Does NIS2 apply to mid-sized companies?

In general, NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. applies to entities in the sectors of its Annexes I and II that are at least medium-sized under Recommendation 2003/361/EC (50 or more employees, or an annual turnover and a balance sheet total both above EUR 10 million) and to some entities regardless of size. Your national authority or legal counsel can confirm whether your organisation is in scope.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

This answer also appears, with more context, here: NIS2 network monitoring

← All 40 questions on NIS2 scope and dutiesAll topics