NIS2 and SMEs: what you need to know
The EU NIS2 directive (2022/2555) brings risk management, reporting obligations and board-level accountability into mid-sized companies' day-to-day. We cover who falls in scope, what is concretely required, and how an SME prepares step by step.
NIS2 entered into force on 16 January 2023, and member states had to transpose it into national law by 17 October 2024. In Finland the directive has been implemented through the Cybersecurity Act and sector-specific legislation. In practice this means that the previously narrow NIS1 scope has expanded significantly: it now covers 18 sectors, of which 11 are critical and 7 are other key sectors.
From an SME perspective this is not a mere compliance exercise. The directive equates cybersecurity risks with other business risks and shifts responsibility to the management team for ensuring that risk management, incident response and supply chain security are in order.
Is your company in scope?
NIS2 applies as a baseline to medium-sized and large companies (at least 50 employees or over EUR 10 m turnover) in specific sectors. The scope is divided into two categories: 'essential' and 'important' entities. Essential entities include energy, transport, banking, healthcare, public administration and digital infrastructure. Important entities include postal and courier services, waste management, chemical industry, food industry and digital service providers.
Smaller companies can also fall in scope if they have a critical role in their sector or provide essential services (e.g. sole provider, public communications network provider, trust service provider). According to ENISA guidance, NIS2 requirements also flow down through the supply chain to subcontractors, even if they are not directly in scope themselves.
- At least 50 employees or EUR 10 m turnover + critical or important sector
- Smaller company that is the sole provider in its sector or has a critical role
- Supplier serving NIS2-regulated customers (indirect impact)
What NIS2 concretely requires
The directive lists 10 minimum measures that all in-scope organisations must implement. These are not abstract principles but concrete controls whose existence must be demonstrable.
The level of requirements scales with company size and risk: essential entities are expected to maintain more systematic and documented governance, whereas for important entities the focus is on baseline controls and incident response.
- Risk management policy and information system security assessment
- Incident handling and reporting process (early warning 24 h, update 72 h, final report 1 month)
- Business continuity and crisis management — backups, recovery plan
- Supply chain security — subcontractor and provider assessment
- Procurement, development and maintenance security requirements
- Effectiveness measurement and cybersecurity practice review
- Basic cyber hygiene and training — all employees in regular training
- Cryptography and, where applicable, strong access controls
- Personnel security and access control policy
- Multi-factor authentication, secure communications and emergency communication channels
Management responsibility — a major change
NIS2 places cybersecurity on the management team's table. Article 20 requires that management members approve risk management measures, oversee their implementation and participate in regular training. Personal liability is real: in cases of serious negligence, management may be temporarily barred from holding responsible positions.
Administrative sanctions are significant. For essential entities the maximum penalty is EUR 10 m or 2 % of worldwide turnover — whichever is higher. For important entities the cap is EUR 7 m or 1.4 %.
Where does an SME start?
Practical preparation should begin with a current-state assessment. This does not require heavy auditing: often it is enough to walk through the 10 compliance controls and mark which are in place, which are partially done and which are missing. ENISA's published guidelines (ENISA, 'NIS2 Implementation Guidelines', 2024) and the Finnish Transport and Communications Agency Traficom's Cybersecurity Centre materials provide a good baseline.
Typically the largest gaps in an SME are in the incident response process and supply chain assessment. Documentation of incident handling — who does what, who is notified, in what order — is often informal and therefore brittle under pressure. Supply chain security assessment is often missing altogether, even though cloud services, outsourced services and API integrations make up the bulk of the technical risk surface.
Frequently asked questions
Need help with NIS2 preparation?
We help SMEs map the current state, identify gaps and build a lean but documented risk management and incident response process. Start small — no heavy project required.
Get in touch