Scoping and planning a NIS 2 compliance programme
This domain tests whether you can turn the directive into a bounded programme: classify the entity, define the legal perimeter, register, assign accountability, baseline against Articles 20, 21 and 23, and sequence work with realistic dependencies.
Scoping sequence
Start with the sector test under Annexes I and II, then apply the SME thresholds: medium-sized is broadly 50 or more employees or above EUR 10 million turnover or balance sheet; large is broadly 250 or more employees or above EUR 50 million turnover and EUR 43 million balance sheet. Identify regardless-of-size categories. Then classify essential versus important. Determine jurisdiction by main establishment; non-EU providers may need an EU representative. Registration with the competent authority is a legal deliverable, not an optional inventory task.
Planning the programme
Set a management-body sponsor because Article 20 makes the management body accountable. Build an asset and service register, a supplier register of direct suppliers, and a control gap assessment against the Article 21 measures and Article 23 incident workflow. Sequence: governance and scope, risk assessment, policies and technical controls, incident and reporting capability, supplier clauses, training, testing and evidence. Use a RACI and tracked corrective actions.
Worked example
A food manufacturer has 180 staff, EUR 45 million turnover and a EUR 30 million balance sheet. Annex II applies, and it is medium-sized, not large, so it is important. Because its main establishment is in one Member State, that state's authority has jurisdiction. The plan should register it, appoint an accountable director, assess the ten Article 21 measures, and prioritise a 24/72-hour reporting playbook.
Traps
Do not count only permanent employees if group or temporary staff affect the SME test. Do not assume certification proves compliance. Do not let scoping stop at IT; operational technology and facilities matter. Do not omit supplier contracts and management training.