NIS2 • Quick classifier

Directive NIS2

Directive (EU) 2022/2555, known as NIS2, sets a reinforced cybersecurity framework in the European Union. Portuguese Decree-Law 125/2025 transposes the directive, defining:

Covered sectors;
Obligation to implement risk management measures;
Incident reporting requirements;
Supervision rules;
Sanctioning regime;
Classification of essential and important entities.

The goal is to reach a high, common and consistent level of cybersecurity, reducing systemic risks and ensuring resilience of digital infrastructures and critical services.

Check in seconds if your company is covered by NIS2.

Enter key organization data, sector of activity and a few criticality criteria. The rules engine applies a simplified reading of Annexes I and II of NIS2 to show if the entity is ESSENTIAL or IMPORTANT — or out of scope. At the end, the data is sent automatically for review.

Focus on critical sectors (energy, health, transport, finance, ICT, etc.)

Classification by size: micro, small, medium and large

Form

Company data

Single step

Identification

Company name

Location

Organization profile

Sectors covered by NIS2 (Annex I / II)

Use the NIS2 typology (Annex I and II) closest to the main activity.

Entity size (Annex III)

Number of employees

Approximate values are fine.

Turnover (million €)

E.g.: 12.5 for €12.5M/year.

Special criteria

Mark any criteria that apply, even if the organization is smaller.

Provider of public communications networks Trust service, DNS or TLD provider Sole provider of a critical service in a region/country High impact on public safety or public health Systemic risk (significant cascading effects) Relevant national or regional importance

This tool implements a simplified rule-based classifier. It is only a decision-support aid and does not replace a formal legal assessment of NIS2 applicability.

Directive NIS2

Check in seconds if your company is covered by NIS2.

Company data

NIS2 assessment