NIS2 for small and medium-sized businesses
Many small companies do not know whether NIS2 applies to them. Size and sector decide most cases, but there are exceptions — and obligations can also arrive indirectly, from your customers. Here is a short overview and a tool that answers it from your company registration number (IČO).
Does NIS2 apply to my company?
Medium-sized or larger company in a regulated sector
NIS2 applies to entities in the sectors listed in Annexes I and II of the directive that are at least medium-sized enterprises — 50 or more employees, or annual turnover and balance sheet both above €10 million. Linked and partner enterprises count towards size.
Art. 2(1) Directive (EU) 2022/2555
Exceptions regardless of size
Even a small company is in scope if, for example, it provides public electronic communications networks or services, trust services, DNS or domain registration, is the sole provider of an essential service in the country, or is designated as critical by the state.
Art. 2(2)–(4) Directive (EU) 2022/2555
Indirect obligations through the supply chain
Regulated companies must address the security of their suppliers. If you supply IT, software or services to a company under NIS2, it may require security measures from you by contract, even if you are not in scope yourself.
Art. 21(2)(d) Directive (EU) 2022/2555
How NISMap helps
1. Enter the IČO
We load the company from the Slovak register of legal entities (RPO) or the Czech ARES and give an indicative classification — essential, important or out of scope — with the reasoning. No sign-up.
2. Check your domain
An outside-in technical scan of your public domain: TLS, security headers, DNS and DNSSEC, exposed files, CMS and known vulnerabilities. No installation, no credentials.
3. Complete the self-assessment
13 areas of security measures — quick mode has 39 questions, extended mode 133. The result is a PDF report with recommendations.
Legislation we reference
- Act No. 69/2018 Coll. on Cybersecurity, as amended by Act No. 366/2024 Coll.
- NBÚ Decree No. 227/2025 Coll.
- Act No. 264/2025 Coll. on Cybersecurity
- Directive (EU) 2022/2555 (NIS2)
Frequently asked questions
We have fewer than 50 employees. Can we ignore NIS2?
Not automatically. Small companies are generally not directly in scope, but size-independent exceptions apply (for example telecoms, trust services, DNS and domain registration) and linked enterprises count towards size. If you supply a regulated company, you may have contractual security obligations.
How quickly can I find out whether NIS2 applies to us?
Enter your IČO at nismap.com. We load the data from the business register and you see an indicative classification with the reasoning. No sign-up required.
Is the NISMap result binding?
No. It is an indicative assessment based on register data. For a binding determination contact NBÚ (Slovakia) or NÚKIB (Czechia), or an auditor.
How much does it cost?
The IČO check and domain scan require no sign-up. Paid plans are listed on the pricing page; orders are handled via sales@nismap.com.
Find out whether NIS2 applies to you
Enter an IČO and see an indicative NIS2 classification with the reasoning.
Check a company by IČOIndicative assessment, not legal advice. For a binding determination contact NBÚ (SK) or NÚKIB (CZ).