Short answer: if your company is at least medium-sized and works in one of the sectors listed in the directive, NIS2 applies to you directly, and in many Member States the first deadlines have already passed. If you're smaller, you're probably not directly in scope. That doesn't mean you're off the hook: if your large customers are in scope, they will push the security requirements down to you through contracts. For most SMEs, NIS2 is above all a supplier question.
There is a lot of half-information around this topic. Some of it exaggerates ("every company must be audited"), some underestimates it ("this is only for critical infrastructure"). This article walks through how to decide whether it applies to you, and what to do in either case.
What NIS2 is
NIS2 is Directive (EU) 2022/2555 on a high common level of cybersecurity across the Union. Its predecessor, NIS1, covered a narrow group. NIS2 covers far more sectors and companies. Member States had to transpose it by 17 October 2024, and it replaced NIS1 from 18 October 2024. One of its key changes is that top management is personally accountable for cybersecurity.
Because it is a directive, each Member State implements it in its own national law. The core is the same everywhere, but registration, supervision, audits and fees differ by country. That is why "what do I have to do?" always has a national answer too.
Does it apply to you? Two questions decide
1. Which sector are you in?
The directive's annexes list the sectors in scope. Some examples:
- sectors of high criticality: energy, transport, banking, health, drinking water and waste water, digital infrastructure, ICT service management (business-to-business), space;
- other critical sectors: postal and courier services, waste management, chemicals, food production and distribution, certain manufacturing (for example medical devices, electronics, machinery, vehicles), digital providers (online marketplaces, search engines, social networks) and research.
If your main activity is not on the list, the directive generally does not apply to you directly.
2. How big is your company?
Within the listed sectors, the general rule is that medium-sized and large companies are in scope. Medium-sized means at least 50 employees, or annual turnover and balance sheet total both above €10 million.
There are exceptions where size doesn't matter, such as providers of public electronic communications, trust service providers, DNS service providers and domain name registries. Micro and small companies are generally out of scope unless they fall into one of these categories.
What national implementation looks like: Hungary as an example
To show how concrete national rules can get, take Hungary, where we work. Its Act LXIX of 2024 entered into force on 1 January 2025:
- in-scope organisations register with the supervisory authority (for most sectors, the SZTFH);
- they contract an accredited auditor and pass a cybersecurity audit, then repeat it every two years;
- organisations already operating before 2025 had to complete their first audit by 30 June 2026;
- newly in-scope organisations register within 30 days and audit within two years;
- a supervisory fee is capped at 0.015% of net revenue, with a fixed maximum per organisation.
According to Hungarian press reports, 2,520 organisations are registered, 2,132 completed the audit on time, and about 90% of those audited passed. The most common gap was documentation of remote access. Organisations that should have registered but didn't face fines of up to HUF 150 million.
Other Member States have chosen different models, some with self-assessments rather than mandatory external audits. Check your own country's law and supervisory authority; the Commission's NIS2 page links to national resources.
What you need to prepare
Article 21 of the directive lists the risk management measures in-scope organisations must take. In short:
- risk analysis and information security policies: know your important systems and data, and what threatens them;
- incident handling: write down what to do, who decides, who must be notified;
- business continuity: backup, recovery, crisis management, and the step most often skipped: actually testing recovery;
- supply chain security: the risks that come from suppliers and service providers;
- security in acquisition, development and maintenance, including vulnerability handling;
- assessing effectiveness: check that your measures actually work;
- basic cyber hygiene and training for staff;
- cryptography, where appropriate;
- human resources security, access control and asset management;
- multi-factor authentication and secured communications.
That is a long list, but in a mid-sized company much of it already exists in some form. An audit doesn't ask whether you have a perfect system. It asks whether you know your risks, whether you made decisions about them, and whether you can show what you did. A smaller solution that is documented and working beats an expensive one that nobody understands.
ENISA's technical implementation guidance gives examples and types of evidence for each measure. If you are just starting, compare what you have against it.
Reporting incidents: the clock starts at detection
NIS2 also sets out how quickly significant incidents must be reported to the national authority or CSIRT. Under Article 23:
- an early warning within 24 hours of becoming aware of a significant incident;
- an incident notification within 72 hours, with an initial assessment of severity and impact;
- a final report within one month, covering root cause and the measures taken.
Twenty-four hours is short. If nobody knows who decides whether an incident is significant, who writes the report and where it goes, the deadline passes while people are still busy restoring systems. That's why incident handling has to be prepared before anything happens: a one-page procedure, named people with deputies, the authority's contact details and a template for the first report.
A useful exercise is a short tabletop drill once a year. Pick a realistic scenario (for example, ransomware on the file server on a Friday evening) and walk through who does what in the first 24 hours. It costs an hour, and it reliably shows the gaps.
Management liability can't be delegated
This is the point most managing directors underestimate. Under NIS2, management bodies must approve the cybersecurity risk management measures, oversee their implementation, and can be held liable for failures. Members of management must also take part in training.
If an external provider runs your IT, the provider is responsible for what the contract says. Accountability under the law stays with management. In practice, the CEO needs to understand the company's risks and make documented decisions about them. They don't need to become a security expert, but they can't wave the question away either.
If you're not in scope: as a supplier, you will be anyway
One of the most important and least known parts of NIS2 is supply chain security. In-scope organisations must manage the risks that come from their suppliers. That flows downstream: your in-scope customers will send questionnaires, write security requirements into contracts and ask for evidence.
If you provide IT services, software, cloud services or maintenance to an in-scope company, expect this. ENISA's guidance for digital and ICT providers is a good starting point even if you are not directly in scope.
The good news: once you've prepared, you can show the same package to every customer. The bad news: those who can't comply may drop out of the supplier list. In tenders, a clear and documented security posture is increasingly a selection criterion, not just a formality at the end.
What might still change
On 20 January 2026, the European Commission proposed targeted amendments to NIS2. Among other things, the proposal would create a "small mid-cap" category for companies with fewer than 750 employees and turnover up to €150 million, which would count only as "important" rather than "essential" entities, with lighter, after-the-fact supervision. It is a proposal for now. Adoption is expected in late 2026 or 2027, followed by national transposition. It doesn't change today's obligations.
What we see
In companies where we discuss this, technology is rarely the main gap. Firewall, antivirus and backup usually exist in some form. What's missing is documentation: who has access to what, how, who approved it, what happens during an incident. It's no coincidence that remote access documentation was the most common gap in Hungary's first audit round.
Documentation isn't bureaucracy. If the system goes down one night, it decides whether you know who to call in the morning. And if a key person is on holiday or leaves the company, it decides whether their knowledge leaves with them.
What to do now
- Decide whether you're in scope. By sector and size, using your national authority's guidance. If unsure, ask the authority.
- If you're in scope and haven't registered, do it now. Fines target the failure to register.
- If you've been audited or assessed, prepare for the next round. Gaps found in the first round must be fixed by then.
- If you're a supplier, prepare a security package: policies, access management, backup and recovery, incident handling. ENISA's guidance is a good start.
- Document remote access. Who, to what, how, with what authentication.
- Brief management on its accountability. A short risk summary, updated yearly, goes a long way.
If you'd like someone to check whether your company is in scope and what's missing from your preparation, have a look at our infrastructure and operations and IT consulting services.
FAQ
Who does NIS2 apply to?
To medium-sized and large organisations in the sectors listed in the directive's annexes, and in some sectors (such as electronic communications, trust services and DNS) regardless of size. National laws set the details.
What is the size threshold?
Generally at least 50 employees, or annual turnover and balance sheet total both above €10 million, within a listed sector.
Is an external audit mandatory?
It depends on the Member State. Hungary, for example, requires an accredited external audit every two years. Other countries rely more on self-assessment and supervision. Check your national law.
If we outsource IT, does the responsibility move to the provider?
No. Management remains accountable under NIS2. The provider is responsible for what the contract says; compliance stays with your management.
Will the small mid-cap amendment exempt us?
It wouldn't exempt anyone; it would move some companies into the lighter "important" category. It is still a proposal, expected to be adopted in late 2026 or 2027, and doesn't change current obligations.
Sources
- European Commission – NIS2 Directive
- ENISA – NIS2 Technical Implementation Guidance
- Hungary – Act LXIX of 2024 on the cybersecurity of Hungary (in Hungarian)
- Telex – Most companies completed the cybersecurity audit on time (in Hungarian)
- Telex – 90 percent of Hungarian companies passed the first cybersecurity audit (in Hungarian)
- Covington – European Commission proposes targeted amendments to NIS2
