NIS2 readiness checklist for European SMEs

NIS2 (Directive (EU) 2022/2555) covers “essential” and “important” entities across 18 sectors. For SMEs, the practical test is: do you have ≥50 employees or ≥€10M turnover AND operate in energy, transport, banking, healthcare, drinking water, digital infrastructure, ICT service management, public administration, space, postal, waste, chemicals, food, manufacturing of medical devices/computers/electronics, digital providers, research, or are you a managed service provider? If yes, you are in scope. National competent authorities (INCIBE in Spain, ANSSI in France, NCSC-NL, BSI in Germany) maintain registers — registration is mandatory.

• Confirm your sector classification against Annexes I & II
• Register with your national competent authority
• Designate a board member personally accountable for cyber risk
• Document your scope decision in writing — auditors will ask

NIS2 mandates risk-based technical, operational and organisational measures. The Article 21(2) list is the floor — auditors will sample evidence for each.

• Risk analysis and information system security policies
• Incident handling (detection, response, recovery)
• Business continuity and crisis management
• Supply chain security (including direct supplier risk)
• Network and information system acquisition, development and maintenance security (incl. vulnerability handling)
• Policies to assess effectiveness of measures
• Basic cyber hygiene practices and training
• Cryptography and encryption policies
• Human resources security, access control, asset management
• MFA, secured voice/video/text, and secured emergency comms

Significant incidents trigger a strict three-stage clock that starts the moment you become aware. Missing any stage is independently sanctionable.

• Within 24 hours: early warning to CSIRT/competent authority indicating whether the incident is suspected of being malicious or having cross-border impact
• Within 72 hours: incident notification with initial severity assessment, IoCs and updates to the early warning
• Within 1 month: final report including detailed description, threat type, mitigation measures and (if applicable) cross-border impact

Maximum administrative fines reach €10M or 2% of global annual turnover (essential entities) and €7M or 1.4% (important entities). Critically, NIS2 makes the management body personally liable for compliance breaches — including potential temporary bans from holding management functions in essential entities.

• Boards must approve and oversee cyber risk measures
• Management must follow regular cyber training
• Member states may publish names of breaching entities
• D&O insurance does not cover regulatory fines in most EU jurisdictions

If you have not started, this is the minimum-viable path. Most SMEs we onboard complete it in 60-90 days with 1-2 internal hours per week plus our team.

• Weeks 1-2: scope confirmation, gap assessment against Article 21, register with authority
• Weeks 3-6: deploy MFA everywhere, EDR on all endpoints, encrypted backups, asset inventory
• Weeks 7-10: write and approve the 8 mandatory policies, run incident-response tabletop, train staff
• Weeks 11-13: supplier risk questionnaires, internal audit, board sign-off and evidence pack