NIS2 compliance for SMBs: does it apply to you, and what comes first?
NIS2 is the EU cybersecurity law for mid-sized and larger companies in 18 sectors. Find out whether it covers you or reaches you through a customer, and what to do first.
Does it apply to you?
Three questions to check in two minutes.
Yes to the first two: you are probably covered. Yes only to the third: NIS2 still reaches you. The exact tests are in the section for your IT manager, below.
- Is your activity in one of the 18 sectors?For example energy, transport, health, digital services, food, chemicals, waste, or making machinery, electronics, vehicles or medical devices.
- Are you a medium-sized company or larger?In general, 50 staff or more, or turnover and balance sheet both above €10 million, counting your group. A few activities, such as DNS and trust services, are covered at any size.
- Does a covered company buy from you?Then its supplier checks reach you, even if the law does not cover you directly.
Not in scope?
Not covered yourself? Your customers may be.
Covered companies must check the security of their direct suppliers. So they send security questionnaires and add clauses to contracts, even to small suppliers. A clear, documented answer keeps those renewals moving.
how we answer customer questionnairesWhat changes for you
Management signs off on security, and answers for it.
If you are covered, your management must approve the company's security measures, oversee them and take training. Serious incidents must be reported quickly, starting with a first alert within 24 hours.
The real risk is to your customers' trust: a public enforcement notice or a reported breach usually costs more than the fine. The fix is a short list of measures, put in place in the right order, with evidence you can show. If you already hold ISO 27001, much of it is there.
NIS2 applies through each country's own law, so dates and registration rules vary. Belgium, Germany and Luxembourg, among others, already apply it; France has not yet adopted its law.
What to do first
Get a clear answer, then fix what matters most.
What we deliver
- A documented answer: covered or not, essential or important, and where to register
- Your gaps against the ten required measures, ranked by risk
- An incident plan your team can follow, with the 24-hour alert ready to send
- Supplier checks and contract clauses that hold up with your customers
- Training for your management on its new duties
Who does what
We lead the work. Your IT provider keeps the technical side.
What we lead
- Work out whether NIS2 covers you, and how
- Rank the gaps and set the plan
- Write the policies and the incident procedure
- Train your management and report to it
- Prepare your registration (you file it)
What stays with your IT provider
- Set up multi-factor authentication, backups and logging
- Apply updates and fix the technical gaps
- Run your systems day to day
We check their work against the plan, so the technical changes add up to compliance.
How it starts
Your first step: the NIS2 Scope & Gap Sprint.
In 15 business days you know whether NIS2 applies, how you would be classified, whether you must register, and which gaps to fix first. The fee is fully deducted if you continue with us within 60 days.
- From
- €4,900excl. VAT
- Duration
- 15 business days
- Your time
- 3–6 short interviews
Fixed price, set by your headcount.
see the Scope & Gap SprintFor your IT manager, DPO or CFO
The ten security measures NIS2 requires.
- 01Art. 21(2)(a)
Risk analysis & security policies
Documented information security policies and a working risk analysis-and-treatment process.
- 02Art. 21(2)(b)
Incident handling
Documented procedures for detection, classification, response and reporting, including the NIS2 notification timelines.
- 03Art. 21(2)(c)
Business continuity & crisis management
Continuity plans, backup management, disaster recovery and crisis management procedures.
- 04Art. 21(2)(d)
Supply-chain security
Security requirements for direct suppliers and service providers, including assessment of each supplier's practices.
- 05Art. 21(2)(e)
Security in acquisition & development
Security across procurement, development and maintenance of network and information systems, including vulnerability handling.
- 06Art. 21(2)(f)
Effectiveness assessment
Policies and procedures for assessing the effectiveness of risk management measures: regular audits and testing.
- 07Art. 21(2)(g)
Cyber hygiene & training
Basic hygiene practices and awareness training for all staff, plus dedicated training for management bodies under Article 20.
- 08Art. 21(2)(h)
Cryptography & encryption
Policies on the use of cryptography and, where appropriate, encryption of data at rest and in transit.
- 09Art. 21(2)(i)
HR security & access control
Access control, asset management, joiner/mover/leaver processes and the security of human resources.
- 10Art. 21(2)(j)
MFA & secure communications
Multi-factor authentication, continuous authentication where appropriate, and encrypted voice, video and text communications.
Fines differ for essential and important entities.
Article 20 makes management bodies approve and oversee the security measures, follow training and answer for failures. Beyond fines, authorities can issue binding instructions, require organisations to inform customers about threats, and order them to make infringements public. For essential entities they can also, as a last resort, request a temporary ban on the CEO or legal representative exercising management functions (Article 32(5)(b)).
For a company selling to other businesses or working in a regulated sector, the reputational cost of a public enforcement action, or of a notified breach, usually outweighs the fine itself.
Essential entity max fine
€10M / 2%
whichever is higher, of total worldwide annual turnover.
Important entity max fine
€7M / 1.4%
whichever is higher, of total worldwide annual turnover.
Three-stage report
24h · 72h · 1mo
early warning within 24 hours and notification within 72 hours of becoming aware; final report within one month of the notification.
How long it takes
It depends on where you start. ISO 27001 already in place? Faster.
4–8 weeks
From an existing ISO 27001 baseline
A focused programme closing the NIS2-specific gaps: 24-hour notification process, registration with the national authority, supplier assessment, management training.
3–6 months
From limited existing controls
End to end: gap analysis, risk assessment, policies, incident response, supplier assessment, staff training, and oversight of the technical controls your IT team or provider puts in place.
FAQ