The avalanche of cybersecurity regulations: a growing challenge for SMEs (and an opportunity for those who prepare)

In recent years the cybersecurity regulatory landscape has changed dramatically. According to the European Union Agency for Cybersecurity (ENISA), more than 60% of Member States have updated, or are in the process of updating, their regulatory frameworks to align with the new NIS2 Directive, approved by the European Parliament in 2022.

This directive aims to create a common, high level of cybersecurity across the European Union. But unlike its predecessor (NIS1), NIS2 significantly broadens the scope, covering not only large organisations or critical sectors but also hundreds of thousands of medium-sized companies that are part of their supply chains.

In other words: protecting your own infrastructure is no longer enough. You must now also make sure that your suppliers and business partners meet minimum security standards. While this is excellent news for strengthening cybersecurity in Europe, it is an enormous challenge for SMEs, the backbone of the continent's economy.

According to the European Commission, 99% of companies in Europe are small or medium-sized, and many of them have neither dedicated security teams nor specific budgets to comply with this kind of regulation.

The balance between protection and regulatory burden

From a strategic perspective, NIS2 (together with other regulations such as DORA for the financial sector or the Cyber Resilience Act for manufacturers of digital products) marks an important milestone: Europe is laying the foundations of a shared digital security culture.

The problem is that, at the same time, obligations have become more complex. Companies must demonstrate cybersecurity governance, incident detection and response capabilities, periodic risk assessments and compliance with recognised standards.

This means that closing B2B deals will become increasingly difficult for companies that cannot show an Information Security Management System (ISMS) or a solid compliance framework. Many large corporations, especially in sectors such as technology, healthcare, finance or energy, already require proof of compliance from their suppliers before signing contracts.

Various studies indicate that 57% of European SMEs lost business opportunities over the last year because they did not meet the minimum cybersecurity requirements demanded by their corporate clients.

Where to start? ISO/IEC 27001 as the pillar of compliance

Given this landscape, the logical question is: how can SMEs start preparing without facing unaffordable investments?

The most effective and sustainable answer is to start with the gradual implementation of ISO/IEC 27001, considered the core international standard for information security management.

This standard provides a clear structure to:

• Identify and classify information assets.

• Assess the risks they are exposed to.

• Define controls and policies adapted to each company's reality.

• Demonstrate compliance to clients, auditors or regulators.

Implementing ISO 27001 not only improves your security posture but also serves as a foundation for complying with future local or sector regulations, such as Spain's National Security Framework (ENS), NIS2 itself or even cybersecurity requirements from other countries (such as CMMC in the US or the LGPD in Brazil).

As the European Union Agency for Cybersecurity (ENISA) points out in its 2023 report on organisational cyber resilience, companies that adopt ISO 27001 ahead of regulatory requirements "reduce the time and cost of later adapting to new laws or directives by more than 40%".

Realistic strategies for SMEs

Not every organisation can hire a security team or fully outsource its ISMS, but there are realistic and sustainable strategies to move forward step by step:

1. Initial risk assessment: start with a basic security maturity assessment (level of compliance, vulnerabilities, existing policies, etc.).

2. Setting priorities: focus resources on the most critical assets: invoicing systems, email, backups, client data.

3. Creating basic policies and procedures: password management, access control, secure remote work, backups and incident response.

4. Staff training and awareness: the human factor remains the main cause of incidents.

5. Progressive automation: use open-source tools and secure cloud solutions to reduce costs without sacrificing protection.

6. Review and continuous improvement: set quarterly or half-yearly reviews to adjust the system and show progress.

From obligation to strategic value

Regulatory compliance should not be seen as an imposition but as an opportunity to stand out. Companies that build cybersecurity into their business strategy will be better positioned to compete in increasingly demanding and regulated markets.

NIS2, DORA and the Cyber Resilience Act are not just laws: they are the reflection of a Europe seeking digital maturity. Those who adapt early will not only avoid penalties but will become preferred partners of large companies looking for secure and reliable ecosystems.

Because in the end, real transformation is not about complying out of obligation, but about seeing cybersecurity as a value that generates trust, continuity and growth.

At Ciberseguridad 720 we specialise precisely in supporting SMEs through this maturity process. Our approach is based on democratising cybersecurity, offering solutions adapted to the operational and budgetary reality of small and medium-sized businesses. We help our clients implement frameworks such as ISO 27001 progressively, integrating risk management, regulatory compliance and staff training. In this way we turn what used to be a regulatory burden into a real competitive advantage, strengthening their reputation and preparing them for a business environment that is increasingly demanding in terms of digital security.