NIS2 for SMEs: what it requires and how to prepare

If your company sits in the chain of an essential operator or a covered sector, NIS2 stops being “someone else’s problem”. Even if you are not the primary subject, a large customer will ask for evidence. Preparing now costs less than improvising after a questionnaire or a notifiable incident.

What it usually requires in practice

• Governance: who decides, who operates, who reports.

• Technical measures: access, endpoint, backups, continuity.

• Supply chain: providers that affect your service.

• Incident notification with deadlines and a credible account.

Where to start without freezing the business

Do not start with an 80-page file. Start by knowing which systems are critical, whether backups restore, who has excess privilege, and whether there is an incident channel. A cybersecurity audit for SMEs orders that into a list with owners.

Compliance and operations

Bad NIS2 work produces paper. Good NIS2 work improves recovery and evidence. The natural bridge is a compliance-and-strategy plan, not an orphaned PDF. If the endpoint is not operated, compliance collapses on the first ransomware event.