NIS2 Scope Test and Obligations Register
Essential or important, Art 21 measures, Art 23 clock, fines, verified
Is your entity in NIS2 scope, essential or important? Size test, Art 21(2) register, Art 23 deadlines, Art 34 fine ceiling; every line cites its article.
Not on Gumroad yet: the store admits ten new listings a day and this one is in the queue. Follow below and the link arrives the day it goes live.
The price applies once the listing is live. Payment and VAT are handled by Gumroad, the merchant of record.
Directive (EU) 2022/2555 (NIS2) has applied through national law since 18 October 2024 (Art 41). This workbook answers the first question for one entity: is it in scope, and is it essential or important? Pick the entity type from the 68 Annex I and Annex II types, enter headcount, turnover and balance sheet total, and answer the size-independent questions (public electronic communications, trust services, DNS and TLD, public administration, Member State identification, critical entity, domain name registration, the Art 2(7) and 2(10) exclusions). The sheet applies the size ceilings of Recommendation 2003/361/EC and Art 2 and 3 of the Directive and states the point it relied on.
What follows from the answer: the supervisory regime (Art 32 for essential entities, Art 33 for important), the fine ceiling computed on the worldwide turnover you enter (Art 34(4): at least EUR 10 000 000 or 2 percent; Art 34(5): at least EUR 7 000 000 or 1,4 percent), the management body duties (Art 20), registration (Art 3(4), Art 27, Art 28) and the incident clock. The Register sheet lists the ten Art 21(2) measure areas in the Directive's wording plus nine other duties, each with its article and a status, owner, evidence and target date column, and counts progress. The Incident timeline sheet turns the moment of awareness into the 24-hour early warning, the 72-hour notification (24 hours for trust service providers) and the one-month final report of Art 23(4).
- Every figure the formulas read sits on a Rules sheet with its article; the Sources sheet links the Directive, the Recommendation and Implementing Regulation (EU) 2024/2690.
- 23 entity cases, three incident-clock cases and the register counts were recalculated with a formula engine and matched to an independent Python replica before listing.
- Live formulas, no macros, no locked cells; opens in Excel and Google Sheets. A working tool, not legal advice: Member State transposing laws and competent authority lists can change the answer for a given entity, and the Guide says where.
What is inside
1 Excel workbook (.xlsx), sheets: Scope test, Register, Incident timeline, Rules, Sectors (68 entity types), Guide, Sources.
Use it if
You run, advise or audit a company or public body that may be an Annex I or II entity type and need a defensible first answer on scope and classification, plus a register to manage the Art 21 measures.
Not for
You need a full gap assessment against a national transposing law or the Implementing Regulation's technical requirements; this workbook tests scope and classification and structures the register.
Sheet previews
How buying works
- Choose a licenceSingle user for one person, team for up to 10, consultancy to use with clients. The buttons above go to the Gumroad page.
- Pay on GumroadCard or PayPal; Gumroad is the merchant of record and handles VAT and the receipt.
- Download the fileThe .xlsx arrives on the receipt page and by email. It opens in Excel and Google Sheets; nothing to install.
- Use itYellow cells are inputs, blue cells are formulas, every figure names its source. Questions: reply to the receipt; every reply is read and answered, usually the same day.
Advisers and accountants who recommend these workbooks to clients can earn 30% of each sale as a Gumroad affiliate: sign up on the store, no approval wait.
Search terms this page answers: nis2 scope test, nis2 essential or important entity, nis2 compliance checklist excel, nis2 article 21 measures register, nis2 incident reporting 24 72 hours.