Free NIS2 check · Runs in your browser

Does your company
fall under NIS2?

Since 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet) applies, the Dutch implementation of NIS2. Whether your organisation falls under it depends on your sector and your size. Answer a few questions and see in plain language where you probably stand and what you then need to do.

Take the check How it works

Free · No account · Nothing is sent anywhere

What a result looks like

Indication, not legal advice

Probably yes: an important entity

Measures and evidenceRequired

Report incidents24 / 72 hours

An example. Below you take the real check.

Answer five questions

The result is an indication and not legal advice. What you enter does not leave this page.

1. Which sector does your organisation work in?

2. Number of employees

Annual turnover

Balance sheet total

3. Is your organisation part of a larger group, or does it have large shareholders or partners?

No Yes I do not know

4. Does any of these apply to you? (leave empty if none does)

5. Do you supply services to organisations that fall under NIS2?

No or I do not know Yes

Sector. Size. Exceptions.

Three things decide
whether the law applies.

The sectorThe law names 18 sectors in two annexes: highly critical (Annex I) and other critical sectors (Annex II). Only the listed activities count.

The sizeIn principle from medium-sized: 50 employees, or more than € 10 million turnover and balance sheet. Large is 250 employees, or more than € 50 million turnover and € 43 million balance sheet.

ExceptionsSome organisations always fall under it, even if small: public authorities, DNS providers, trust services and providers of public communications.

Essential or importantLarge in Annex I is essential, with proactive supervision. Medium in Annex I, or medium or large in Annex II, is important, with reactive supervision.

The check holds your answers against those rules. It does not look at a list of organisations, and does not know which companies have already registered.

FAQ

Frequently asked questions

What is NIS2?

NIS2 is a European directive on the cybersecurity of organisations in critical sectors. In the Netherlands it is implemented in the Cybersecurity Act (Cyberbeveiligingswet), which came into force on 15 August 2026.

From what size does NIS2 apply?

In principle from medium-sized: 50 or more employees, or more than 10 million euro turnover and balance sheet total, in one of the listed sectors. Some categories fall under it regardless of size, such as DNS providers and public authorities.

What is the difference between an essential and an important entity?

Large in Annex I is essential, with proactive supervision. Medium in Annex I, or medium or large in Annex II, is important, with reactive supervision.

Is the result legally binding?

No. It is an indication and not legal advice. Your organisation decides for itself whether it falls under the law. For the official assessment use the NIS2 self-assessment of the Dutch Authority for Digital Infrastructure and the NCSC registration checklist.

What the check does not do, and why that is more honest

It is an indication, not a verdict. Your organisation decides for itself whether it falls under the law. The check helps you on your way; the official starting point is the NIS2 self-assessment of the Dutch Authority for Digital Infrastructure (RDI) and the NCSC registration checklist.

“I do not know” is not a “no”. If you do not know your sector or your position in a group, it says “still unclear” and never “does not fall under it”.

Groups and partners count. In a larger group their employees and figures may count too, and your size then comes out higher. The check cannot calculate that for you; ask your accountant or a lawyer.

It never says you “comply with NIS2”. This is only about whether the law applies to you, not about whether you comply with it.

Honest about your data

Everything stays
with you.

The check runs entirely in your own browser. Your answers are not sent, not stored and not seen by us. You can verify that in the Network tab of the developer console: nothing leaves your browser when you view the result.

What you may come across is measurement, and only if you accepted the cookie notice: a counter of how often the check was used, never what you answered.

Do you fall under it? Start collecting evidence.

The MK Cloud & IT M365 Security Dashboard measures the technical measures in your Microsoft 365 environment and collects the evidence per duty-of-care area, with the NIS2 Monitor as an extra aid towards NIS2 readiness. It is not official proof, an audit or certification.

See the M365 Security Dashboard →

More tools like this

The NIS2 check is one of the free apps from MK Cloud & IT. Also see the hack help: we have been hacked, what now? All apps (in Dutch for now).

Sources

The NIS2 Directive (EU 2022/2555), the Dutch Cybersecurity Act (in force since 15 August 2026) and the EU definition of SMEs (Recommendation 2003/361/EC). For the official assessment: the RDI (self-assessment) and the NCSC, ncsc.nl.

For organisations

MK Cloud & IT helps organisations of 50 to 500 users map the technical side of NIS2 readiness: MFA, mail protection, licences and evidence per duty-of-care area. See the M365 Security Dashboard or get in touch.

Is something wrong in the result, or is a sector missing? Let us know.

Does your companyfall under NIS2?