nis2 scope audit

The problem

Most NIS2 compliance assessments fail by treating the directive as a uniform EU regulation. They often miss critical national transposition variances and incorrectly assume financial entities have a blanket exemption due to DORA.

What it does

• Determines NIS2 scope by mapping entity activities against Annex I and II criticality sectors.
• Classifies entities as Essential or Important based on staff count, turnover, and balance sheet thresholds.
• Identifies jurisdictional conflicts by determining which EU Member State's specific transposition law applies.
• Performs a DORA equivalence test to verify which obligations are displaced and which remain under NIS2.
• Generates a baseline readiness gap map against Article 21 risk measures and Article 23 reporting timelines.

Why this beats prompting it yourself

Generic prompts treat NIS2 as a static checklist. This skill accounts for the directive's nature as a national-law floor, preventing expensive classification errors and ensuring border entities don't overlook sub-threshold exceptions or Member State specific gold-plating.

Use cases

• Determining if a medium-sized ICT provider is an "Essential" or "Important" entity.
• Audit preparation for cross-border entities needing to identify their lead supervisory authority.
• Pre-screening financial institutions to map the overlap between DORA and NIS2 Article 4.
• Conducting a baseline gap analysis for Article 21 cybersecurity risk-management measures.

Known limitations

Does not cover Cyber Resilience Act product requirements. Classification remains advisory, as national authorities are the ultimate arbiters of legal status.