If your company received a letter from the national cybersecurity authority, or a customer asked you to confirm that you meet NIS2 requirements, your first question was probably a simple one: does this even apply to us? The second question is usually harder: what exactly do we need to have in place to prove it?
NIS2 is the European Union directive on the security of network and information systems. Each member state transposes it into its own national law, with its own registration deadlines, supervisory authority and penalties, so the details differ from country to country (in Lithuania, for example, it is implemented through the Law on Cybersecurity). Unlike the earlier rules, which covered a relatively narrow circle of operators, the new framework includes many medium-sized and even smaller companies that until now thought of cybersecurity as antivirus software and passwords.
In this article we go through, in plain language, who the requirements apply to, what they mean in practice and which documents you need. At the end: where to start if you have nothing today.
Who NIS2 applies to: essential and important entities
The directive splits organisations into two groups: essential and important entities. The difference is not in the content of the requirements but in the strictness of supervision and the size of sanctions. Essential entities are supervised proactively, important entities mostly after an incident or a complaint.
Which group you fall into is decided by two things: sector and company size. In general, the sectors are divided as follows:
- Sectors of high criticality: energy, transport, banking and financial market infrastructure, healthcare, drinking water and waste water, digital infrastructure (data centres, cloud providers, DNS, electronic communications networks), ICT service management (managed service and managed security service providers), public administration, space.
- Other critical sectors: postal and courier services, waste management, the chemicals industry, food production and distribution, various manufacturing (medical devices, electronics, vehicles, machinery), digital providers (marketplaces, search engines, social networks), research.
The size threshold is usually a medium-sized company, that is, 50 employees or more, or a certain annual turnover. There are exceptions, though: some entities (for example, providers of electronic communications or trust services) are included regardless of size, and the authority can also include a smaller company if it is the only provider of an important service in a region.
In our experience the most common case is a manufacturing, logistics or healthcare company with 60 to 200 employees that first hears about NIS2 from a customer questionnaire. If that is you, it is very likely that you are an important entity. Because each member state sets its own scope details and deadlines, check the rules of the country where you operate.
What is required in practice
The directive does not prescribe specific technologies. It requires a company to manage cybersecurity risks in proportion to its size and the threats it faces. In practice this means five areas.
Risk management
You need to know which systems you use, what data they hold, what threatens them and what you do to keep those threats from materialising. This is formalised in a risk register and security policies: access control, passwords and multi-factor authentication, updates, network segmentation, use of cryptography. A risk assessment is the first job, and everything else depends on it.
Incident management and reporting
You need a procedure for how an incident is recognised, who is responsible for it and how it is reported. The reporting deadlines are strict: an early warning to the national cybersecurity authority within 24 hours of becoming aware of a significant incident, a more detailed notification within 72 hours and a final report within a month. Without a plan prepared in advance, these deadlines are almost impossible to meet.
Supply chain security
Your responsibility does not end at your own servers. If your accounting runs at a cloud provider and an external company looks after your IT, you must assess their security and write it into contracts. That means a list of suppliers, a risk assessment for each of them and contract terms on security, incident reporting and audit rights.
Backups and business continuity
A company must be able to restore operations after an incident. That requires backups stored separately from the main infrastructure and a tested recovery plan. A backup that nobody has ever restored has no value on paper. Here we often recommend immutable backups, which cannot be changed and are invisible from the network, because these are the ones that withstand ransomware attacks.
Management accountability
This is a new element and a surprise to many. Management must approve the risk management measures, oversee their implementation and take part in training. Personal liability can apply for violations. In practice this means that security topics must appear on the agenda of board or management meetings and that decisions must be recorded in the minutes.
Which documents you need
During an inspection, or when answering a customer questionnaire, you are asked for documents, not stories. The minimum set we recommend for every entity:
- An information security policy approved by management.
- An asset register (systems, devices, data).
- A risk assessment report and a risk register with responsible owners and deadlines.
- An access control policy and records of access rights reviews.
- An incident management procedure with reporting templates and contacts.
- An incident log (even if it is empty for now).
- A backup policy and restore test records.
- A business continuity plan.
- A list of suppliers, their risk assessment and security addenda to contracts.
- A patch and vulnerability management procedure.
- Records of employee training and management training.
- Management decisions (minutes) approving the measures.
You do not need a hundred pages of documents. Ten short documents that people actually follow are better than one thick binder that nobody has read.
Registration deserves a separate mention. Entities must register with the list maintained by the national cybersecurity authority and provide contact details, which will be used to send warnings and which the authority will use to reach you after an incident. Deadlines and procedures depend on the country. It is a simple step, but without it everything else looks unstarted. Also appoint a person responsible for cybersecurity and formalise this with a written order, because the authority will ask for exactly that person.
The most common mistakes we see
First, starting from documents instead of reality. A copied policy stating that multi-factor authentication is enabled everywhere, when it is only turned on for e-mail, will hurt you more during an inspection than having no policy at all.
Second, assuming that the IT provider will “ensure” compliance for you. A provider can fix the technical side and prepare the documents, but responsibility, decisions and management involvement stay with the company.
Third, forgetting the incident reporting deadlines. The company has excellent protection, but when an incident happens, nobody knows who has to report, and where, within 24 hours.
Where to start
If today you have only antivirus software and good intentions, a realistic path looks like this:
- Determine whether you are an entity and in which group. If in doubt, it is better to check than to find out from the authority.
- Carry out a risk assessment and an asset inventory. It creates the foundation for all the other documents and shows where the real gaps are.
- Sort out the technical basics: multi-factor authentication, endpoint protection, separately stored backups, an update process.
- Prepare an incident management procedure and walk through it “on paper” with management.
- Secure management involvement: approve the policies, schedule training, put security on the meeting agenda.
We can walk this whole path with you. Our NIS2 compliance service covers the assessment of entity status, the risk assessment, preparation of documents and implementation of technical measures, and if you need a permanent security lead without a full-time hire, CISO as a Service keeps the documents alive after the inspection. Our team holds valid ISACA certificates, and we deliver our services in line with ISO 27001 requirements, so we know what auditors ask and what they check first.
