Is a SaaS company in scope of NIS2?
Often, yes. Software you sell as an on-demand online service can meet the definition of a cloud computing service. Cloud computing is an Annex I activity. From medium size, the company is in scope, and large ones are essential entities.
The size test
| Your size | Result |
|---|---|
| Below 50 staff, with turnover or balance sheet at EUR 10 million or less | Out of scope |
| From 50 staff, or with both turnover and balance sheet above EUR 10 million | Important entity |
| From 250 staff, or with turnover above EUR 50 million and balance sheet above EUR 43 million | Essential entity |
Count the figures of partner and linked companies too. Some countries make an exception for companies with independent IT. See group figures.
5 profiles in 24 countries
A group company that runs IT for its group can be in scope in Italy at any size.
| Profile | Result in most countries | Where the result differs |
|---|---|---|
| 30 staff, EUR 4m turnover, EUR 3m balance sheet | Out of scope in 24 of 24 | Same result in every country |
| 60 staff, EUR 8m turnover, EUR 6m balance sheet | Important in 24 of 24 | Same result in every country |
| 300 staff, EUR 60m turnover, EUR 45m balance sheet | Essential in 24 of 24 | Same result in every country |
| Security operations (MSSP), 25 staff, EUR 3m turnover | Out of scope in 23 of 24 |
|
| Security operations (MSSP), 80 staff, EUR 12m turnover | Important in 22 of 24 |
Where the result differs, a national rule changes the class. The country page names the provision.
The definition
‘cloud computing service’ means a digital service that enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources, including where such resources are distributed across several locations;
Running on someone else's cloud does not change this. The German BSI counts a self-contained SaaS product with on-demand, scalable access as a cloud computing service.
Which country supervises you
A cloud computing provider answers to the Member State of its main EU establishment only. That is usually where the decisions on cybersecurity risk management are taken. You register there, report incidents there and follow that country's law.
Managed services are a different activity
If you also install, run or monitor IT for your customers, you can be a managed service provider too. If you run security operations for them, you can be a managed security service provider.
How the Directive defines a managed service provider
‘managed service provider’ means an entity that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers’ premises or remotely;