NIS2 for small and mid-sized companies: what it actually asks

NIS2 is the European directive on the security of network and information systems (Directive (EU) 2022/2555). It replaced the first NIS directive in January 2023 and had to be written into national law by October 2024. Some countries did it on time, others are still debating it, but its content is fixed: it is the same text everywhere, and national laws may add to it, never take away.

For a company of fifty people, the question is rarely “how do we become compliant tomorrow”. It is “does this apply to us at all, and if it does, what is the first useful thing to do”. This guide answers both.

Who is covered

Three conditions decide, in this order.

Your sector. The directive lists eighteen sectors in two annexes. Annex I, “high criticality”: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure (data centres, cloud, DNS, content delivery networks, telecoms, trust services), managed IT and security services for other businesses, public administration and space. Annex II, “other critical sectors”: postal and courier services, waste management, chemicals, food production and distribution, manufacturing of medical devices, electronics, electrical equipment, machinery and vehicles, online marketplaces, search engines and social networks, and research.

Your size. Only companies that are at least medium-sized under the EU definition are covered by default: 50 staff or more, or both an annual turnover and a balance sheet total above 10 million euros. The whole group counts, including partner and linked companies.

A few exceptions to the size rule. DNS service providers, top-level domain registries and qualified trust service providers are covered whatever their size, and so are telecom providers. A state can also designate a small company that is the only provider of an essential service in the country.

The free NIS2 scope checker applies these rules for you, tells you the article that decides, and shows where the law stands in France, Germany and Ireland.

Essential or important

Covered entities fall into two categories. Large companies in an Annex I sector are essential; medium-sized ones in Annex I and medium or large ones in Annex II are important.

The duties are the same. The difference is supervision and fines: essential entities can be audited at any time and face fines up to 10 million euros or 2% of worldwide turnover; important entities are supervised after the fact, when there is a sign of a breach, with fines up to 7 million euros or 1.4%.

The ten measures of Article 21

Article 21 asks for “appropriate and proportionate” measures, and lists the minimum:

1. Policies on risk analysis and information system security.
2. Incident handling.
3. Business continuity: backups, disaster recovery, crisis management.
4. Supply chain security, including your suppliers’ security practices.
5. Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure.
6. Ways to assess whether the measures work.
7. Basic cyber hygiene and training.
8. Cryptography and encryption.
9. Human resources security, access control and asset management.
10. Multi-factor authentication and secured communications.

“Proportionate” matters. Nobody expects a 60-person food distributor to run a security operations centre. Regulators expect the measures to match the risk, and to be written down.

Incident reporting: 24 hours, 72 hours, one month

Article 23 sets the clock for a significant incident, one that disrupts your services seriously or causes considerable damage to others:

• an early warning within 24 hours of becoming aware of it, saying whether it may be malicious or have effects in other countries;
• an incident notification within 72 hours, with a first assessment;
• a final report within one month.

The 24-hour deadline is the one companies miss, because nobody knows who decides that an incident is significant, or who sends the warning. Decide it now, in one page: who declares, who notifies, who talks to customers.

Management is accountable

Article 20 makes the management body approve the security measures, oversee them, and follow training. In several countries, managers can be held personally liable when they did not. For a small company this is good news in disguise: security decisions stop being “the IT person’s problem”.

Where to start this month

1. Check whether you are covered, and if your country already requires registration (Germany does, with the BSI).
2. List what is exposed. You cannot protect what you do not know: domains, subdomains, mail servers, certificates, open ports. An outside audit gives you this list in minutes.
3. Fix the cheap, visible things first. E-mail that anyone can forge in your name (no DMARC policy, see SPF, DKIM and DMARC), certificates about to expire, services with known exploited vulnerabilities. They are what attackers try first, and what an assessor sees first.
4. Write the incident page described above.
5. List your critical suppliers and how you check them (see Supplier security under NIS2).
6. Keep evidence. Dated reports showing that issues were found and fixed are worth more than a policy nobody follows.

Not covered? Your customers may be

Many small companies meet NIS2 without being covered: a customer who is covered must check the security of its supply chain, and sends a questionnaire or adds clauses to the contract. Being able to show a recent external report, and how you fixed what it found, answers most of those questions.

How Perimetry helps

Perimetry Cloud audits your domains from the outside every week and links every finding to the NIS2 measure it relates to, in a compliance view you can export. Its attestation, checkable online, shows a customer or an assessor that you watch your exposure continuously. Suppliers are watched the same way, with the public checks only.