FREE TOOL
Which of your clients are NIS2 essential or important entities?
Paste or upload a CSV (name, sector, staff count, optional turnover). This tool runs the same NIS2 scope logic as the single-company scope check against every row, in your browser. It sorts the result into essential, important, possibly supply-chain exposed, or out of scope, so you know who to call this quarter first.
Everything below runs in your browser. No row of this file is ever sent anywhere. Nothing is uploaded to a server.
Upload or paste a CSV, then click "Triage this list".
Does any client data leave the browser?
No. The CSV is read with the browser’s own file-reading API and classified in memory using @ecp/nis2-scope, the same deterministic rules ported from the CCB’s NIS2 Scope Assessment workbook [1] that the single-company NIS2 scope check uses [2]. Nothing about a client is ever sent to a server, an API or a third party. The only network call anywhere on this page is the unrelated "Get the PDF" email step, which sends a generic guide and never any portfolio data.
A free-text sector column cannot answer the scope check’s own follow-up questions for digital infrastructure or public administration subtypes. This tool therefore makes a best-effort keyword guess per row and lets you confirm or change the sector before trusting a verdict. Rows it cannot guess confidently are marked "needs a sector pick" rather than given a false verdict.
"Possibly supply-chain exposed" is a heuristic, not a scope verdict. It flags a client out of direct NIS2 scope whose sector text suggests IT, consultancy, accounting, legal or similar supplier work. Such a client is worth a questionnaire conversation, because NIS2-essential and NIS2-important clients must assess their own suppliers [2].
What does a result look like?
A 40-row client list comes back sorted essential first (a hospital, a bank), then important (a mid-size logistics firm). A handful are flagged "possibly supply-chain exposed" (an IT consultancy and an accounting firm with no Annex I/II sector of their own, but sector text that often supplies regulated clients). The rest are out of scope. The sorted order is a call list for this quarter, not a legal filing.
Download the result as a CSV to keep in the account plan, or come back to the single-company NIS2 scope check for a fuller, sourced explanation on any one client before that conversation.
See also the NIS2 scope check for a single company, and the NIS2 field guide for MSPs.
Frequently asked questions
- Is my client list uploaded anywhere?
- No. The file is read and classified entirely in the browser with JavaScript’s FileReader API; this page makes no network request with any row of the file, ever.
- What columns does the CSV need?
- Name, sector (free text), staff count, and an optional yearly turnover in euros. A header row is optional; the tool detects one automatically. A sample CSV is one click away.
- Why does one client show "needs a sector pick"?
- The sector text in that row did not match any of the tool’s known categories confidently enough to guess. Pick the closest sector from the dropdown and the row re-classifies immediately.
- How accurate is the bulk result?
- As accurate as the single-company NIS2 scope check for the obvious cases, and no more: a free-text sector column and a simplified Belgium-only jurisdiction assumption mean group structure, cross-border activity and sector subclassifications are not checked. Treat a borderline or supply-chain-exposed row as a reason to ask, not a final answer.
- Can I check one company instead of a whole list?
- Yes. The NIS2 scope check asks a few more questions (including a supply-chain step) and gives a fuller, sourced result for a single company.
Related free tools
- NIS2 scope check Sector, size and a supply-chain step: see in about two minutes whether a company is an essential or important NIS2 entity, or out of scope, and which customer sectors push requirements down anyway.
- MSP NIS2 revenue calculator Enter your client mix by size, your fee, your delivery hours and cost, and what you pay ECP. See your monthly recurring revenue, margin and hours.
- Is your MSP NIS2-ready? 14 questions on the MSP’s own security: privileged access to client systems, RMM hardening, MFA, logging, suppliers, incident reporting, staff training. A score and a fix-first list.
NIS2 scope check (one company at a time) · NIS2 field guide for MSPs
2026-11-03
Computed with the free tool at https://easycyberprotection.com/learn/tools/client-portfolio-triage/, by Easy Cyber Protection.