NIS 2: Is My Company In Scope, and What Exactly Is Required?

NIS 2 considerably widens the number of regulated entities and introduces a proportionality mechanism. It distinguishes two categories by criticality: essential entities and important entities. Obligations and supervision differ between the two, but both are regulated.

Two criteria combine. First the sector: the directive lists highly critical and critical sectors in its annexes. Then size: the entity must at least reach the medium-sized enterprise threshold under the European definition, or exceed the stated ceilings. Essential entities generally operate in highly critical sectors with more than 250 full-time-equivalent employees.

Once an entity has assessed that it falls within scope, it must register with ANSSI, the French national cybersecurity agency. Registration happens online on the MonEspaceNIS2 platform. It is a declarative process: the company performs the analysis, the administration does not come looking for it.

Since 17 March 2026, ANSSI has published the French Cyber Framework (ReCyF), listing the measures it recommends to meet the security objectives set by NIS 2. That is the document to compare against your current situation, rather than starting from a generic checklist found online.

In practice the work items are usually the same: knowing who has access to what and being able to evidence it, having strong authentication, being able to detect and log an incident, holding backups that are tested and not merely configured, and being able to report an incident within the deadline. On a Microsoft environment, much of this already exists in the licences in place and is simply not switched on.

Start with the scope analysis, written and dated, even if the conclusion is that you are not concerned: that document is what protects you when the question comes back. If you are in scope, then measure the gap between the framework and what exists. The gap gives you the work plan, not a catalogue of tools.