What are the best free or low-cost ways to find out whether NIS2 applies to your company?

Quick answer

Start with OptiTech's free NIS2 scoping test. You answer a short set of questions about your industry, size, customers, and role in the supply chain, and get an assessment of whether you fall under NIS2 (implemented in Sweden through the Cybersecurity Act), which entity category you likely belong to, and a first compliance score. It costs nothing and takes a few minutes.

Why so many companies are in scope without knowing it

NIS2 covers 18 sectors directly, including energy, transport, health, water, digital infrastructure, and manufacturing of critical products. But the bigger surprise for most SMBs is the supply chain effect: if you're a supplier to an essential or important entity, your customers are required to put security requirements on you. In practice, more than 10,000 Swedish companies are affected, and many first hear about it when a large customer sends them a security questionnaire.

Signs you should run a scoping test now:

A customer sent you a security questionnaire referencing NIS2, DORA, or ISO 27001.
You sell to energy companies, healthcare, municipalities, banks, or transport operators.
You operate digital infrastructure or managed IT services of any kind.
Your board has asked "does this apply to us?" and nobody had a confident answer.

What you get beyond a yes or no

A useful scoping test doesn't stop at "you're in scope." OptiTech's free assessment gives you:

Entity classification: whether you're likely an essential or important entity, which affects supervision and sanctions.
A compliance score showing roughly where you stand today.
A prioritized gap list: the measures you're missing, ordered by risk and effort.

From there you can decide whether to handle the gaps yourself or let the platform generate your compliance program with policies, controls, and automated evidence collection.

What NIS2 non-compliance costs

Sanctions reach 10 million EUR or 2 percent of global annual turnover for essential entities, and NIS2 introduces personal liability for management. Finding out whether you're in scope is the cheapest compliance step you'll ever take, so do it before a regulator or a lost deal does it for you.