NIS2 is the European Union’s cybersecurity directive for organisations that provide services society and the economy depend on. For a small or midsize company the practical questions are simple: does it apply to us, what would we be expected to have in place, and what should we do first? BlueNova IT is a Tallinn-based IT company that offers cybersecurity services for small and midsize companies. This guide explains the directive in plain language and focuses on sensible preparation, not shortcuts.
General information, not legal advice. Check the official sources: the text of Directive (EU) 2022/2555 (NIS2) on EUR-Lex and the rules and guidance published by your national cybersecurity authority. Whether NIS2 applies to your company, and what your country requires, must be confirmed with legal counsel or that authority. Using this guide does not guarantee compliance, and BlueNova IT does not give legal advice or certify compliance.
What NIS2 is, and what it is not
NIS2 is Directive (EU) 2022/2555, the successor to the original NIS Directive. It aims for a higher common level of cybersecurity across the Union by requiring organisations in certain sectors to manage cyber risks, report significant incidents and accept supervision by a national authority.
Two points are easy to miss. First, a directive does not apply directly to companies: each member state transposes it into national law, so the exact rules, the competent authority and the penalties differ by country. The transposition deadline was October 2024, but national progress has not been uniform, so check the current position wherever you operate. Second, NIS2 is not a certificate. There is no official "NIS2-compliant" badge to buy; the law looks for appropriate measures that can be shown to the authority if requested.
Does NIS2 apply to a company of your size?
The directive works through three questions: your sector, your size and the kind of service you provide.
- Sector. Annex I lists sectors of high criticality, such as energy, transport, banking, health, drinking water, digital infrastructure and ICT service management for other businesses. Annex II lists other critical sectors, such as postal services, waste management, chemicals, food, certain manufacturing and digital providers.
- Size. As a general rule the directive covers medium-sized and large entities in those sectors. Medium-sized follows the EU recommendation on SMEs: roughly 50 or more staff, or turnover or balance sheet above EUR 10 million. Small and micro companies are generally outside the core scope.
- Exceptions. Some entities are covered whatever their size, for example certain providers of public electronic communications, trust services or DNS services, or the sole provider of an essential service in a member state. Member states can also extend the rules to smaller organisations.
Entities in scope are classed as essential or important, and supervision differs between the two. The details depend on national law, which is another reason to confirm locally.
A quick way to sort yourself. This sequence helps you organise the question before you take it to legal counsel or your national cybersecurity authority. It is a screening aid, not a determination, so check the current text of the directive and your national transposition at each step.
- Where are you established, and where do you provide services? List each EU country involved. Each member state has its own transposing law and competent authority.
- Does your activity appear in Annex I or Annex II? Read the annexes on EUR-Lex rather than relying on a summary. Annex I includes ICT service management for other businesses, which can include managed IT providers.
- How large are you? Compare headcount, turnover and balance sheet with the EU definition of SMEs. As a general rule, medium-sized and large entities in the listed sectors are covered, and small and micro companies generally are not.
- Is there an exception or a national extension? Some entities are covered whatever their size, and some countries apply the rules more widely.
- Do you supply a company that is in scope? Even if the answers above point outside the directive, expect security questionnaires and contract clauses from those customers.
How to read the result. If the answers suggest you may be in scope, or you cannot tell, take the question to legal counsel or your national authority and start with the checklist below. If they suggest you are outside the scope, customers may still ask you for evidence, so the same checklist is a sensible baseline. Nothing in this section is a legal conclusion.
If you are below the threshold, keep reading. Customers that are in scope must manage the security of their supply chain, so they may send you questionnaires or change contract terms. A small supplier can feel NIS2 without being regulated by it. Our guide to NIS2 supplier requirements covers what those customers typically ask for and which evidence to keep.
What the directive expects, in plain language
This is a summary, not a replacement for the directive text, which is available on EUR-Lex.
- Management accountability (Article 20). The management body approves the risk-management measures, oversees their implementation and can be held accountable. Managers are expected to receive training.
- Risk-management measures (Article 21). Appropriate and proportionate technical, operational and organisational measures. The minimum areas include risk analysis and security policies, incident handling, business continuity such as backup management and disaster recovery, supply-chain security, basic cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication where appropriate.
- Incident reporting (Article 23). Significant incidents are reported to the national authority or CSIRT in stages.
- Supervision and penalties. Authorities can request information, audit and order corrective action. The directive sets minimum levels for maximum fines and national law decides the rest; we mention this only as general context.
Note the words "appropriate and proportionate". Measures should reflect size, exposure and the likely impact of an incident, which leaves a smaller company room to start with sensible basics.
The incident reporting timeline
Article 23 describes three steps for significant incidents. National law sets what counts as significant and who receives the report, but the timeline is:
- Early warning, within 24 hours of becoming aware of the incident.
- Incident notification, within 72 hours, with an initial assessment of severity and impact.
- Final report, within one month of the incident notification, covering the likely root cause and the mitigation applied.
You cannot meet a 24-hour deadline if nobody knows who decides, who calls whom and where the contact details are. For a company with nothing written down, a short incident procedure is often the most valuable single document.
How NIS2 connects to everyday IT controls
Most Article 21 measures translate into ordinary IT hygiene. For a company without a security team, the useful way to read the directive is as a list of questions about daily practice:
- Accounts and access. Who can sign in to what, whether multi-factor authentication is used consistently, who holds administrator rights, and how leavers and new starters are handled. Our Microsoft 365 security baseline checklist covers these points for Microsoft 365.
- Backups and continuity. What is backed up, where copies are kept, who can delete them, and whether a restore has ever been tried. A backup that has never been restored is an assumption, not a safeguard. Our backup and recovery guide explains RTO, RPO and restore tests.
- Devices and cloud services. An inventory, a way of applying updates, disk encryption, and clear rules for sharing outside the company.
- Suppliers. Who hosts your data or runs critical systems, what access they have, and what they must do when something goes wrong.
- People. Short, practical awareness sessions, and enough management understanding to approve decisions knowingly.
First steps for a small or midsize company
- Establish whether you are likely in scope. Note your sector, headcount, turnover, countries and any services you give to in-scope customers, then confirm with legal counsel or the national authority.
- Name an owner in management, because accountability sits at that level.
- Write down what you have: systems, accounts, devices, cloud services, suppliers and the data they hold.
- Check the basics: multi-factor authentication, administrator rights, updates, and backups with a tested restore.
- Write a one-page incident procedure: who decides, who is informed and which systems come back first. Our one-page disaster recovery plan guide covers the recovery side.
- Keep short records of decisions, reviews and tests, then agree priorities and a review date.
A practical NIS2 readiness checklist
Use this list as a working document once you have a view of your likely position. It follows the areas Article 21 names, in general terms, and turns them into questions about daily practice. It is not a compliance test: answering every line does not show that the directive is satisfied, and national rules may ask for more.
| Area | Question to answer | Evidence worth keeping |
|---|---|---|
| Governance | Has management named an owner, agreed the priorities and received basic training? | A named owner, short meeting notes, training dates |
| Inventory | Do you know which systems, accounts, devices, cloud services and data you rely on? | An inventory with an owner and a review date |
| Access | Is multi-factor authentication used consistently, and are administrator rights limited and reviewed? | Settings exports, a list of administrators, starter and leaver records |
| Backups and recovery | What is backed up, who can delete the copies, and when was a restore last tested? | The backup scope, a restore test record |
| Updates and devices | How are systems and devices updated and encrypted, and what happens when one is lost? | An update routine, a device list, a lost-device procedure |
| Incidents | Is there a one-page procedure saying who decides, who is informed and which systems return first? | The procedure, a contact list, a note of any practice run |
| Suppliers | Which suppliers host your data or run critical systems, and what do the contracts say about security and incidents? | A supplier list, the relevant contract clauses, questionnaire answers |
| People | Do staff know what to report, and to whom? | Short session records, a reporting route |
Keep the evidence short and up to date. If you would like help turning the answers into a prioritised plan, see what an IT partner can and cannot do below.
What an IT partner can and cannot do
An IT partner can make the practical side clearer; it cannot take over your legal responsibility. Our cybersecurity services for small and midsize companies start with a structured review of accounts, devices, backups, network and cloud settings, and incident preparation. In a NIS2 context we can help you:
- review what is actually in place and document it, with the open gaps, in plain language (see how a security audit differs from a vulnerability scan or a penetration test);
- prepare answers to customer or contractual security questionnaires;
- group improvements by impact and effort and agree who owns each one;
- support the day-to-day work through our managed IT services, with scope agreed separately.
We do not give legal advice, decide whether NIS2 applies to you, certify compliance, or guarantee that an authority will consider your measures sufficient. Support is in English and Spanish, Monday to Friday, 09:00 to 18:00 CET. To start with a review, contact us and tell us briefly about your teams, locations and main concerns.
Related: cybersecurity services for small and midsize companies, managed IT services, How to choose cybersecurity services.
Sources
- Directive (EU) 2022/2555 (NIS2), official text on EUR-Lex: the legal text behind the scope, management accountability (Article 20), risk-management measures (Article 21) and incident reporting (Article 23) summarised above
- Commission Recommendation 2003/361/EC, on EUR-Lex: the EU definition of micro, small and medium-sized enterprises used for the size test
- European Commission: NIS2 Directive: official overview of the directive and its aims
