NIS2 for SMEs: who is affected and what to do now

What NIS2 is and why it matters for SMEs

NIS2, officially Directive (EU) 2022/2555, is the revised EU directive on cyber security. It generally applies to medium-sized and large companies in 18 sectors and requires risk management, prompt reporting of significant incidents and an active role for management. Many smaller businesses are not covered directly but feel NIS2 through their customers.

It replaces the first NIS Directive from 2016 and covers far more companies. For SMEs, three questions matter: Are we covered ourselves? Will our customers ask us for evidence? And what exactly do we have to do? This article answers them in plain language, but it does not replace legal advice.

Who is covered: sectors and company size

The sectors

The directive distinguishes two groups. Sectors of high criticality are energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management for business customers, public administration and space.

Other critical sectors include postal and courier services, waste management, chemicals, food, parts of manufacturing such as machinery, electronics and vehicles, digital providers such as online marketplaces, and research. The annexes of the directive and the national law define each category precisely.

The size threshold

As a rule, medium-sized and large companies in these sectors are covered. Put simply, that starts at 50 employees, or at more than 10 million euros in annual turnover and a balance sheet total of more than 10 million euros. Partner and linked enterprises can count towards these figures.

Some entities are covered regardless of size, including providers of public electronic communications networks and services, trust service providers, DNS service providers and entities that are the sole provider of a critical service in a member state. So check your activities, not just your headcount.

Indirectly affected: NIS2 in the supply chain

Many SMEs are not covered by NIS2 themselves but still feel its effects, because covered companies must also address the security of their supply chain. This affects IT service providers, maintenance firms, software vendors, logistics partners and many other suppliers, who typically receive requests such as:

• Security questionnaires on backups, updates, access rights and incident plans
• Contract clauses with minimum standards and duties to report incidents
• Evidence such as security policies, training records or audit reports
• Multi-factor authentication for all access to customer systems

Suppliers with clear, documented answers have an advantage in tenders and contract renewals.

What NIS2 requires: the risk-management measures

Covered entities must take appropriate and proportionate technical, operational and organisational measures. The directive lists a set of minimum topics. Proportionate means that the effort depends on the company's risk exposure and size, and on the likelihood and severity of possible incidents.

• Risk analysis and security policies for your information systems
• Incident handling, meaning detecting, analysing, containing and recovering from incidents
• Business continuity with backup management, disaster recovery and crisis management, for example through a 3-2-1 backup strategy
• Supply chain security towards service providers and suppliers
• Security in the acquisition, development and maintenance of systems, including vulnerability handling
• Assessing the effectiveness of the measures taken
• Basic cyber hygiene and training for staff
• Policies on cryptography and, where appropriate, encryption
• Human resources security, access control and asset management
• Multi-factor authentication, where appropriate, and secured communication, covered in our article on introducing MFA

Reporting obligations: 24 hours, 72 hours, one month

Significant incidents must be reported. Put simply, an incident is significant if it has caused or can cause severe operational disruption or financial loss, or if it can cause considerable damage to others. Reports go to the competent CSIRT or authority in three stages:

1. Early warning without undue delay and within 24 hours of becoming aware of the incident, indicating, for example, whether an unlawful or malicious act is suspected or a cross-border impact is possible.
2. Incident notification within 72 hours of becoming aware, with an initial assessment of severity and impact.
3. Final report no later than one month after the notification, describing the incident, its cause and the measures taken. If the incident is still ongoing by then, a progress report is due first.

Management is responsible

NIS2 explicitly makes cyber security a management task. Management bodies must approve the risk-management measures, oversee their implementation and can be held liable for infringements. Members of management are also required to take part in training.

In practice, IT security cannot be fully delegated to the IT department or an external provider. Management should be briefed regularly on the security status and document its decisions.

The situation in Austria: the NISG 2026

In Austria, NIS2 is transposed by the Network and Information Systems Security Act 2026 (Netz- und Informationssystemsicherheitsgesetz 2026, NISG 2026). It was published in the Federal Law Gazette in December 2025 (BGBl. I Nr. 94/2025) and has been in force since 1 October 2026. The previous NISG 2018 ceased to apply on the same date.

According to information published so far, for example by the Austrian Economic Chamber (WKO), covered entities have three months from entry into force to register with the cyber security authority (Cybersicherheitsbehörde). A self-declaration on the risk-management measures taken is due within twelve months of the start of the registration duty. Regulations and official guidance set out details such as format and exact dates.

First steps for SMEs

1. Check whether you are covered: establish sector, activities, headcount, turnover and balance sheet total, including linked enterprises, and note the registration deadline if you are covered.
2. Look at the supply chain: which customers are covered by NIS2, and which requirements do they pass on?
3. Take stock: list systems, data, access rights and service providers, and name the biggest risks.
4. Implement quick basic measures: MFA for email and remote access, tested backups with an offline copy, current updates.
5. Define the incident and reporting process: responsibilities, contacts and templates for the 24-hour early warning.
6. Involve management: have the action plan approved, schedule training and report progress regularly.

NIS2 is not a one-off project but an ongoing process. Starting in a structured way also creates the evidence that customers and authorities expect. Q-entra supports you with the assessment and the implementation of technical measures in cyber security and, if you wish, takes over ongoing operation with managed security.