NIS2 for small and medium companies
NIS2 for SMEs, without a compliance team
NIS2 applies to medium and large companies in its sectors, and its supply chain rules reach many smaller suppliers through their customers. CloudSignLab shows whether you are in scope, turns the ten measures into a short list of controls and keeps the answers your customers ask for in one place.
Paid packages from €79 a month, excl. VAT. You can also start free. See prices
What NIS2 means for a smaller company
In scope from medium size
Companies in the sectors of Annexes I and II are covered from medium size: 50 employees, or more than 10 million euros of turnover and balance sheet. Some services, such as DNS or trust services, are covered at any size.
Reached as a supplier
Covered companies must manage the security of their supply chain (Article 21(2)(d)). Their suppliers, often small companies, get security questionnaires, contract clauses and checks.
Ten risk management measures
Article 21(2) lists ten measures, from risk analysis and incident handling to backups, access control, multi-factor authentication and staff training.
Reporting deadlines
Significant incidents are reported to the authority: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
Management is accountable
The management body approves the measures, oversees them and takes part in training (Article 20).
How CloudSignLab helps a small team
Scope check in minutes
The free NIS2 check works through sector, size and special cases in your browser; nothing is stored.
The ten measures as controls
A ready template turns Article 21(2) into controls with owners, status and evidence, and a readiness score shows what is missing.
Answer customer questionnaires once
Approved answers, policies and a trust page you can share, so the next questionnaire from a customer takes less time.
Incident clock
Record an incident and see the 24 hour, 72 hour and one month deadlines, with reminders before each one.
Policies and training
Publish policies with read confirmation and track who completed which training.
Start on the Free package
Begin with the Free package and move to a larger one only when you need more.
Questions about NIS2 for SMEs
Does NIS2 apply to small companies?
Usually not directly. Small and micro companies are only covered in special cases, such as DNS service providers, top-level domain registries, trust service providers, providers of public electronic communications, or when a country designates them. Many are still asked for NIS2 measures by customers that are covered.
How do I know whether my company is in scope?
Check your sector against Annexes I and II of the directive and your size against the medium company thresholds. The free NIS2 check takes you through these questions; the national law of your country gives the final answer.
A customer sent us a NIS2 questionnaire. Do we have to answer it?
Your customer has to manage its supply chain risks, so the questionnaire is usually part of the contract or the selection. Answering it well with clear evidence often decides whether you keep or win the customer.
What should a small company do first?
Name a responsible person, list your important systems and suppliers, switch on multi-factor authentication, check your backups and write down how you handle an incident. These steps cover several of the ten measures at once.
Find out where you stand with NIS2
Run the free check, then start free and see your first readiness score.