The NIS2 Directive applies to thousands of SMEs and mid-sized companies across Europe. Whether it applies to a given company depends on three criteria: size, business sector, and position in the supply chain of regulated customers.
The Network and Information Security Directive 2 (Directive (EU) 2022/2555) entered into force on 16 January 2023, with a transposition deadline of 17 October 2024. Transposition remains uneven: a majority of Member States have notified their national law, but on 8 July 2026 the Commission referred four late countries, including France, to the EU Court of Justice (see the transposition status below).
This guide describes what NIS2 requires from SMEs: the scope criteria, the 10 Article 21 measures, the reporting deadlines, the penalty framework and a 12-month implementation roadmap.
What is NIS2?
NIS2 replaces the original NIS Directive from 2016. Where NIS1 covered about 7 sectors and roughly 300 entities in France, NIS2 expands to 18 sectors and is expected to cover over 160,000 entities across the EU. This includes thousands of SMEs.
The directive has one core goal: raise the baseline of cybersecurity across Europe by requiring organizations in critical sectors to implement risk management measures, report incidents within set deadlines, and place responsibility at the management level.
It distinguishes two categories of regulated entities:
| Category | Size threshold | Sectors | Supervision |
|---|---|---|---|
| Essential Entities (EE) | ≥250 employees OR ≥€50M turnover AND ≥€43M balance sheet | Energy, transport, banking, health, water, digital infrastructure, public administration, space | Proactive (ex-ante) |
| Important Entities (IE) | ≥50 employees OR ≥€10M turnover OR ≥€10M balance sheet | Postal services, waste management, chemicals, food, manufacturing, digital providers, research | Reactive (ex-post) |
Key point for SMEs: the cybersecurity obligations (the 10 Article 21 measures) are identical for Essential and Important Entities. The differences lie in supervision approach and fine thresholds. To work out your category, see NIS2: essential or important entity?.
Where does transposition stand? (as of 25 July 2026)
The directive does not apply to companies directly: each Member State transposes it into national law. On 7 May 2025, the Commission sent a reasoned opinion to 19 Member States that had not notified complete transposition. On 8 July 2026, it referred four of them to the Court of Justice of the European Union: Ireland, Spain, France and the Netherlands. The country-by-country status is maintained by the Commission.
In France, the transposition vehicle is the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, presented in the Council of Ministers on 15 October 2024, adopted by the Senate on 12 March 2025 and voted in the National Assembly's special committee on 10 September 2025. The text was not placed on the agenda of the July 2026 extraordinary session and examination in plenary is not expected before September 2026 (National Assembly legislative file). At the update date of this article, the law has not been promulgated; the French obligations will enter into force with the law and its implementing decrees and orders.
Work can start before promulgation. On 17 March 2026, ANSSI published the Référentiel Cyber France (ReCyF), released as a working document pending transposition: it lists the measures the agency recommends to reach the security objectives set by NIS2, with a proportionality principle tied to the entity's maturity, and comes with a tool to compare it with other frameworks. Pre-registration of entities is also already open on MonEspaceNIS2. The 10 Article 21 measures are set by the directive itself and will not change with the French texts: that is the baseline to work on now.
Does NIS2 apply to your SME?
Three criteria determine whether your business is in scope. You need to meet both the size and sector criteria. Or fall into an exception.
Criterion 1: size
Your SME is potentially in scope if it meets at least one of these:
- 50 or more employees, OR
- €10 million or more annual turnover, OR
- €10 million or more annual balance sheet total
Important nuance: this applies at the legal entity level, not the group level. A subsidiary with 60 employees and €12M turnover is in scope even if the parent group is smaller.
Criterion 2: sector
Your business must operate in one of the 18 sectors listed in Annexes I and II of the directive:
Annex I: Essential sectors
- Energy (electricity, gas, oil, hydrogen)
- Transport (air, rail, maritime, road)
- Banking and financial market infrastructures
- Health (hospitals, labs, medical device manufacturers)
- Drinking water and waste water
- Digital infrastructure (DNS, data centers, cloud, telecoms)
- Public administration
- Space
Annex II: Important sectors
- Postal and courier services
- Waste management
- Chemical production and distribution
- Food production, processing, and distribution
- Manufacturing (medical devices, electronics, machinery, vehicles)
- Digital providers (online marketplaces, search engines, social networks)
- Research
Criterion 3: supply chain pull-through
Even if you're below the size thresholds, you can still be pulled into NIS2 if you supply products or services to an Essential or Important Entity. Article 21(2)(d) requires these entities to assess the cybersecurity of their suppliers. They typically pass this down as contractual security clauses.
Example: a 20-person software development shop building a custom app for a hospital (Essential Entity) will generally face NIS2-aligned security requirements in its contract, even though the shop itself is below the size threshold.
Also always in scope regardless of size: DNS providers, TLD registries, qualified trust service providers, and public electronic communications networks and services.
The 10 Article 21 measures
Article 21 of NIS2 lists 10 minimum cybersecurity risk-management measures that every in-scope entity must implement. The directive explicitly frames these as "appropriate and proportionate." This means a 50-person manufacturer won't be held to the same standard as a multinational bank. But you must address all 10 areas.
The 10 measures align directly with the NIST CSF 2.0 functions. Here's what each measure requires in practice for an SME:
1. Risk analysis & information security policies
What it means: know your risks, write them down, and have a plan.
SME baseline:
- Maintain a risk register with your top 10 to 15 cybersecurity risks
- Have a board-approved Information Security Policy (even if it's 2 pages)
- Review risks at least annually
Evidence you need: risk register, policy document with approval signature, review meeting notes.
2. Incident handling
What it means: be able to detect, respond to, and recover from security incidents.
SME baseline:
- Documented incident response plan with roles and escalation paths
- Basic detection (EDR, SIEM, or at least antivirus with alerting)
- Post-incident review process
Evidence you need: IR plan, incident log/tickets, post-incident review template.
3. Business continuity & crisis management
What it means: maintain operations during and after an incident.
SME baseline:
- Backup policy following the 3-2-1 rule (3 copies, 2 media types, 1 off-site)
- Tested restoration process (not just "we have backups")
- Basic crisis communication plan
Evidence you need: backup policy, restore test results, RTO/RPO targets, crisis comms plan. Setting realistic RTO and RPO targets starts with a business impact analysis.
4. Supply chain security
What it means: your vendors are your risks.
SME baseline:
- Inventory of critical suppliers with risk ratings
- Security clauses in contracts with key vendors
- Basic due diligence checklist for new suppliers
Evidence you need: supplier inventory, contract clauses, review checklist.
5. Security in system acquisition, development & maintenance
What it means: security by design, not as an afterthought.
SME baseline:
- Security requirements in procurement
- Vulnerability management process with patching SLAs
- Change management for production systems
Evidence you need: procurement security requirements, patch policy, change logs.
6. Effectiveness assessment
What it means: prove your controls actually work.
SME baseline:
- Annual internal review or basic audit
- Key metrics (MFA coverage, patch compliance, backup success rate)
- Action tracker for findings
Evidence you need: review reports, KPI dashboard, corrective action tracker.
7. Cyber hygiene & training
What it means: your people are your first line of defense.
SME baseline:
- Annual security awareness training for all staff
- Phishing simulations (optional but recommended)
- Role-specific training for admins and developers
Evidence you need: training materials, completion records, onboarding/offboarding checklist.
8. Cryptography & encryption
What it means: protect data in transit and at rest.
SME baseline:
- TLS 1.2 or higher for all external communications
- Full-disk encryption on laptops
- Encryption for sensitive databases
Evidence you need: encryption policy, configuration screenshots, certificate inventory.
9. HR security, access control & asset management
What it means: control who can access what.
SME baseline:
- Joiner/Mover/Leaver process for access rights
- Annual access reviews
- Asset inventory (hardware and software)
- Principle of least privilege
Evidence you need: JML checklist, access review logs, asset inventory.
10. Multi-factor authentication (MFA) & secure communications
What it means: passwords alone are no longer enough.
SME baseline:
- MFA on all critical systems and admin accounts
- Secured communication channels for incident response
- Emergency communication plan
Evidence you need: MFA configuration proof, admin hardening evidence, emergency channel drill notes.
Incident reporting: the 24h/72h/1-month rule
Article 23 of NIS2 imposes a strict three-stage reporting timeline for "significant incidents." These are incidents causing severe operational disruption, substantial financial loss, or considerable harm to others.
| Stage | Deadline | What to report |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Suspected malicious cause? Potential cross-border impact? |
| Incident notification | Within 72 hours of becoming aware | Updated assessment, severity, impact, indicators of compromise |
| Final report | Within 1 month of incident notification | Full description, root cause, mitigation measures, cross-border impact |
Critical point: the clock starts when you become aware of the incident, not at the end of your investigation. You must therefore have a 24/7 escalation process, including weekends and holidays. For many SMEs, this is the most significant operational change.
What counts as "significant":
- Severe operational disruption to services
- Substantial financial loss
- Considerable damage to other persons or organizations
Voluntary reporting: Article 30 allows voluntary reporting of near-misses and threats that don't meet the significance threshold. This builds goodwill with your CSIRT and can't trigger additional obligations.
Management accountability & fines
NIS2 is explicit: cybersecurity is a management responsibility, not just an IT issue.
Article 20: governance
Management bodies must:
- Approve cybersecurity risk-management measures
- Oversee their implementation
- Undergo regular training to understand cyber risks
- Face potential personal liability for breaches
Article 34: penalties
| Entity type | Maximum fine |
|---|---|
| Essential Entities | €10 million OR 2% of global annual turnover (whichever is higher) |
| Important Entities | €7 million OR 1.4% of global annual turnover (whichever is higher) |
Beyond fines, authorities can:
- Issue binding compliance orders
- Suspend certifications
- Temporarily ban individuals from management functions
- Require security audits at the entity's expense
- Publicly name non-compliant organizations ("name and shame")
For an SME, the directive places the approval and oversight of the measures at the management-body level; it cannot be fully delegated to the security lead or the IT team.
Supply chain pressure through customer contracts
Even if your SME is below NIS2 size thresholds, you may face compliance pressure through your customers. Here's how it works:
- Your customer is an Essential or Important Entity under NIS2
- Article 21(2)(d) requires them to assess supplier cybersecurity
- They insert security clauses into contracts with you
- You must now demonstrate controls, provide evidence, and possibly allow audits
Sectors where this is already happening:
- Healthcare (hospitals requiring security attestations from medical device suppliers)
- Financial services (banks pushing DORA/NIS2 requirements to fintech vendors)
- Public infrastructure (government contracts with mandatory security standards)
- Manufacturing (automotive and aerospace supply chains)
A 15-person SaaS startup selling to a hospital will likely need to provide an information security policy, evidence of MFA in production, incident response procedures, tested backups, and staff training records. These requests most often arrive as a customer security questionnaire.
If you build this systematically, the same evidence will generally satisfy customers who require ISO 27001 or SOC 2.
A 12-month compliance roadmap
The following roadmap sequences the work for an SME approaching NIS2 compliance over twelve months.
Month 1-2: discovery & scoping
- Confirm if you're in scope: check size thresholds and sector against Annexes I and II
- Identify supply chain exposure: are you a critical supplier to an NIS2 entity?
- Pre-register with your national authority (in France: MonEspaceNIS2, open even before the law is promulgated)
- Conduct a gap analysis against the 10 Article 21 measures
Month 3-4: governance & documentation
- Designate a security lead (can be fractional or external for SMEs)
- Draft and approve an Information Security Policy
- Create a risk register with your top risks
- Document incident response procedures aligned with 24h/72h/1-month reporting
- Schedule management training on NIS2 obligations
Month 5-7: technical baseline
- Deploy MFA on all critical systems and admin accounts
- Implement EDR (Endpoint Detection and Response) on all devices
- Establish backup policy with 3-2-1 rule and test restoration
- Enable encryption for data at rest and in transit
- Deploy vulnerability management with defined patching SLAs
Month 8-9: processes & training
- Roll out security awareness training for all staff
- Implement Joiner/Mover/Leaver process for access control
- Create supplier security assessment checklist
- Conduct first tabletop exercise for incident response
- Test backup restoration and document results
Month 10-11: assessment & improvement
- Conduct internal audit of all 10 measures
- Perform penetration test or vulnerability assessment
- Review and update risk register and policies
- Prepare evidence pack for each Article 21 measure
- Address gaps identified during assessment
Month 12: validation & continuous improvement
- Conduct second tabletop exercise
- Review KPIs (MFA coverage, patch compliance, training completion)
- Update management on compliance status
- Plan next year's improvement cycle
The cost depends on the starting point (tooling already in place, backup and MFA maturity, whether an external provider is involved); no generic range holds without a prior assessment. The gap analysis from months 1 and 2 provides the basis for costing.
How Komplyo handles NIS2
The 10 Article 21 measures align with the NIST CSF 2.0 functions. Komplyo uses CSF 2.0 as the assessment framework and projects the answers onto NIS2, GDPR, ISO 27001 and SOC 2 through the mappings between frameworks; identified gaps feed a prioritized roadmap and the generated documents (information security policy, incident response procedure, backup policy). The NIS2 page details the coverage of each Article 21 obligation, and the free diagnostic (23 questions, around 5 minutes) gives a first maturity picture by CSF function.
Frequently asked questions
When will NIS2 apply in France?
The transposition law has not been promulgated at the update date of this article (25 July 2026); France was referred to the EU Court of Justice on 8 July 2026 over this delay. The obligations will apply with the law and its implementing texts. In the meantime, ANSSI has published the ReCyF framework (as a working document) and opened pre-registration on MonEspaceNIS2: in-scope entities can start without waiting for promulgation.
Is my small business really in scope for NIS2?
You're likely in scope if you meet at least one size threshold (≥50 employees, or ≥€10M turnover, or ≥€10M balance sheet) and operate in one of the 18 sectors in Annexes I and II. Below the thresholds, you can still be pulled in contractually as a supplier to an Essential or Important Entity. France's MonEspaceNIS2 wizard is the quickest way to self-check.
What's the difference between Essential and Important Entities?
The cybersecurity obligations (the 10 Article 21 measures) are identical. The differences are supervision (proactive or ex-ante for Essential, reactive or ex-post for Important) and fine caps (€10M or 2% of turnover vs €7M or 1.4%).
What are the NIS2 incident reporting deadlines?
Three stages for significant incidents: an early warning within 24 hours, a fuller incident notification within 72 hours, and a final report within one month. The clock starts when you become aware of the incident, not when the investigation ends.
Can company directors be held personally liable under NIS2?
Yes. Article 20 makes management bodies responsible for approving and overseeing risk-management measures and requires them to undergo training. Individuals can be temporarily banned from management functions for serious non-compliance.
How does NIS2 relate to NIST CSF 2.0, ISO 27001, and GDPR?
The Article 21 measures align with NIST CSF 2.0 functions and overlap heavily with ISO 27001 controls and GDPR Article 32 (security of processing). That's the core of Komplyo's "assess once, project everywhere" model. You answer against CSF 2.0 once and read your readiness across all of them. See SOC 2 vs ISO 27001: which one first?.
Free resources & tools
| Resource | Source | What it provides |
|---|---|---|
| NIS2 Directive full text | EU Official Journal | The legal text of Directive (EU) 2022/2555 |
| ENISA NIS2 topic page | ENISA | Country-by-country transposition status |
| Commission transposition tracker | European Commission | Official transposition status and infringement steps |
| ANSSI NIS2 resources (France) | ANSSI | French transposition guidance, templates, FAQ |
| Référentiel Cyber France (ReCyF) | ANSSI | Recommended measures to reach the NIS2 security objectives (working document, 17 March 2026) |
| NCSC Ireland NIS2 FAQ | NCSC Ireland | Irish-specific guidance and registration |
| MonEspaceNIS2 (France) | French Government | Self-assessment wizard to check if you're in scope |
| ECSO NIS2 transposition tracker | ECSO | Detailed country-by-country transposition analysis |
| NIST CSF 2.0 | NIST | Framework that maps well to NIS2 Article 21 measures |
| CISA Cyber Essentials | CISA | Free baseline security guidance for small businesses |
Summary
For an SME, the NIS2 analysis comes down to three points: scope (size, sector, position in the supply chain of a regulated entity), the gap against the 10 Article 21 measures, and the assignment of responsibility, which the directive places at the management-body level. A documented security program also answers the requirements that NIS2-regulated customers pass on to their suppliers in tenders and vendor assessments.
The NIST CSF 2.0 and ANSSI's EBIOS Risk Manager method provide the structural framework; the directive and its transposition set the timeline.