NIS2 and SMBs: what really concerns you
“Am I covered, and what do I risk if I do nothing?”
The observation
NIS2 considerably widens the scope of the European directive on the security of network and information systems: entire industries are now covered, and subcontractors of large companies often are too, indirectly, through their contracts. Many SMBs discover the issue not through a text, but through a request from a client or their insurer. So the question isn't "am I on the list?" but "could I prove it if asked?".
How we handle this topic
Establish whether you're covered, and on what basis
Directly, through your industry and size, or indirectly as a supplier to a covered entity. We establish the scope with you, without jargon and without dramatizing: you'll know whether the issue affects you, and why.
Take inventory of what already exists
Most covered companies have already done part of the work without knowing it. We list the measures actually in place, written procedures, backups, access, logging — and we identify the gaps in order of urgency.
Close the gaps that matter first
Exploitable logging, access management, the incident procedure, tested backup. These are the requirements that come up everywhere, and the ones an auditor or a client will ask you about.
Produce the record, continuously
The usual weak point isn't doing it, it's being able to prove it. So traceability is continuous, not reconstructed the day before an inspection: who has access to what, when, and what was done with it.
What it changes for you
- You know whether you're covered, directly or as a supplier
- Measures already in place are inventoried instead of redone
- Gaps are prioritized by urgency, not by convenience
- The record is produced continuously, ready to be presented
The limit, stated plainly: We support compliance work, we don't certify it: compliance is established, it isn't sold, and legal accountability remains with the company. This support is no substitute for a regulatory audit or the opinion of a legal advisor.
Is your situation specific?
This topic is handled case by case. The assessment frames it around your numbers, not in the abstract.