NIS 2: am I in scope, and where do I start?

The NIS 2 directive governs the cybersecurity of several thousand entities in France, spread across 18 sectors. It came into application at European level in October 2024, but the French law transposing it has still not been enacted: the bill, adopted by the Senate on 12 March 2025, is still going through the National Assembly.

That gap creates an uncomfortable situation. The obligation exists at European level, the French regulator has already published its technical framework and opened its registration service, but the national legal framework is not settled. So the right question is not “when will I have to comply”, it is “am I in scope, and what can I start on without waiting for the final text”.

What NIS 2 is, in one minute

The NIS 2 directive replaces the first NIS directive of 2016 and considerably widens its scope. Where the previous text covered a few hundred operators considered critical, this one covers 18 sectors and reaches down to medium-sized companies. Energy, transport, health, water, digital infrastructure and public administration, but also postal services, waste management, medical device manufacturing, food production and digital service providers.

The text imposes two families of obligations. Risk management measures first: risk analysis, incident handling, business continuity, supply chain security, access control, encryption, training. An incident reporting regime second, with an early warning followed by a detailed report to the national authority. And one point that changes the nature of the subject: the liability of management bodies is explicitly engaged.

The 18 sectors, concretely

The directive splits the sectors into two annexes, and that split determines by default whether you are classified as an essential or an important entity. Annex I covers eleven so-called highly critical sectors: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, management of business-to-business ICT services, public administration and space.

Annex II adds seven further critical sectors: postal and courier services, waste management, manufacture and distribution of chemicals, production and distribution of food, manufacturing in the broad sense (medical devices, computer and electronic products, machinery, vehicles), digital providers and research organisations.

It is that second annex that surprises people most. A 120-person engineering company, a medical device manufacturer or a software vendor selling to businesses rarely see themselves as covered by cybersecurity regulation. They are.

Am I in scope?

Two criteria combine: sector and size. A sector listed by the directive, and a company above the medium-sized thresholds in the European sense, meaning 50 employees or 10 million euros of turnover. Below that, the entity falls outside the scope, except in specific cases where the role it plays makes it critical whatever its size.

The next distinction determines how intensely you are supervised. Essential entities are subject to proactive supervision: the authority can inspect without a prior reason. Important entities are subject to reactive supervision, triggered by an indication of non-compliance. The security obligations are largely the same; it is the oversight that differs.

The French cybersecurity agency has published an eligibility simulator that answers the question in a few minutes, based on sector, headcount and turnover. The same space allows you to pre-register with the agency and request a free diagnostic. That is the first thing to do, and it costs nothing.

Where the French law stands

The Senate’s legislative file tracks the progress of the bill on the resilience of critical infrastructure and the strengthening of cybersecurity. The government triggered the accelerated procedure on 15 October 2024. The Senate adopted the text at first reading on 12 March 2025, and it was transmitted to the National Assembly the following day, where it is going through committee.

This single text transposes three European directives at once: NIS 2, the directive on the resilience of critical entities, and part of the DORA regulation for the financial sector. That architecture partly explains the delay, and it has a practical consequence: some companies will find themselves covered by several parts of the same law.

Until the law is enacted, the precise thresholds, the named list of entities and the enforcement calendar remain open to change. The foundation laid by the directive, however, will not move.

The technical framework already exists

This is the part many companies miss, and it changes what you can do now. On 17 March 2026 the French agency published the Référentiel Cyber France, which translates the NIS 2 security objectives into concrete requirements, with a proportionality principle: the level of effort expected adapts to the maturity of the entity and the resources available to it.

One important and often omitted detail: this framework is distributed as a working document. The agency states that no definitive version will be published until the legislative and regulatory transposition work is complete and the text has been through consultation. It should therefore be read as the best available indication of what will be required, not as an enforceable standard.

What the framework asks for largely overlaps with what a serious organisation should already be doing: an inventory of the information system and a risk analysis for every entity in scope, a continuity and recovery plan for essential entities, and regular exercises and tests to verify the ability to handle an incident and a cyber crisis.

Incident reporting, in three stages

This is the most operational obligation in the text, and the one that puts an organisation in difficulty if it has not been prepared. The directive requires a three-stage report to the CSIRT or the national authority, each deadline running from the moment the entity becomes aware of the incident.

• 24 hours: an early warning, simply stating that a significant incident has occurred and whether a malicious act or cross-border impact is suspected.
• 72 hours: a full incident notification, with an initial assessment of severity, impact and indicators of compromise.
• One month: a final report describing the incident, its cause, the measures taken and the cross-border impact. If the incident is still ongoing at that point, a progress report replaces it.

The point to remember is not the list of deadlines, it is what they imply. Twenty-four hours is not the time for a technical investigation: it is the time for a decision. So you need to have decided in advance who qualifies an incident as significant, who has the authority to trigger the notification, and through which channel, including on a Friday evening. An organisation discovering that question during a crisis will spend those twenty-four hours looking for the right person.

Penalties

The regime mirrors the GDPR in its mechanics. According to the European Commission’s frequently asked questions, Member States must provide, for essential entities, a maximum fine of at least 10 million euros or 2% of worldwide annual turnover, whichever is higher. For important entities the ceiling is at least 7 million euros or 1.4% of worldwide turnover.

Two nuances are worth knowing. The authority must take the circumstances of each case into account: nature, gravity and duration of the breach, damage caused, and whether it was intentional or negligent. And fines are not the only lever: the directive also provides for injunctions, mandated audits, and the possibility of temporarily suspending a certification or barring a manager from exercising management functions.

Where to start, without waiting for the law

Four actions make sense right now, because they will be required whatever the final version of the text says, and because they take time.

• Check your eligibility and pre-register. The agency’s simulator gives you the answer, and pre-registering puts you in its information loop rather than learning your obligations from the press.
• Inventory the information system. It is the framework’s first requirement, and the one that takes longest in an organisation that grew by accumulation. You cannot protect what you do not know you own.
• Map the digital supply chain. NIS 2 makes the entity responsible for the security of its critical suppliers. That means knowing who hosts what, who has access to what, and what the contracts say when the incident happens at the provider’s end.
• Write the incident notification procedure. Who detects, who qualifies, who decides to notify, within what deadlines. The reflex already exists on the personal data side, with the 72 hours of a personal data breach notification: you may as well build a single procedure covering both regimes.

The blind spot: access control

One observation from the field, which holds for most of the organisations we work with. Compliance projects tend to concentrate on the network perimeter, antivirus and backups, which are visible and reassuring. The subject that produces the most real incidents lies elsewhere: application-level access control.

Broken access control has held first place in the OWASP Top 10 since 2021. Concretely: an identifier you can edit in a URL that opens another customer’s file, an export meant for administrators but reachable directly, an API returning more fields than the screen displays, a contractor account left active after the engagement ended. Those defects do not show up in an infrastructure audit, and they are what turns a minor intrusion into a data breach.

It is also a point where the inventory required by NIS 2 pays off beyond compliance: listing your applications means discovering the ones nobody maintains any more. We cover that approach in our articles on shadow IT and on technical debt.

What we take from it

NIS 2 is not one more IT project, it is a change of status: cybersecurity becomes a documented obligation of means, with liability reaching up to management. For a mid-sized company, most of the work over the coming months is not technical, it is organisational: knowing what you own, knowing who you depend on, and knowing who does what when an incident happens.

The French calendar is not settled yet, but it will not loosen. Companies that use this delay to run the inventory and map their suppliers will have a phased project. The others will discover the list of requirements at the same time as the deadline. If you want to scope this subject before it becomes urgent, let’s talk.