You've heard about the NIS2 directive. Perhaps your CIO or legal department mentioned it in a meeting. But in practical terms, does it affect your organization? And if so, what does it really mean for you? This article gives you the criteria you need to check to find out, in clear, jargon-free language, taking into account the actual situation in France.
NIS2 is a European directive published on December 14, 2022 (EU Directive 2022/2555), with a clear objective: to sustainably raise the level of cybersecurity for organizations that are critical to the European economy and society.
Contrary to popular belief, it does not list technical solutions to be deployed. It imposes something much more fundamental: the ability to demonstrate that cyber risks are truly identified, managed, and controlled at the executive level.
NIS2 marks a significant break with its predecessor (NIS1). Whereas NIS1 targeted specific services, NIS2 targets entire entities. In concrete terms: if your organization is qualified, your entire relevant information system falls within the scope, not just a single isolated service.
⚠️ Important point for French companies
The European directive has been published and its principles established. However, France has not yet finalized its national transposition (the draft law on cyber resilience is currently being adopted). This means two things:
ANSSI has published a preliminary security framework, but this does not yet have the force of law. The best approach for French organizations is to align themselves with the European framework today, explicitly documenting the assumptions made about national procedures.
NIS2 qualification is not based on a single criterion. It is the result of a combination of three elements: size, sector, and actual role in the ecosystem. The final qualification is determined by the competent national authority, but the basic criteria are set at the European level.
The first filter is size. The directive explicitly refers to the European definition of SMEs (Recommendation 2003/361/EC). The correct rule is as follows:
An organization is potentially affected if it employs ≥ 50 people AND its annual revenue OR total balance sheet is ≥ €10 million.
It is not an "either/or" between employees and revenue. It is an "and": both conditions must be met in order to reach the size threshold.
Concrete example: A company with 60 employees, €8 million in revenue, and €7 million in total assets does not exceed the size threshold. A company with 60 employees and €12 million in revenue does exceed it.
Below these thresholds, an organization is in principle outside the scope, but there are important exceptions to this rule (see below).
Important point for groups: size is assessed at the level of the legal entity, not at the consolidated level. A subsidiary may be subject to the rules even if the group is not, depending on its own workforce and figures. However, shared services, IT interconnections, and centralized governance may effectively broaden the scope.
The second filter is sector-specific. Even if you exceed the size thresholds, you are only affected if you operate in a sector listed in the directive (Annexes I and II).
Essential entities (EE): sectors whose unavailability would have a major systemic impact:
Significant entities (SEs): key sectors with a real but lesser systemic impact:
Key reminder: The classification between essential and important entities is not solely sector-based. It depends on the sector (Annex I = essential by default), size, and national decisions. The final classification is determined by the competent national authority, not by the organization itself.
Important note: Actual activity takes precedence over legal classification or NAF code. A company that considers itself to be "outside the sector" may well be subject to taxation depending on what it actually produces or does.
This is the criterion that is most often overlooked: certain categories of organizations are covered by NIS2 regardless of their size ( Article 2, §2 and §3 of the directive).
These include:
For these categories, the size criterion does not apply. A micro-enterprise providing critical DNS services may be fully subject to NIS2.
Beyond size and sector, NIS2 takes into account the actual role of an organization in the ecosystem. The directive targets entities whose disruption could have a significant impact on the provision of an essential service.
An organization that is usually outside the scope may be included if it:
Important nuance: Unlike size or sector, role in the ecosystem is an operational interpretation, not a legal criterion that can be directly enforced by the organization. It applies primarily through designation by the competent authorities.
Digital service providers occupy a special place in NIS2, and many underestimate their exposure.
These actors may be directly subject to the directive, not only as providers of affected customers. This includes, in particular: cloud service providers, data center operators, managed service providers (MSPs), managed security service providers (MSSPs), and DNS service providers.
For these entities, the directive is supplemented by a directly applicable European implementing regulation (without waiting for national transposition), which describes specific operational expectations tailored to multi-client and pooled services. This text applies immediately, regardless of the transposition status of each Member State.
Double exposure: These service providers are both potentially subject to regulation as entities and subject to increased contractual requirements from their clients who are themselves subject to regulation.
The distinction between essential entities (EE) and important entities (IE) does not only apply to sectors. It determines the applicable supervisory regime, with significant differences:
What being an EE means in practical terms: the authorities can inspect your organization even if there has been no incident. Evidence of cyber management must therefore be available at all times, not just in a crisis situation.
A frequently used phrase deserves clarification: NIS2 does not only penalize the lack of justification for choices. It primarily penalizes the lack of appropriate cyber risk management measures.
The directive provides for:
That said, the ability to justify choices in a proportionate and documented manner remains key: an organization that has made informed, traceable decisions consistent with its actual risks is much better positioned than an organization that has accumulated controls without a clear rationale.
Field experience shows two symmetrical shortcomings:
Underqualification:
Overqualification:
If your organization is subject to these requirements, the obligations cover four main areas defined by the European text:
Each block involves concrete evidence, not mere statements of principle. As an essential or important entity, you must be able to present them at any time, without waiting for an incident to occur.
👉 Not sure where your organization stands with NIS2? Take our free NIS2 self-assessment and get an initial assessment of your exposure and priorities.
2025 FeelAgile
