Most organisations approach NIS2 by asking what they have to do. The more useful first question is narrower: are you in scope, and in which countries. Everything downstream, the size of the programme, the budget, the board briefing, depends on that answer, and it is the answer most organisations never actually establish.
Where the ambiguity sits
The sector and size criteria look straightforward. In practice, three things complicate them. Group structures put different entities in scope in different Member States. National transpositions vary, so an entity in scope in one country may sit outside it in another. And competent authorities retain the power to designate entities that the headline criteria would miss.
An organisation that assumes one country's position applies across the group will either over-invest in places that do not need it or, more dangerously, leave a genuinely in-scope entity unaddressed.
Settle it early, and cheaply
Scope is a five-day question. A focused diagnostic establishes provisional scope by entity, sector, and jurisdiction, tests governance readiness, and maps the gap across the security obligations. It produces a brief the management body can act on, and it does so before any programme commitment is made.
Once scope is settled, the programme can be shaped to what is actually required, in the countries where it is actually required, and the board is briefed on a position that will hold.