NIS2 for SMEs: obligations and practical checklist
NIS2 covers many SMEs in critical sectors and reaches others through their customers. This guide shows when it applies, what your customers will ask for and an Article 21 checklist with evidence.
In 30 seconds: Directive (EU) 2022/2555 covers medium-sized and large companies in 18 sectors and, by exception, some smaller ones. If you fall outside it, covered customers will pass requirements on to you by contract. The core is the 10 measures of Article 21 and incident reporting at 24 hours, 72 hours and one month. Spain has still not transposed it.
When NIS2 applies to SMEs
The general rule in Article 2 combines two filters. First, your activity must appear in Annex I (high criticality) or Annex II (other critical sectors). In total, they cover 18 sectors, from energy and health to manufacturing, food and digital providers. Second, you must be at least a medium-sized enterprise under Recommendation 2003/361/EC.
In practice, you are medium-sized or larger if you have 50 or more employees. The same applies if both your annual turnover and your balance sheet total exceed €10 million. Hence micro and small SMEs fall outside the general NIS2 rule. Watch out for groups, too: the figures generally include, in full or in part, those of your partner and linked enterprises.
Within scope, a medium-sized company is usually an important entity, subject to ex post supervision. By contrast, large companies in Annex I are usually essential and also face ex ante supervision.
However, Article 2 sets out exceptions where size does not matter. The directive reaches you whatever your size if you:
- Provide public electronic communications networks or publicly available electronic communications services.
- Are a trust service provider, a top-level domain name registry or a DNS service provider.
- Offer domain name registration services.
- Act as the sole provider in your country of a service essential for critical activities.
- Run a service whose disruption could seriously affect public safety, security or health, or create systemic risk.
- Hold specific national or regional importance, or count as a critical entity under Directive (EU) 2022/2557.
In the last few cases, the national authority is the one that identifies you. If in doubt, follow the steps in how to tell whether the directive applies to you.
NIS2 and supplier SMEs: the supply chain
Even if you are out of scope, the directive can reach you through your customers. This is because Article 21 requires covered entities to manage the security of their direct suppliers. They must also assess those suppliers’ cybersecurity and secure development practices. That is why many SMEs with no direct NIS2 obligation already receive questionnaires, clauses and audit requests.
In practice, customers will mainly ask you for four things:
- Report incidents that affect their service without delay.
- Show basic measures: MFA, tested backups, patching and access control.
- Also accept audits or provide certificates, such as ISO 27001 or Spain’s ENS.
- Finally, manage your own subcontractors with similar criteria.
Answering those questionnaires well is already a commercial advantage for SMEs selling into NIS2 sectors. So the checklist below works for you whether or not the directive applies directly.
NIS2 checklist for SMEs: the 10 Article 21 measures
Article 21 requires technical, operational and organisational measures proportionate to the risk and, among other factors, to the size of the entity. So a small company does not need what a bank needs, but it must cover all ten areas.
| Measure (Art. 21(2)) | Reasonable minimum | Evidence |
|---|---|---|
| a) Risk analysis and system security policies | Policy approved by management and an up-to-date risk analysis | Approval minutes and a dated risk register |
| b) Incident handling | Procedure to detect, classify, respond and report | Incident log and a 24/72-hour reporting template |
| c) Business continuity and crisis management | Tested backups, disaster recovery and a crisis plan | Restore test report and approved plan |
| d) Supply chain security | Inventory of direct ICT suppliers and security clauses | Critical supplier list, contracts and questionnaires |
| e) Acquisition, development and maintenance | Security when buying or developing, and vulnerability handling | Patching policy and scan reports |
| f) Assessing effectiveness | Indicators, internal reviews or audits | Internal audit report and metrics |
| g) Cyber hygiene and training | Updates, passwords and training for staff and management | Attendance records and training plan |
| h) Cryptography and encryption | Policy on cryptography and, where appropriate, encryption | Encryption settings for devices and backups |
| i) HR security, access control and assets | Joiners and leavers, least privilege and an asset inventory | Inventory and access reviews |
| j) MFA and secure communications | Multi-factor authentication and secure emergency channels, where appropriate | MFA coverage and crisis procedure |
Management, incidents and evidence
In addition, management must approve these measures, oversee them and take training, as we explain in what liability directors face. For a significant incident, Article 23 requires an early warning within 24 hours, a notification within 72 and a final report within a month. Under NIS2, however, what counts for SMEs is proving it with dated evidence.
Implementing Regulation (EU) 2024/2690 for digital providers
If your company provides digital services, also read Implementing Regulation (EU) 2024/2690. It dates from 17 October 2024 and has been in force since 7 November 2024. It also sets out the technical requirements of Article 21, and when an incident counts as significant, for these providers:
- DNS service providers, top-level domain name registries and trust service providers.
- Cloud computing services, data centres and content delivery networks.
- Managed service providers and managed security service providers.
- Online marketplaces, online search engines and social networking platforms.
Likewise, its annex details thirteen areas, from the security policy to physical and environmental security. Note, however, that except for DNS, domain registries and trust services, the size thresholds still apply. As a regulation, it needs no transposition, although supervision depends on each national authority. In addition, ENISA published technical guidance with examples of evidence in June 2025. For SMEs providing managed ICT services to NIS2 entities, it is the most concrete reference available.
Where Spain stands in October 2026
Spain has still not transposed the directive, although the deadline expired on 17 October 2024. In July 2026, the European Commission referred Spain to the Court of Justice of the EU over this failure. Then Royal Decree 806/2026 (Official State Gazette, 6 October) dissolved the Cortes Generales and called elections for 29 November. As a result, there will be no transposition law in 2026. Moreover, the draft Cybersecurity Coordination and Governance Act, approved by the Council of Ministers in a first round in January 2025, never completed its passage.
Meanwhile, Royal Decree-Law 12/2018 remains in force for operators of essential services and certain digital service providers. In general, an untransposed directive does not create direct obligations for a private company. Even so, waiting is a poor strategy for SMEs within NIS2 scope. After all, your customers already ask for these measures, and preparing them takes months. You will also find the details in the state of transposition in Spain and the CJEU case.
Frequently asked questions
Does NIS2 apply to all SMEs?
No. In fact, it only covers medium-sized companies in the sectors of its annexes. By exception, it also reaches some smaller ones, such as DNS service providers or trust service providers. By contrast, the rest may feel it indirectly through their customers.
What fines does the directive set?
Essential entities face maximum fines of at least €10 million or 2% of worldwide annual turnover. For important entities, the cap is at least €7 million or 1.4%, whichever is higher in each case. Article 34 sets these figures, although the exact amounts in Spain will depend on the transposition law.
Does ISO 27001 help you comply?
It helps a great deal, because its management system and Annex A cover much of Article 21. We also look at this in ISO 27001 as a shortcut across regulations. Even so, check what is specific to the directive: reporting deadlines, management accountability and the supply chain.
Where should SMEs start with NIS2?
First, confirm whether it applies and in which category. Then run a gap analysis with the table above and prioritise by risk and cost. Finally, prepare the incident reporting procedure and gather the evidence you already have.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps
Atalaya GRC turns the ten measures NIS2 requires of in-scope SMEs into controls with owners and evidence. First, it works out what applies to you service by service. It then reuses each control for ISO 27001, the ENS or GDPR: one control, many regulations. In addition, its regulatory clock warns you about deadlines, and incident management guides you through each report. It also keeps the third-party register you need to answer your customers. See the NIS2 page on Atalaya GRC or request a demo.
