The NIS2 directive sets out specific cybersecurity requirements for companies in critical sectors, but what about SMEs that are not directly required? Even if your company is not classified as an essential or important entity, knowing the NIS2 requirements for SMEs will help you to establish a solid basis for protection. In this article we explain what minimum measures you should implement, how to prepare evidence for audits, and why even uncompulsory companies should pay attention to this regulation.
What is NIS2 and what does SMEs directly affect?
The NIS2 Directive (Network and Information Security 2) is the European cybersecurity regulation that entered into force in January 2023 and was to be transposed into Spanish law before October 2024. This directive establishes cybersecurity requirements for companies operating in 18 sectors considered critical or essential.
As regards NIS2 requirements for SMEs by size, the regulation directly affects:
- Medium-sized enterprises: between 50 and 250 employees, with turnover between 10 and 50 million euros per year
- Large companies: more than 250 employees and more than 50 million euros of annual turnover
However, there are exceptions where even small businesses may be obliged: if their activity is considered critical, if they are the only provider of an essential service in the territory or if they operate in specific sectors such as digital infrastructure or DNS services.
Why should non-mandatory SMEs be aware of NIS2 requirements?
Even if your SME is not directly affected by NIS2, there are important reasons for implementing similar requirements:
- Supply chain requirements: Companies required by NIS2 may require their suppliers to meet minimum cybersecurity standards. If you work with customers in critical sectors (energy, health, banking, transportation), they may ask for documented evidence of your protection measures.
- Real business protection: Cyberattacks do not distinguish between companies that are forced by NIS2 and those that are not. A ransomware attack can paralyze your activity for weeks, regardless of your size or sector.
- Sweeping with GDPR: If you process personal data, you are already bound by the General Data Protection Regulation The NIS2 requirements for SMEs overlap significantly with these obligations.
- Preparation for future enlargements: The regulatory trend is towards a greater demand. Moving ahead with possible legislative changes will save you costs and urgency.
NIS2 requirements for SMEs: key measures adapted
Based on the nine pillars that NIS2 establishes, these are the measures that any SME should consider, adapted to its scale:
Risk analysis and safety concepts
Identify what information is critical to your business (customer data, financial information, credentials) and what systems are essential. Evaluate the most likely threats according to your sector and size. You don't need a comprehensive analysis such as NIS2 requires, but a core document that identifies risks and priorities.
Security incident management
Set a simple incident response protocol: who to warn, how to isolate affected systems, steps to contain the damage. Although NIS2 requires reporting serious incidents within 24-72 hours to authorities, your SME should have at least one internal action plan.
Continuity of operations and backups
Implement regular automatic backups (daily or weekly according to criticality). Save at least one offline copy to protect you against ransomware. Prove periodically that you can restore data. This is one of the NIS2 requirements for the most critical and accessible SMEs to implement.
Supply chain security
Evaluate your leading technology providers. Make sure that contracts with providers accessing your data include confidentiality and security clauses. Keep an up-to-date inventory of these providers.
Access control and identity management
Each employee should have access only to the information needed for their work. Implement robust passwords and dual-factor (2FA) authentication for critical accesses. Review permissions quarterly and remove accesses from former employees immediately.
Updates and patch management
Keep all operating systems, applications and devices up-to-date. Many attacks take advantage of vulnerabilities with patches available. Set a schedule of priority updates.
Basic staff training
The human factor is the weakest link. It shapes your employees in phishing recognition, secure password management, and suspicious incident procedures. An annual session can prevent most attacks.
Critical Data Encryption
Encrypt the most sensitive data, especially if you work with customer information or financial data. Implement HTTPS on your website and consider encrypting email communications when sharing confidential information.
Perimetral protection and network security
Keep firewalls, antivirus and antimalware assets on all computers. Set up your router and business wifi correctly with robust passwords and, if possible, segment the network to separate critical areas.
Essential documentary evidence for audits
Documentation is as important as technical measures. Here are the minimum documents you should prepare:
- Inventory of assets: List of equipment, applications, cloud services and technology providers, indicating which critical information each handles.
- Documented risk analysis: Although basic, it should include identified threats, probability, impact and measures taken. Update it annually.
- Backup policy: Often document backups, location, responsible and frequency of restoration tests. Includes records of copies made.
- Permission matrix: Document which employees access which systems. Keep evidence of periodic reviews.
- Update log: Control of applied security patches with dates and responsible.
- Training certificates: Training session records with date, content and attendees.
- Incident Management Protocol: Written procedure for incidents with contacts, steps and responsible.
- Contracts with suppliers: Signed copies of contracts that include security and confidentiality clauses.
When will you need to demonstrate your cybersecurity requirements
Your SME may need to show its cybersecurity measures in several scenarios:
- Large customer audit: Companies affected by NIS2 may require proof of your measures as a contractual condition
- GDPR inspection: The Spanish Data Protection Agency will evaluate your technical and organizational measures
- Voluntary certifications: If you are looking to be certified in ISO 27001 or National Security Scheme
- Investment processes: In due diligence, the status of your cybersecurity will be evaluated
Implement NIS2 requirements with expert advice
Knowing and applying NIS2 requirements for SMEs, even if you are not directly required, can make the difference between keeping your activity behind a cyber attack or facing a devastating operational crisis. It also opens commercial doors to customers demanding documented security standards.
In Afianza We help you implement these requirements in a way that is proportionate to your size:
- Applicability assessment: We determine whether your SME is directly bound by NIS2 or whether you should apply similar requirements.
- Adapted risk analysis: We identify specific vulnerabilities of your sector and size
- Proportional implementation: We guide you in realistic security measures for your budget and resources
- Audit documentation: We prepare all necessary evidence for customers, certifications or inspections
- Coordination with GDPR: We integrate cybersecurity requirements with your data protection obligations
Don't wait for a major customer to ask for evidence that you don't have or to suffer a cyber attack that paralyzes your business. Contact Afianza and set the minimum cybersecurity requirements that will protect your SME and strengthen your competitive position.
