NIS2, explained simply
NIS2 is the European Union’s horizontal cybersecurity law. Unlike a standard, it is binding — but it is a directive, so it reaches you through your country’s transposition law rather than directly, and it applies only to entities inside its scope.
- Standard
- Directive (EU) 2022/2555 (NIS2)
- Version
- OJ L 333, 27.12.2022
- Jurisdiction
- EU
- Catalogue last verified
- 2026-07-16
Who is in scope
Essential and important entities in the sectors listed in the directive’s annexes, subject to size thresholds with exceptions. Whether you are in scope is a legal question decided under your national transposition law — not something software can determine for you. Many companies are pulled in indirectly, as suppliers to an entity that is in scope.
What is actually in it
Tawsik tracks every requirement in the published catalogue, grouped by its official numbering.
28requirements tracked
- Art. · 28
What evidence can prove — and what it can’t
We would rather tell you this up front than let a dashboard imply more certainty than it has.
Where Tawsik fits
Tawsik measures NIS2 readiness from your self-assessment and your evidence. It never decides that the directive applies to you, and it never declares you compliant — that determination belongs to your national authority. What it gives you is an honest picture of which risk-management measures you can evidence today, and which you cannot.
Tawsik is not a certification body or an auditor.
One set of evidence, every framework
Tawsik maps one canonical control to every framework that asks for it, so a proof you gather once counts everywhere it applies.
See where you stand
Start with the free EU AI Act check — no account, no email. Your workspace covers the rest.
Tawsik guides you toward compliance. It isn’t legal advice.