Group structure decides everything: who is in scope and how are they classified?
Nordhavn Gruppen A/S is a Danish group with three legal entities. Nordhavn Food Logistics A/S (NFL) employs 240 people and reported a turnover of EUR 61 million in the last financial year; it runs refrigerated warehousing and distribution for food retailers in Denmark and northern Germany. Nordhavn IT Partner A/S (NIP) is a wholly owned subsidiary with 34 employees and EUR 6.8 million turnover; it provides fully managed IT services, including remote monitoring and patch management, to 60 business customers. Nordhavn Ejendomme A/S owns the group's buildings and employs six people. A newly hired group CISO has three weeks before the national registration deadline to tell the board which parts of the group are in scope and what must happen first. NIP's largest customer is a regional electricity distribution system operator; NFL's largest customer is a national supermarket chain. The three entities share no IT governance, no common incident process and no group risk register.
1. Determine which of the three legal entities fall within the scope of the national NIS 2 transposition, and how each is classified. State the test you applied and the residual uncertainties you would flag to the board.
Read the worked answer
Apply both limbs of the test, separately. Scope requires (i) the entity is of a type listed in Annex I or Annex II, and (ii) it is medium-sized or larger: 50 or more employees, or annual turnover or balance sheet total above EUR 10 million (Art. 2(1)). The unit of assessment is the legal person, not the group and not a business division.
- NFL: 240 employees and EUR 61m clears the size test on both limbs. Its activity is food distribution, an Annex II sector, so it is an important entity. Note the reasoning trap: food is Annex II, not Annex I. Had NFL distributed drinking water it would be essential.
- NIP: 34 employees and EUR 6.8m fails both limbs. B2B ICT service management is an Annex I activity, but Annex I entities are still subject to the size cap. The size-independent categories are narrow (qualified trust service providers, TLD registries, DNS service providers, public electronic communications providers) and a managed service provider is not among them. Default answer: out of scope - but check the Danish statute, because Member States may extend scope to smaller entities that are critical for society or the economy.
- Ejendomme: real estate is not an Annex I or II sector, and six employees fails the size test. Out on both limbs.
Consequences worth stating. Important status means ex-post supervision only (Art. 32) and a lower fine ceiling (EUR 7m or 1.4% of worldwide turnover) than essential entities (EUR 10m or 2%), but the Art. 21 duties are identical.
Residual uncertainties. Whether Danish law applies a consolidated or group-level size assessment; whether NIP has been designated as critical at national level; and the fact that NIP is still a tier-1 supplier to an essential entity, so it enters NFL's supply-chain risk management (Art. 21(2)(d)) even without being registered itself.
2. NFL delivers services in Denmark and Germany. Explain where NFL must register and notify incidents, and why, and identify what could change that answer.
Read the worked answer
Jurisdiction follows the main establishment, not the customer base. Under Art. 26, an entity providing services in more than one Member State falls under the jurisdiction of the Member State where it has its main establishment - in practice the place of its central administration in the Union. NFL's central administration is in Denmark, so Denmark registers it, Denmark supervises it, and incidents are notified to the Danish CSIRT or competent authority.
What this does not mean. It does not mean German obligations vanish. The cross-border delivery to German retailers still exposes NFL to contractual and sector-specific requirements, and the German authority can act through the Cooperation Group and request mutual assistance. It also does not mean NFL may pick the friendlier regime: jurisdiction is a legal fact, not a choice.
What would change the answer. Relocating central administration, or a restructuring that turns the German operation into a separate legal entity that is itself medium-sized and delivers services in Germany - that new entity would have its own registration. Similarly, if NFL were not established in the Union at all, it would need to designate a representative in a Member State where it offers services (Art. 27).
Practical step. Registration should be filed before the national deadline with the information the register requires: name, address, contact point, Member State, sector and, where relevant, the list of entities. The designated contact point is not a formality - it is the channel through which the 24-hour clock in Art. 23 becomes workable.
3. The board asks what to do in the first 30 days on a limited budget. Which three actions would you prioritise, and what is the legal reasoning behind each?
Read the worked answer
1. Put the management body formally on record (Art. 20). The management body must approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements; its members must also undergo training. Without a minuted approval, NFL cannot show a lawful decision-making chain, and every later proportionality argument collapses because nobody with authority accepted the risk. Cost: a board agenda item and a training session.
2. Register and designate the contact point (Art. 27). This is the cheapest obligation and the first thing a supervisor checks. Being unregistered is an immediately provable infringement that needs no technical assessment, and it undermines credibility on everything else.
3. Produce a first risk assessment and a written decision record (Art. 21(1) and 21(2)(a)). The Directive requires measures that are appropriate and proportionate to the exposure - which presupposes a documented exposure. This record is what converts a budget constraint from an excuse into a defensible position, and it is the input to the supply-chain measure, which matters here because NFL's operations depend on third-party platforms.
What I would deliberately not do first. Buy technology. Also, incident-reporting readiness (Art. 23) should be stood up in the same 30 days even though it is not in the top three: a 24-hour deadline cannot be retrofitted, and NFL currently has no common incident process at all.