not legal advice

what the pages are

General information: a plain reading of public legal texts, written to help you plan work. Reading a page creates no adviser relationship.

what they are not

They are not an opinion on your company. Whether a rule applies depends on your activity, size, group structure and country, and on facts this site does not know. Tools like the finder give a starting point and cannot decide scope.

limits to keep in mind

• National law can differ. NIS2 reaches you through national law, and a member state can add to it. These pages cover the EU text first and name a national act only where one was read.
• Texts change. Each page shows the date it was last checked. After that date, the law may have moved.
• Authorities and courts decide. Words like "appropriate" get their meaning in decisions that may not exist yet.
• Standards are read second-hand. ISO 27001 and the SOC 2 criteria are not freely available, and their references here may need checking against your own copy.
• Mistakes are possible. Each page lists its texts so you can check for yourself. If a text and this site differ, the text wins.

when to ask a lawyer

Before you tell a regulator, an auditor, a customer or your board that a rule does or does not apply. Before you decide not to report an incident. Before you sign a contract with liability for security terms.