NIS2 for SMEs: What to Do Now

NIS2 for SMEs means significantly higher cybersecurity requirements from the EU — and the directive affects far more companies than you'd think. It pays to look into this now rather than wait: addressing the new obligations early helps you avoid last-minute scrambling and lets you build security into your existing processes in a considered way, instead of bolting it on afterward under pressure.

What NIS2 Is

NIS2 is the second version of the EU's Network and Information Security Directive, and it obligates companies to a higher standard of cybersecurity. This includes risk management, technical and organizational protective measures, and reporting duties when security incidents occur. Unlike its predecessor, NIS2 no longer targets only classic operators of critical infrastructure such as energy providers or hospitals — it also draws in their suppliers, service providers, and partner companies. So if you deliver products or services to a company that falls under NIS2, you can be indirectly pulled into the same obligations, for example because your client asks for evidence, security concepts, or contractual assurances around security. This shifts the topic from a pure compliance question for large corporations into a practical task for many smaller and mid-sized companies across the supply chain.

Who NIS2 for SMEs Affects

Many mid-sized companies underestimate that they could be affected at all. Directly affected are companies in sectors such as energy, transport, health, digital infrastructure, or finance, provided certain size criteria are met. Indirectly affected, however, are also all those who are woven into these sectors' supply chains as service providers, software vendors, or suppliers — think of an IT agency working for an energy provider, or a manufacturer delivering components to a hospital operator. Precisely because the boundaries aren't always clear-cut, it's worth doing a structured check when in doubt: which customers do you serve, which industries are they active in, and what contractual requirements might come your way as a result? Answering these questions early lets you realistically gauge how urgent the topic is for your own company, rather than reacting under pressure the moment a customer or partner asks. And even if your company ultimately doesn't fall formally under the directive, taking a close look at your own risks is rarely wasted effort.

First Steps

Getting started with NIS2 compliance doesn't have to be complicated if you approach it in a structured way. A sensible first step is taking stock of your own risks: which systems, data, and processes deserve particular protection, where are safeguards already in place, and where are the gaps? From there, you can implement baseline protection that covers the most important attack surfaces — from clearly defined access rights to regular backups to keeping software up to date and maintaining a sensible password and access policy. Documentation matters just as much: processes, responsibilities, and reporting channels should be written down so that everyone knows what to do, and who needs to be informed, if an incident occurs. Training for employees belongs here too, since many security incidents start with simple human error, such as an attachment opened without a second thought. This not only creates clarity around NIS2 itself, it also makes internal communication easier and helps when customers ask for proof of your security measures. We think security and marketing together — see Data Privacy & IT Security, where technical safeguards and communication aspects are considered side by side.

Why This Affects Marketing Too

Cybersecurity doesn't stop at the IT department. Websites, online forms, tracking tools, and the customer data processed there all fall within the scope of reasonable protective measures. If you leave a content management system outdated, install plugins without checking them, or leave a contact form unprotected, you potentially open a door for attackers — regardless of whether your company formally falls under NIS2 or not. For people responsible for marketing, this means security should be a fixed part of digital communication, from choosing the tools and vendors you use to how data from campaigns, sign-up forms, and landing pages gets stored and protected. Working proactively here also builds trust with customers and partners, who increasingly ask how you handle security and data. The BSI (Germany's Federal Office for Information Security) offers orientation on baseline protective measures and current recommendations. Not legal advice. If you're unsure how your own website and marketing processes should be classified, it's worth clarifying these points together with IT and, where relevant, legal counsel, rather than putting the topic off.