NIS2 has probably crossed your path somewhere too, a slide at a seminar, an annex in a big customer’s contract, or an email whose subject line turned your stomach. And if you run a small or mid-sized business, the first reaction is usually the same: another EU directive that wants paperwork and money I don’t have…
I get the reaction. But NIS2 isn’t quite the monster it sounds like, nor is it something you can sweep under the mat and hope for the best. Let’s unpack it without the lawyer’s vocabulary: what it is, whether it applies to you, and where to actually start.
What NIS2 actually is
NIS2 is the EU’s cybersecurity directive, written into Finnish national law and supervised here by the National Cyber Security Centre. There’s no magic behind the name: it obliges certain organisations to keep their cybersecurity in order and. This is the key part, to be able to show it. It’s not enough that things are roughly fine; you have to be able to demonstrate they’ve been taken care of.
In plain terms: get the basics right, make responsibilities clear, and keep enough paper to prove it. No more mystique than that.
Does this apply to me?
Here many people sigh with relief too early. The directive targets so-called essential and important entities in certain sectors, energy, water, healthcare, digital infrastructure, manufacturing, food and so on, and mainly medium-sized and larger companies. If you’re a three-person plumbing shop, you’re probably not directly in scope.
But don’t close the tab yet. Here’s the part that surprises the smaller players too: the supply chain. Even if NIS2 doesn’t apply to you directly, it applies to your big customers, and they’re obliged to assess their own suppliers. In practice that means before long you’ll be asked, in a contract negotiation, how you handle your security. And if you can’t answer, that’s good news for your competitor. I’ve seen this play out again and again: the small supplier who can answer the question with a straight face wins the deal on good security as often as on price. The other way round, a single vague answer to a security questionnaire is enough to raise doubt, even when you’re otherwise the best option.
So the question isn’t really ”does NIS2 apply to me”, but ”how soon will someone important to me require NIS2-level things of me”. The answer is usually: soon.
It’s not an IT project. It’s a management issue
The most common misconception is that NIS2 is handled by buying some device or software and ticking a box. It isn’t. The core of the directive is risk management, and the responsibility sits squarely with management, not ”the IT guy” or an outsourced partner. Management can delegate the doing, but not the responsibility.
That sounds unpleasant, but it’s actually a healthy thought. Cybersecurity isn’t a technical corner somewhere in the server room; it’s part of business continuity, the same species as having your insurance in order and knowing what you’ll do if the factory burns. NIS2 just forces you to look at it with the same seriousness.
Five first steps
If you decide to start, and I’d recommend starting before someone makes you, here’s a sensible order. None of these needs an army of consultants or a six-figure budget.
- Know what you have. You can’t protect what you don’t know you own. Make a list: what systems, what data, where it lives, who can access it. This is the dullest step and almost always the one that turns up surprises, old accounts, open shares, data in places nobody remembered.
- Get the basic hygiene right. Multi-factor authentication everywhere you can. Updates kept current. Backups that genuinely sit somewhere other than the same machine, and that you’ve actually tested restoring. These three alone stop the bulk of what actually takes small companies down.
- Name who’s responsible. Write down on paper who’s responsible for security. It doesn’t have to be a dedicated security officer. It’s enough that someone is named, knows it, and management stands behind them. Responsibility that belongs to everyone belongs, in practice, to no one.
- Look at your supply chain. Which of your suppliers can reach your systems or data? What happens if one of them goes down or leaks? The same question your big customers will soon ask you, ask it of your own partners now.
- Prepare for incidents. Think it through in advance: if a breach is spotted today, who calls whom, and in what order? NIS2 requires reporting incidents to the authority quickly, and that’s far easier if the plan was made before the house is on fire, not during.
Common mistakes I see
A few pitfalls recur so often they’re worth calling out separately. First: buying a tool before you know what you’re actually protecting, an expensive system aimed at the wrong problem is just expensive. Second: MFA gets switched on ”soon”, and soon never comes; yet it’s the single thing that blocks the most. Third: backups get taken but their restore is never tested, an untested backup is a wish, not a plan. And fourth: responsibility is left hanging ”somewhere with management” without anyone actually picking it up. None of these four costs anything to fix. They just need a decision.
What NIS2 doesn’t require
A little reassurance here, because fear is a poor adviser. NIS2 doesn’t require you to build your own operations centre, hire a security team, or pour senseless sums into technology on day one. It requires the basics to be done, responsibilities to be clear, and you to be able to show it. Most of it is organising and recording, not expensive purchases.
Many small companies find, on starting, that they already do half of it right, only the documentation and the order are missing. That’s good news: the journey is shorter than the fear suggests.
So what does this cost?
This is the question that actually weighs on a small-business owner, so let’s answer it straight. The basic steps are mostly time and organising, not money. MFA is essentially free, updates are free, and backups cost little. The biggest cost isn’t money but attention: someone has to sit down, do that inventory, and make decisions. But that time is an investment that pays for itself the first time something goes wrong, and something always goes wrong eventually. NIS2 only gets expensive if you leave it to the last minute and have to buy in a hurry what you could have built at your own pace.
Why it’s worth starting now
Two reasons. The first is practical: that supply-chain pressure is coming anyway, and it’s much nicer to answer ”yes, we’ve got things in order, here are the papers” than to start from zero when a big deal is on the line.
The second matters more. All of these steps make your business more resilient regardless of any directive. Backups that haven’t been tested are wishes. An account without MFA is an open door. These aren’t NIS2 things. They’re good-business things that NIS2 happens to require. Do them, and you sleep better, supervisor or no supervisor.
NIS2 isn’t a punishment. It’s a nudge to do what should have been done anyway. And where to start? With number one on that list, do it this week.
If you want to go deeper into the concrete measures, I wrote about it in more detail here: NIS2 in Small and Mid-sized Industry, What You Actually Need to Do.