NIS2 for SMEs: what it requires and how to prepare

If your company sits in the chain of an essential operator or a covered sector, NIS2 stops being “someone else’s problem”. Even if you are not the primary subject, a large customer will ask for evidence. Preparing now costs less than improvising after a questionnaire or a notifiable incident. What it usually requires in practice Governance: who decides, who operates, who reports. Technical measures: access, endpoint, backups, continuity. Supply chain: providers that affect your service. Incident notification with deadlines and a credible account. Where to start without freezing the business Do not start with an 80-page file. Start by knowing which systems are critical, whether backups restore, who has excess privilege, and whether there is an incident channel. A cybersecurity audit for SMEs orders that into a list with owners. Compliance and operations Bad NIS2 work produces paper. Good NIS2 work improves recovery and evidence. The natural bridge is a compliance-and-strategy plan, not an orphaned PDF. If the endpoint is not operated, compliance collapses on the first ransomware event.