Your Company Is Probably NIS2 In Scope (Here's the 10-Minute Test)

The EU gave member states until November 2024 to transpose NIS2 into national law. Most of the coverage was about power grids and hospitals. Almost none of it was about you.

NIS2 is not another critical-infrastructure law

The first NIS directive (2016) was about energy, transport, and banking — the stuff that breaks the news. NIS2 (Directive 2022/2555) is different in one way that matters to you: it's size-based, not just sector-based.

If you're a medium-sized company (50+ employees or €10M+ in annual turnover) in one of the 18 listed sectors, you're an "important entity." If you're large (250+ employees or €40M+), you're in scope regardless of most other factors. Small companies are mostly out — unless your national law says otherwise, or you sit in the supply chain of a company that's in.

That last part is the one most people miss. NIS2 pushes obligations down the supply chain. Your client's compliance team will start asking you questions you've never been asked before.

The 10-minute test

Three questions. Answer honestly.

1. Do you have 50+ employees or €10M+ in turnover?

If yes, you're a medium or large company. Now check the sector list — energy, transport, banking, health, water, digital infrastructure, ICT service management (B2B), public administration, space, postal and courier, food, manufacturing of critical products, digital service providers, and a few more (the full list is Annex I of the directive). In one? You're in scope. Not in one? Keep going.

2. Are you under 50 employees and under €10M?

You're a small company. You're in scope only if you operate in one of the listed sectors — and even then, several member states exempt small companies from some obligations. Check your national law; transposition timelines varied and the details differ by country.

3. Who are your top five clients?

If any of them is an essential or important entity, expect NIS2-driven requirements to land on your desk as contract terms: security questionnaires, incident notification clauses, audit rights. You may not be "in scope" legally — you'll still feel it commercially.

The 5 things you actually have to do

NIS2's risk-management requirements (Article 19) read like a list of boring basics. That's the point.

1. Risk management measures

Risk analysis, incident handling, supply chain security, secure development, access control, MFA, encryption, patching, backups. Notice what's not on the list: no specific product, no certification to buy. It's the fundamentals — done consistently.

2. Incident reporting

Three deadlines: a 24-hour early warning, a 72-hour notification, and a final report within one month — to your national authority. Most SMBs have never reported an incident in their life. The first time it happens, the clock is already running.

3. Management responsibility

This is the genuinely new part. Senior management is accountable for risk-management measures — and must be trained on cyber risk. In several member states, that accountability is personal: if the board didn't do its job, the board answers for it. "It's IT's problem" stopped being a valid answer in 2024.

4. Supply chain security

You assess the risk your suppliers pose to you, and they do the same for you. If you're a vendor to an in-scope company, expect their security questionnaire. Have answers ready before they arrive.

5. Basic cyber hygiene, documented

Vulnerability management, secure software development for anything you build, and — the part everyone skips — writing it down. An auditor doesn't care that you patch. They care that you can show when, how, and who decided.

What it costs to ignore

Penalties scale with the entity: up to €10M or 2% of worldwide annual turnover for essential entities, €4.5M or 1.5% for important ones. The fine is the easy part to understand. The expensive part is the incident that happens while you're "not yet compliant" — insurers and clients notice.

Quick wins you can start this week

• MFA everywhere. It's on the Article 19 list for a reason. If you haven't done it, start with your email and VPN — here's how to do it without breaking the budget.
• Test your backups by restoring them. A backup you've never restored is a hope, not a control. Your IR plan should name who does the restore — build one in an afternoon.
• Ask your top five clients one question: "Are you NIS2 in scope, and do you have security requirements for suppliers?" Ten minutes of email buys you a year of surprise avoidance.
• Write down your incident contacts. Who calls whom when something breaks at 2am. One page, pinned somewhere people actually look.