NIS2 for Small and Medium Businesses: Who Is Covered and What to Do

NIS2 is the European Union’s updated cybersecurity directive. It widens the list of sectors that must manage cyber risk, sets clear duties for management, and introduces strict deadlines for reporting incidents. Many small and medium businesses assume it only concerns banks and utilities. That assumption is often wrong.

Who is covered by NIS2?

NIS2 applies to organisations in sectors the directive lists as essential or important. These include energy, transport, banking, health, water, digital infrastructure, managed service providers, public administration, manufacturing of certain products, food, waste management, postal services and digital providers. As a general rule, medium-sized and large organisations in those sectors are in scope. Size is not the only test, though: some entities are covered whatever their size, and suppliers to covered organisations are often pulled in through contracts.

Because each EU country transposes the directive into its own law, the exact scope and the competent authority depend on national legislation. Check the current position in each country where you operate before you decide that you are out of scope. If a customer or regulator has already asked you about NIS2, treat that as a signal to assess seriously.

What NIS2 asks you to do

• Manage cyber risk. Put in place technical and organisational measures that match your risk: access control, multi-factor authentication, encryption, backup, vulnerability handling, secure development and supply chain security.
• Make management accountable. Senior management must approve the measures and can be held responsible for failing to apply them. Training for management is part of the expectation.
• Report significant incidents. An early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.
• Control your suppliers. You are expected to look at the security of the third parties you depend on.

What is at stake

For essential entities the directive allows administrative fines of up to 10 million euro or 2% of worldwide annual turnover, whichever is higher. For important entities the figures are 7 million euro or 1.4%. National authorities can also order audits and, in serious cases, hold individual managers to account. Fines are the worst case. The more common cost is losing a contract because you cannot show evidence of your controls.

A practical starting point

1. Check applicability. Confirm your sector, your size and whether you supply covered organisations.
2. Run a gap assessment. Compare what you do today with the measures the directive expects, and list the gaps by risk.
3. Write down the basics. Policies, an asset inventory, a risk register and an incident response plan. Auditors look for evidence, not intentions.
4. Prepare to report. Decide who detects, who decides and who notifies, so that the 24-hour and 72-hour deadlines are realistic at three in the morning.
5. Review your suppliers. Start with the ones that hold your data or run your systems.

How Guardbyte can help

We assess whether NIS2 or DORA applies to you, run the gap analysis, and help close the gaps with the right controls and monitoring. Read our NIS2 and DORA compliance guide, see how a compliance platform keeps evidence in one place, or talk to our advisory team.

This article is general information and not legal advice. Confirm your obligations with your legal adviser and the competent authority.