How accurate is a result from 7-8 questions?

It correctly classifies the obvious cases: a 500-staff hospital is essential, a 4-person consultancy with no Annex I/II sector is out of scope. Group structure, cross-border activity and sector subclassifications can still change a borderline case; those need the full CCB workbook or a consultant review, not five more checkboxes.

Does the result use artificial intelligence?

No. The result comes from deterministic rules ported from the CCB’s own NIS2 Scope Assessment workbook [1] and CyFun Selection Tool [5], run in the browser. No data leaves the browser unless the PDF is requested by email.

My sector is not on the list. Am I safe?

Probably outside direct NIS2 scope. But customers in NIS2-essential sectors (hospitals, banks, energy, public administration, telecom) must assess their own suppliers, so selling into one of those sectors usually means a security questionnaire arrives sooner or later. The supply-chain step above shows which of your own customer sectors carry that pressure.

What happens once a company is in scope?

Registration on Safeonweb@Work [4] (the deadlines were 18 December 2024 for digital sectors and 18 March 2025 for everyone else), cybersecurity risk-management measures, and reporting significant incidents to the CCB, a duty since 18 October 2024 [2]. Essential entities add a conformity assessment, due 18 April 2027.

Is being essential or important the same as the CyFun level?

No, these are two separate questions. The law decides essential or important from sector and size. The CCB risk model separately points to a CyberFundamentals level (Basic, Important or Essential), and a small important entity can land on CyFun Basic as a starting point. That is not the level of a formal assessment.

NIS2 scope check: am I in scope in Belgium?

By Tom Janssens · Founder, Easy Cyber Protection · Last reviewed 3 November 2026 · How we write this

How does the NIS2 scope test work?

The Belgian NIS2 law of 26 April 2024 [2] puts a company in scope when two things are true: it provides a service listed in Annex I or Annex II of the law, and it clears a size threshold (roughly 50+ staff, or over €10M in turnover and balance sheet, counting the whole group). Some services (public administration, telecom, DNS and top-level domain registries, trust services) stay in scope at any size.

This tool runs the same logic as the NIS2 Scope Assessment workbook [1], the spreadsheet the Centre for Cybersecurity Belgium (CCB) publishes to decide scope. A second CCB spreadsheet, the CyFun Selection Tool [5], gives the matching CyberFundamentals (CyFun) assurance level: Basic under 100 risk points, Important 100-199, Essential 200 and above. Points are scored per sector and scaled by company size.

A questionnaire from a customer, insurer or regulator is usually the first sign that supply-chain pressure has arrived, whatever the direct-scope answer.

What does a result actually look like?

A hospital with 500 staff selects "Health" and "Large": essential entity, CyFun Essential, 218 controls, with the 18 April 2027 conformity-assessment deadline (and the 2028 fallback if a remediation plan is filed [3]). A 4-person web agency with no Annex I/II sector and no public-sector customers comes back out of scope, with a note that a security questionnaire from a client would be the first sign of a change.

A 90-person logistics firm (medium) has no Annex I/II service of its own, but three customers in energy, health and banking. It is out of direct scope itself, and all three customer sectors are flagged Annex I. Supply-chain pressure is close to certain, not theoretical.

Scope not settled by seven questions? The NIS2 directive in Belgium page covers the full legal text, and the NIS2 fine calculator shows what being in scope and not acting can cost.

Frequently asked questions

How accurate is a result from 7-8 questions?: It correctly classifies the obvious cases: a 500-staff hospital is essential, a 4-person consultancy with no Annex I/II sector is out of scope. Group structure, cross-border activity and sector subclassifications can still change a borderline case; those need the full CCB workbook or a consultant review, not five more checkboxes.
Does the result use artificial intelligence?: No. The result comes from deterministic rules ported from the CCB’s own NIS2 Scope Assessment workbook [1] and CyFun Selection Tool [5], run in the browser. No data leaves the browser unless the PDF is requested by email.
My sector is not on the list. Am I safe?: Probably outside direct NIS2 scope. But customers in NIS2-essential sectors (hospitals, banks, energy, public administration, telecom) must assess their own suppliers, so selling into one of those sectors usually means a security questionnaire arrives sooner or later. The supply-chain step above shows which of your own customer sectors carry that pressure.
What happens once a company is in scope?: Registration on Safeonweb@Work [4] (the deadlines were 18 December 2024 for digital sectors and 18 March 2025 for everyone else), cybersecurity risk-management measures, and reporting significant incidents to the CCB, a duty since 18 October 2024 [2]. Essential entities add a conformity assessment, due 18 April 2027.
Is being essential or important the same as the CyFun level?: No, these are two separate questions. The law decides essential or important from sector and size. The CCB risk model separately points to a CyberFundamentals level (Basic, Important or Essential), and a small important entity can land on CyFun Basic as a starting point. That is not the level of a formal assessment.

Related free tools

Who must comply with NIS2 · NIS2 field guide for MSPs

Use this with your clients

Does the Belgian NIS2 law apply to your company?

How does the NIS2 scope test work?

What does a result actually look like?

Frequently asked questions

Related free tools

Sources