Scope a mixed-service group under NIS2

Scope a mixed-service group under NIS2

The first scope map is complete, but the client now explains that the group has three service companies. Sales are centralised in one country, cyber decisions are made in another, and a third company operates the customer environment. The initial label EU headquarters is no longer enough.

Separate the group structure from the activities relevant to NIS2. Identify which entity supplies each service and the facts supporting the possible statutory category. A managed-service label in a brochure is a starting point, not a legal conclusion. Check the annexes, definitions, size assessment and applicable exceptions.

Do not assume that a small subsidiary is outside scope merely because its own staff count is low. The relevant size calculation may require examining linked or partner enterprises. Conversely, selling to an entity within NIS2 does not by itself prove that every supplier is directly within the directive's scope. Contractual demands and direct statutory duties are different questions.

Jurisdiction needs its own analysis. Article twenty-six has specific rules for listed digital providers, including cloud and managed service providers. For those entities, the main-establishment analysis concerns where cybersecurity risk-management decisions are predominantly taken, with further criteria if that place cannot be determined. The general location of a server or the address on an invoice does not replace that analysis.

Check national implementation and any applicable sector-specific Union rules before stating the final obligation. The directive supplies the framework; this episode does not determine the national result for every country where the group operates.

Return to the three companies. Ask for a service map, contracts identifying the provider, relevant ownership information and a description of who decides cyber measures. Request facts proportionate to the actual uncertainty. A corporate chart alone may not explain operational responsibility.

Your conclusion should state the entity, activity, jurisdiction reasoning and remaining qualification. That makes the advice reusable when the client launches a new service or reorganises the group. A single red or green box labelled NIS2 compliant cannot carry those distinctions.

Pick one entity from the fictional group. Which missing fact could move it into a different legal category, and who in the business can reliably answer that question?