NIS2 is here: what European SMEs must do before the next audit cycle

The original NIS Directive applied only to a handful of designated operators. NIS2 (Directive (EU) 2022/2555) widens the scope dramatically: any medium-sized company in 18 sectors now qualifies as either an "essential" or "important" entity. In Spain this is implemented via Real Decreto-ley 7/2025; in France via the LPM/SREN package; in the Netherlands via the Wbni update. The practical consequence is that an SME that previously had no statutory cybersecurity obligations now has the same minimum baseline as a regulated bank in many areas.

Scope is decided by sector + size. Medium-sized = 50+ employees or €10M+ turnover. Small entities can also be pulled in if they are the sole provider of a service, are critical for public order, or operate cross-border infrastructure.

• Essential: energy, transport, banking, drinking water, healthcare, digital infrastructure, public administration, space
• Important: postal/courier, waste management, manufacture of medical devices/electronics/machinery/vehicles, food production and distribution, chemicals, research, digital providers (online marketplaces, search engines, social platforms)
• B2B IT and managed-service providers fall under "ICT service management" — almost every MSP is in scope by definition
• Supply-chain rule: even out-of-scope SMEs that supply in-scope clients will be contractually pulled into compliance via vendor-risk clauses

NIS2 deliberately avoids prescriptive controls but requires "appropriate and proportionate" measures across ten domains. Auditors are converging on a Bitdefender-class EDR + MFA + backup + IRP combination as the de-facto minimum for SMEs.

• Risk analysis and information system security policies
• Incident handling (with a documented runbook and named owners)
• Business continuity, backup and disaster recovery, crisis management
• Supply-chain security, including direct supplier and service-provider assessments
• Security in network and information systems acquisition, development and maintenance — including vulnerability handling and disclosure
• Policies and procedures to assess effectiveness of cybersecurity risk-management measures
• Basic cyber hygiene practices and cybersecurity training
• Policies and procedures regarding the use of cryptography and, where appropriate, encryption
• Human resources security, access control policies and asset management
• Use of multi-factor authentication or continuous authentication, secured voice/video/text comms and secured emergency communication systems

Article 23 introduces a hard reporting cascade. Missing the early-warning window is a sanctionable breach in itself, separate from the underlying incident.

• T+24h: early warning to the national CSIRT (Spain: INCIBE-CERT / CCN-CERT; France: ANSSI; NL: NCSC-NL)
• T+72h: incident notification with initial assessment, severity, impact and indicators of compromise
• T+1 month: final report with root cause, mitigations applied and cross-border impact
• For "significant cyber threats" (not just incidents), affected service recipients must also be notified without undue delay

NIS2 is the first EU cyber law to attach personal liability to management. Boards must approve and oversee cybersecurity risk-management measures and can be held individually accountable for non-compliance. Fines mirror GDPR scale.

• Essential entities: up to €10M or 2% of global annual turnover, whichever is higher
• Important entities: up to €7M or 1.4% of global annual turnover, whichever is higher
• National authorities can suspend management functions and certifications for repeated failures
• Many member states (ES, DE, NL) have transposed criminal liability for wilful neglect

Auditors want evidence, not aspiration. The fastest path to a defensible posture is to map existing tooling against Article 21 and close the obvious gaps before you write the policy.

• Days 1–14: scope assessment + asset inventory + supplier list with cyber clauses flagged
• Days 15–30: deploy EDR (Bitdefender GravityZone tier matched to risk), enforce MFA on all admin and email, mandate immutable backups
• Days 31–60: write and approve incident-response runbook, business-continuity plan and supplier-security clauses; train staff; run a tabletop exercise
• Days 61–90: independent gap assessment, board sign-off, register with the national CSIRT, schedule quarterly reviews

We map your environment to Article 21 in one workshop, deploy the Bitdefender + Hornetsecurity + immutable-backup stack typically within 5–10 business days, and provide the documented incident-response runbook, supplier-clause template and board-pack you need for your first audit. Book a 30-minute discovery call and we will quote a fixed-price NIS2 readiness package within one business day.