The situation
A company profile: services, employee numbers, turnover and group entities
A software group headquartered in Amsterdam runs a managed IT and hosting service for mid-sized manufacturers, alongside its SaaS products. It has 180 staff and EUR 38 million turnover, with an operations entity in Cologne. Two customers have asked in writing whether the group is subject to NIS2.
Counsel must answer before the board meets. The work is mapping the group’s services to the sector lists, applying the size test with the right group data, deciding which country has jurisdiction, and confirming where national law stands in each country. Each step changes the next.
What the research has to settle
The rules behind the answer
- Sector first, then size
- NIS2 applies to entities providing services in the sectors listed in its annexes that are at least medium-sized, with some services in scope regardless of size. Managed service providers and cloud computing services are among the listed digital services.
- The size test uses the EU SME definition
- Size follows the Commission’s SME Recommendation: employee numbers, turnover and balance sheet, taking partner and linked enterprises into account. A group company can be medium or large because of its group.
- Essential or important
- Broadly, large entities in the sectors of high criticality are essential, and other entities in scope are important. The difference matters most for supervision and fines, less for the security measures themselves.
- Jurisdiction and national law
- For managed service providers and cloud services, the main establishment in the EU generally decides which member state supervises. The duties come from national transposition, so the research confirms the state of the law in each country on the date of the memo.
How it runs in azta
From the question to the document
The question, as you would type it
Dutch BV group: managed IT and hosting for manufacturers plus SaaS products. 180 staff, EUR 38 million turnover, a German subsidiary in Cologne running operations. Are we in scope of NIS2 as an essential or important entity, which country supervises us, and what is the state of national implementation in Germany and the Netherlands?
You start with
A company profile: services, employee numbers, turnover and group entities
- 01
Describe the group
Give the services, the customers, employee numbers, turnover and balance sheet, and where cybersecurity decisions are taken. azta searches NIS2, the SME Recommendation and the Dutch and German law.
Cited research· Free - 02
Check the national law in force
Open the Dutch and German implementing provisions in the reader and check their in-force status on the date of the memo.
Atlas statute reader - 03
Draft the scope memo
Ask for a memo in steps: sector, size, category, jurisdiction, with the open points flagged. Edit it in Canvas.
Canvas · Ask azta· Pro - 04
Export for the board
Export the memo to Word for the board, with a short customer letter drafted from it.
Word export· Pro You send
A scope memo on NIS2 status, with the reasoning for each step
What you get
A scope memo on NIS2 status, with the reasoning for each step
Scope memo · draft
NIS2: scope and status of the group
Sector. The managed IT and hosting service is a managed service provider service and may also be a cloud computing service under the Directive. Both are in the sectors of high criticality. The SaaS products are assessed separately in the annex.
Size and status. With 180 staff and EUR 38 million turnover, the group is a medium-sized enterprise under the SME Recommendation. A medium-sized entity in a sector of high criticality is an important entity, not an essential one, unless national law designates it otherwise.
Jurisdiction. Cybersecurity decisions are taken in Amsterdam, which points to the Netherlands as the main establishment and the Dutch authority as supervisor. The state of the Dutch and German implementing laws on the date of this memo is set out in the annex.
Outcomes on your numbers
What azta is worth on this task
Pro pays for itself after
13 minutes a month
At €130 an hour, that is all the time Pro (€27 a month) has to take off your desk to cover its price.
Example figures. Replace them with your own.
- Hours back a year
- 25
- Capacity at your rate
- €3,276
- More NIS2 scope memos a quarter
- 0.8
- Return on Pro
- 10.1×
- Research
- Drafting
- Your review
A scenario you set, not a promise. The hours that come back go to another client, or deeper into this one.
Want these numbers on your team’s real workload?
Book a demoSources azta searches here
- EUR-Lex · Curia
- wetten.overheid.nl
- Gesetze im Internet
What stays with you
- The facts: services, employee numbers and group figures.
- The call on contested points, such as whether the SaaS products are cloud services.
- Registration with the authority and the security programme itself.
Frequently asked questions
- Does azta hold the national implementing laws?
- It holds national legislation as published, indexed daily. Each citation shows the provision’s in-force status, so you can see whether it applies on the date you ask about.
- Does it cover the security measures too?
- Yes, as a separate question. The Directive and national law set the risk-management measures and the reporting stages, and azta cites both.
- Can we answer our customers from the memo?
- Use it as the basis. Ask for a short customer letter in Canvas and review it before it goes out.
