies that are too small or operate in a non-designated sector. This search question concerns the first aspect — the direct obligation — and the answer to it is not yet certain as long as the final text and the associated sector list have not been checked against the name and figures of the enterprise itself. Whoever has already answered that question with certainty — with or without direct obligation — often still encounters the same questions in practice as when a customer asks about it, for example whether there is a policy for risk analysis and the security of information systems or whether multi-factor authentication has been established.

Where this is evident: the sector and size criteria

This classification follows from the Cybersecurity Act, the Dutch transposition of NIS2, which enters into force on 15 August 2026. The act itself, with the annexes containing the sectors and size thresholds, is the designated source to measure the enterprise against; this text can be found at wetten.overheid.nl.