Does DORA or NIS2 apply to your organisation?
Has a customer asked for evidence, or are you unsure whether your organisation is in scope? We prepare a short written conclusion based on activities, size, group relationships and applicable exceptions.
From €900
Scope and price are confirmed in writing before work starts.
Discuss your caseWhen you need this service
- You are not sure whether NIS2 (EU cybersecurity directive) or DORA (EU Digital Operational Resilience Act) applies to you.
- A customer says you are in scope and you disagree.
- You are part of a group and do not know how size is counted.
The benefit for your organisation
- You choose your preparation on a reasoned conclusion instead of starting with the wrong package.
- You know the authority and your category.
- You have a written rationale to show management or a customer.
First conversation and written assessment
The first conversation clarifies your question, deadline and necessary information. If that is sufficient for orientation, there is no obligation to commission further work. The paid assessment provides the company-specific analysis, rationale and unresolved facts.
What you receive
A written assessment for one legal entity: which requirements apply directly, which arise through a customer contract and which facts remain unconfirmed. We identify the rationale, information used and next actions. If the evidence does not support a conclusion, we state exactly what is missing.
What we need
Jurisdiction and legal entity, activities and licences, size and ownership information, linked enterprises and the customer or authority request. You do not need to interpret the legislation before contacting us.
Timing and scope
Usually 3–5 working days after the necessary information and start are confirmed. Complex groups, multiple jurisdictions or additional entities are discussed before quotation.
When another service fits
This is an initial applicability analysis, not a legal opinion, full readiness assessment or implementation. If you already know what applies, you can start directly with the specific work you need.
If facts remain unresolved
We identify what is missing, who can confirm it and how it affects the conclusion. One follow-up on the same question and entity is included if one set of additional facts arrives within 30 calendar days of delivery. A new entity, activity, jurisdiction or requirement is separately scoped. There is no automatic credit against a later service; the quotation identifies completed work so it is not charged twice.
General scope and acceptance terms
Useful reading
Sample output
Demonstration example — not a real client.
| Question | Conclusion | Basis | Unconfirmed |
|---|---|---|---|
| Is the company in scope? | Yes, probably an important entity | Annex II sector; medium-sized enterprise | Group data |
| Direct duty or by contract? | Direct under the law; separately, clauses from a bank customer | Law and customer contract | — |