Scope assessment for security duties: stages and deadlines
A scope assessment for security duties establishes whether your organisation sits inside the current cybersecurity and data-protection regime, and at which tier. It checks sector, size and the sensitivity of the service you provide against the applicable thresholds, then fixes the registration and reporting deadlines that follow from the result.
What the assessment covers
The exercise turns a general regulatory regime into a specific answer for your organisation. It checks three things in sequence: whether your sector is covered at all, whether headcount and turnover clear the relevant thresholds, and whether the service you provide is treated as sensitive enough to move you into a stricter tier.
The output is a written classification, not an opinion. It states in-scope or out-of-scope, names the tier if one applies, and lists the duties that follow. Registration, incident reporting and technical measures all depend on this document.
Stages and typical timing
| Stage | What happens | Typical duration |
|---|---|---|
| Intake call | We collect a description of your sector, group structure and services | Same week |
| Document collection | Corporate structure, service descriptions, headcount and turnover figures are gathered | One to two weeks |
| Threshold mapping | Figures are checked against the thresholds that apply to your sector | A few working days |
| Draft classification | A written scope conclusion is prepared and reviewed internally | One week |
| Registration, if in scope | Filing with the competent authority, where registration applies | Set by the authority's own calendar |
| Reporting calendar | Internal deadlines for ongoing notification duties are fixed | Immediately after registration |
The point of no return sits at registration. Before that stage, a draft classification can be revised without formal consequence. After filing, a change of position runs through an amendment request rather than a quiet correction.
Practical consequence
An organisation that skips the assessment does not avoid the duties. It meets them without warning, usually at the moment an incident forces disclosure. A completed assessment moves the deadline pressure from reactive to planned, and it leaves a defensible record that the classification was considered.
What to do
- Assign one internal owner for the assessment before work starts.
- Collect the group structure, service descriptions, headcount and turnover figures.
- Run the sector and threshold check against the current regime.
- Have the draft classification reviewed by whoever signs off regulatory filings internally.
- File the registration, if the result requires it, ahead of the authority's published deadline.
- Set the recurring reporting calendar and assign an owner for each duty on it.
Who decides
The classification is prepared by your team, with legal input where the sector line is unclear. It is not unreviewable: the competent national authority can question a classification after the fact, particularly if an incident later shows the organisation was in scope and had not registered. Sign-off should sit with whoever is accountable for regulatory filings, not with the technical team alone.
If your situation differs
If the assessment runs alongside an acquisition, a change of control in your commercial contracts can trigger its own termination deadline, separate from the security review — see When a change of control triggers termination: the deadline.
If a dispute over inventorship runs in parallel, keep the two matters apart. An ex-employee named on a related filing follows a separate timeline — see When an ex-employee appears as an inventor elsewhere: the.
If a vendor contract central to the service under review is up for renewal, treat the two clocks separately — see When the renewal price doubles: the deadline that matters.
If the assessment coincides with preparing a token listing, the listing timeline runs independently and should not wait on the scope conclusion — see Listing preparation step by step in detail.
Cost factors
Cost moves with three variables: how many jurisdictions your group operates in, how many registers or authorities apply to your sector, and whether a statutory deadline is already running when work starts. One jurisdiction with no open regulator inquiry is materially lighter than several registers under time pressure.
A partner responds within minutes during business hours. A firm price for the assessment follows within one business day of intake.
What this page does not cover
This page does not decide whether your specific organisation is in scope; that depends on facts we have not seen. It does not set out the technical measures required once a duty applies, and it does not cover incident notification once an event has occurred.
Verified
Reviewed on 4 November 2025. Based on publicly available guidance issued by the relevant national and EU-level supervisory bodies responsible for cybersecurity and data-protection oversight.
Related reading
Once a classification exists, most organisations move to Gap review and remediation plan to close whatever the assessment surfaced.
Frequently asked questions
How long does scope assessment for security duties take in practice?
A first classification typically takes two to four weeks from intake to draft conclusion, assuming the group structure and service descriptions are ready when the process starts. Registration, if required, adds the authority's own processing time on top.
Which documents are needed to start?
You need a current group structure chart, a description of each service offered, headcount and turnover figures by entity, and a list of any existing security certifications or prior regulatory correspondence. Missing figures slow the threshold check rather than stopping it.
What happens if the other side does not respond?
Where the assessment depends on a subcontractor or group entity supplying figures, a non-response does not suspend the deadline. Escalate in writing, set a short internal cut-off, and complete the classification on the best available information, flagging the gap for later correction.
Related: When an SLA credit regime is triggered in detail covers an adjacent deadline-driven scenario.
Related: What to do first in this situation in practice covers a related security-duties scenario.