Can a small subsidiary be in NIS2 scope because of its group?
Yes, it can. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. measures size with the EU definition of small and medium-sized enterprises (Commission Recommendation 2003/361/EC), under which the staff, turnover and balance sheet of partner and linked enterprises are generally added to the company's own figures. A 30-person subsidiary of a large group can therefore count as large and fall within scope if its activity is in a listed sector. National laws may soften this: Germany's section 28(4) of the BSIG, for example, does not add the group's figures if the company is independent of its partner or linked enterprises in how its IT systems are designed and run. Map each legal entity in the group, its sector and its group figures, check the national rules in each country where it operates, and record the result.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.