You've heard about NIS 2 from your accountant, a client, or a supplier. And you're wondering if it really affects you.
The answer comes down to two questions: what is your size, and what sector do you work in. This guide helps you decide, without jargon, based on what I see on the ground as a pentester.
The Size Criterion: 50 Employees or €10M
The directive primarily targets companies with at least 50 employees, or whose turnover and balance sheet total exceed €10 million.
Below that, you are generally outside the direct scope. Generally only: we'll come back to this later.
A mid-sized company (ETI) changes category. From 250 employees, or over €50 million in turnover and €43 million in balance sheet total, and if its activity is listed in Annex I, the company is generally an essential entity. Authority controls are tighter, and penalties are heavier.
The Sector Criterion: Annexes I and II
Size is not enough. Your activity must also be listed in Annex I or II of the directive.
- Energy, transport, health, water.
- Digital infrastructure and ICT services for businesses.
- Manufacturing, agri-food, chemicals, waste.
- Postal services and digital providers.
This list is not exhaustive. If you are unsure between two annexes, the chosen category changes your obligations: it's best to determine it before spending anything.
Outside the Scope, But Still Contacted
Many SMEs that are not directly concerned still receive a security questionnaire. Their client, however, is subject to NIS 2 and must vet its suppliers.
The questionnaire arrives before contract renewal. Simply replying "we take security seriously" is no longer enough: proof is required.
What you will be asked for, in practice: a written security policy, access management, backups, an incident response plan, and a recent technical test.
What to Do If You Are Concerned
A NIS 2 audit measures the gap between your actual security measures and the ten measures in Article 21 of the directive. It provides an action plan categorized by risk. It does not issue any certification, as none exist.
Start by defining the legal scope: which entities in the group, in which category. Then the technical scope: systems, sites, suppliers. The penetration test then serves to verify that the measures hold up against a real attack.
If you want the details of an audit, read our page NIS 2 Audit for SMEs and Mid-Sized Companies.
Frequently Asked Questions
Is a 30-employee SME concerned?
In principle, no, unless it meets another criterion of the directive. However, it may be required to respond to a client subject to NIS 2.
Does NIS 2 require a certification?
No. No certification exists: an audit provides a measured gap and an action plan.
How long does an audit take?
For an SME on a single site, generally 2 to 5 days. For a multi-site mid-sized company, 10 to 30 days.
Where to start?
With the eligibility test: size, sector, category. Only then, choose the depth of the audit.
NIS 2 Audit for SMEs and Mid-Sized Companies
Read more