Cyber security
Does NIS2 apply to you?
Most smaller firms are not directly in scope. It reaches them through a customer who is — and who sends a questionnaire. Find out in a minute where you stand.
What sector are you in
The act defines highly critical sectors and other critical sectors.
Company size
Size is counted under Commission Recommendation 2003/361/EC. Linked and partner enterprises count too.
Do you supply a regulated customer?
A hospital, utility, bank, manufacturer or public body, for example. This is what usually decides.
Honestly
What we cover and what we do not
The directive asks for more than technical settings. Miciamo covers one slice — the Microsoft 365 environment. The rest belongs to you, your IT partner or a cyber security adviser.
We cover by measuring and deploying
- Multi-factor authentication and access management
- Admin permissions and break-glass accounts
- Mail protection against phishing and impersonation
- Document sharing and guest access
- Encryption and data protection inside Microsoft 365
- Monitoring, logs and alerts on suspicious activity
- Evidence of the state at a point in time, repeatable in six months
Not covered — handled elsewhere
- Risk analysis and security documentation
- Incident procedures and reporting to the authority
- Backup and business continuity planning
- Networks, servers and devices outside the tenant
- Physical security and HR measures
- Appointing a cyber security manager
- Statutory audit by a certified auditor
Scope is not the same as liability. This overview says what the service covers. Who is liable for what is set by the contract, which we go through together before we start — not after the first incident.
Where the classification comes from. The sectors in this test follow Annexes I and II of Directive (EU) 2022/2555. The size thresholds come from Commission Recommendation 2003/361/EC. Only defined entities are in scope regardless of size under Article 2(2) — telecoms, trust services, DNS, TLD registries and public administration. Construction, architecture and schools are not among the directive's sectors.
EU-wide, with national detail. NIS2 is an EU directive. The sectors and the size thresholds used in this test come from the directive and apply across the Union. Registration, deadlines, the supervisory authority and any national extensions of scope differ by member state — check those where you operate.
What the assessment is not. It is evidence of the state of technical measures in Microsoft 365. It is not a statutory audit and not a certificate of NIS2 compliance. Whether your organisation is in scope is for your legal adviser to judge — this test is indicative.
What this test is based on
Last verified 22 October 2026- Directive (EU) 2022/2555 — NIS2 Sectors from Annexes I and II, scope under Article 2, essential and important entities under Article 3 EUR-Lex ›
- Commission Recommendation 2003/361/EC Enterprise size thresholds, including linked and partner enterprises
- National transposition Duties arise from the law of the country where your organisation is established. Registration, deadlines and the supervisory authority differ, and some member states extend the scope beyond the directive. European Commission ›
The directive may change and national rules keep evolving. Check the current wording at the source before deciding.
Received a questionnaire and unsure what to do?
Send it to us. We will tell you which questions an environment assessment can answer and which ones need someone else — even when that someone is not us.
Write to us