NIS2: the big challenge coming for SMEs (and why it's not just a "big company" issue)

Over the last few months we have had many conversations with companies that are starting to hear about NIS2 as if it were a distant regulation designed only for critical infrastructure or corporations with thousands of employees. The reality is different: NIS2 has a much broader scope and will have a direct impact on thousands of Spanish organisations, especially in sectors where SMEs operate that have never before had to meet such strict cybersecurity obligations.

According to the European Commission, NIS2 aims to drastically raise the minimum security standard across the Union, requiring every link in the chain, large or small, to adopt robust controls. In the words of ENISA, the EU cybersecurity agency, "supply chain security will be one of the fundamental pillars of the new regulatory framework". And this is where SMEs come in: many act as essential suppliers to larger companies, which makes them critical pieces of a much wider system.

The structural problem: the gap between obligations and capabilities

The OECD itself has pointed out that small and medium-sized enterprises have, on average, "a significantly lower level of cybersecurity maturity" than large organisations, which translates into a lack of resources, tools, processes and specialised talent. Add to this that NIS2 will require measures such as advanced risk management, continuous monitoring, mandatory incident reporting within strict deadlines and supply chain control, and the challenge grows.

Many SMEs today have no dedicated security teams, up-to-date asset inventories, incident response plans or minimal monitoring capabilities. And yet, according to Spain's National Cybersecurity Institute (INCIBE), "the attack surface of Spanish companies has grown steadily in recent years, especially in the SME segment".

A cultural change more than technical compliance

One of the most relevant, and least discussed, points of NIS2 is that ultimate responsibility lies with senior management. According to the European Commission, executives may even face personal liability if negligence in adopting adequate security measures is proven.

This forces a deep cultural change: security stops being a "technical" area and becomes a strategic matter that affects contracts, company reputation, operational continuity and the ability to do business inside and outside Spain.

The most underestimated challenge: proving compliance

NIS2 not only requires implementing measures; it requires being able to prove they exist, that they are applied and that they are reviewed. And as several studies by Deloitte and PwC warn, companies without documentary maturity (demonstrated mainly through policies, processes, evidence, reporting, internal audits, etc.) will find it very hard to justify their compliance when the time comes.

For many Spanish SMEs this will be the biggest challenge: moving from informal management to structured management based on verifiable controls.

An opportunity to professionalise security

Although it may seem contradictory, NIS2 is also a great opportunity. Companies that start preparing today will be able to:

• stand out from their competitors,

• access contracts with stricter requirements,

• reduce their risk surface,

• and avoid unnecessary penalties.

And this does not require disproportionate investment or 10-person teams. It requires methodology, prioritisation and expert support.

At Ciberseguridad 720 we have spent months helping SMEs take this leap: from NIS2 gap analyses to implementing technical controls, generating evidence, designing processes, supporting management and building a realistic, sustainable cybersecurity culture.

NIS2 is not the future, it is the present

The entry into force of NIS2 should not be seen as a burden but as an invitation to professionalise security and reduce risk in an environment where cyberattacks keep growing. As ENISA has stated, "the resilience of the European ecosystem will depend on every actor, large or small, taking on its role in collective protection".

SMEs now have the opportunity, and the obligation, to do so.

If you need to understand how NIS2 will affect your organisation or where to start, we will be glad to help. At Ciberseguridad 720 we are supporting companies that, just like yours, want to prepare with vision rather than urgency.