NIS2 applies to medium-sized and large companies in the eighteen sectors it lists, not only to large ones. Under the EU SME definition, that means 50 or more employees, or more than EUR 10 million in both annual turnover and balance sheet. Small and micro companies are mostly out of scope. But if they supply regulated companies, those customers will pass NIS2-style requirements on to them.
This guide covers who is in scope, how to check, why NIS2 reaches SMEs that are out of scope, what customers will ask for, the support SMEs can expect, and how to prepare.
| Your company | In a sector listed in Annex I or II? | NIS2 status |
|---|---|---|
| Micro or small (under 50 employees, and turnover or balance sheet up to EUR 10M) | Yes | Out of scope, unless in a category covered regardless of size |
| Medium-sized (50 to 249 employees, or above the small-company ceilings) | Annex I or II | In scope, usually as an important entity |
| Large (above the medium-sized ceilings) | Annex I | In scope as an essential entity |
| Large | Annex II | In scope as an important entity |
| Any size | No | Out of scope, but reached through customers’ supply-chain duties |
Does NIS2 apply to SMEs?
Partly. NIS2 uses the EU definition of micro, small and medium-sized enterprises in Commission Recommendation 2003/361/EC:
- Micro: fewer than 10 employees, and annual turnover or balance sheet total up to EUR 2 million.
- Small: fewer than 50 employees, and annual turnover or balance sheet total up to EUR 10 million.
- Medium-sized: fewer than 250 employees, and annual turnover up to EUR 50 million or balance sheet total up to EUR 43 million.
The directive applies to entities in the listed sectors that are at least medium-sized. So the medium-sized part of the SME population is in scope, which is the part most people overlook. A 60-person manufacturer of electrical equipment, or an 80-person managed service provider, is covered.
Small and micro companies are out of scope, with exceptions that apply regardless of size: providers of public electronic communications networks or services, trust service providers, top-level domain registries and DNS service providers, public administration entities, and entities a national authority designates because a disruption would have a serious impact. Headcount and financials can also include those of linked companies in the same group, so a small subsidiary of a larger group can be in scope.
National laws apply the same test. Luxembourg’s is Article 1 of the Law of 5 May 2026, explained in NIS2 in Luxembourg.
How do you check whether your company is in scope?
Two questions decide it: is your activity listed in Annex I or Annex II, and are you at least medium-sized? The NIS2 scope checker asks for sector, headcount and turnover and tells you in three clicks. The detail behind the answer is in NIS2 scope and applicability, and the difference between the two categories in essential vs important entities.
If you are in scope, the duties are the full set, applied proportionately: the risk-management measures in Article 21, incident reporting on the 24-hour, 72-hour and one-month clocks, management-body approval and training, and registration. Proportionality is how a medium-sized company sizes the measures to its risk.
Why does NIS2 reach SMEs that are out of scope?
Through the supply chain. Article 21 requires essential and important entities to manage supply-chain security, including the security aspects of their relationships with direct suppliers and service providers. Article 21(3) makes them take into account the vulnerabilities specific to each direct supplier and the overall quality of its products and cybersecurity practices.
Recital 56 explains why. SMEs are increasingly the target of supply-chain attacks, because their security measures and resources are more limited, and a breach at a supplier can cascade into the larger customers it serves. An SME that provides software, hosting, managed services or data processing to a bank, an energy company or a hospital is part of that customer’s attack surface.
The customer asking you questions is not being difficult. It is meeting its own obligation: it has to show that it assessed its suppliers and took proportionate measures. The simplest measure is to require suppliers to meet a security baseline. For the supplier, that turns readiness into a condition of doing business. How customers run this is in supply chain security under NIS2.
What will regulated customers ask SME suppliers for?
Nothing exotic. The questions follow the Article 21 measures:
- Asset management: knowing what hardware and software you own and run.
- Access control: only authorised people reach systems and data, with multi-factor authentication for remote access.
- Encryption: for sensitive data in transit and at rest.
- Incident detection and response: a way to notice when something is wrong, and a procedure for what happens next.
- Backup and recovery: regular backups to a separate system, so you can recover from ransomware or data loss.
- Vulnerability management: systems kept up to date, scanned for known flaws, and critical issues fixed promptly.
- Staff training: employees who recognise phishing and social engineering and know their role.
These are long-standing good practice, but many SMEs apply them inconsistently. A supplier that wants to keep regulated customers has to show that they are in place and working, usually through a security questionnaire.
What support do SMEs get under NIS2?
The directive expects Member States to help. Article 7(2)(i) requires each national cybersecurity strategy to include a policy on strengthening the cyber resilience and cyber hygiene baseline of SMEs, in particular those outside the directive’s scope, with easily accessible guidance and assistance for their needs.
Recital 56 adds that Member States should have a point of contact for SMEs, at national or regional level, that gives guidance or directs them to the right bodies, and encourages services such as website configuration and logging for micro and small companies. What exists varies by country, from guidance and self-assessment tools to subsidised audits and training, so check what your national authority offers. The strategy requirement itself is covered in national cybersecurity strategies under Article 7.
Why is ransomware the practical reason for SMEs to act?
Because it is the threat most SMEs actually face, and Recital 56 names it. Ransomware is a volume business: phishing emails go to thousands of organisations, some are opened, some users click, the malware spreads and the files are encrypted. Many SMEs are hit because they happened to be on the list, not because they were chosen.
NIS2 does not remove that risk, but its measures are the ones that blunt it. Backups mean you can recover without paying. Access controls make it harder for an attacker to spread. Detection catches an infection sooner. Training means fewer phishing emails succeed. The directive’s specific treatment of ransomware is in the ransomware dimension of NIS2.
How should an SME prepare for NIS2?
Treat it as a steady improvement, not a one-off project. In order:
- Assess where you are. Do you have a security policy covering access, passwords and incident response, and do employees know it exists? Writing one costs nothing and forces you to say what should happen.
- Identify what matters most. The systems, data and infrastructure whose loss would stop the business. You cannot protect everything equally.
- Patch on a schedule. For example, critical security updates within 48 hours and other updates within 30 days, automated where possible. Many attacks exploit flaws that were fixed months earlier.
- Turn on multi-factor authentication for remote access. It stops most phishing-based account takeovers.
- Back up, and test the restore. Automated, offsite, regular backups, with a recovery test at least once a year.
- Train your staff. Phishing, passwords and how to report something suspicious.
- Write down what you do. When a customer asks about your security posture, a one-page summary backed by evidence answers most of it.
If you have budget, an independent security audit finds the biggest risks quickly. If you are in scope, the full programme is described on the NIS2 solution page.
NIS2 checklist for SMEs
- Check whether your activity is listed in Annex I or II, and whether you are at least medium-sized.
- If you are in scope, register with your national authority and brief your management body.
- If you are out of scope, list which of your customers are regulated and what they will ask for.
- Put asset management, MFA, patching, backups and training in place first.
- Test a backup restore and time it.
- Keep a one-page security summary and the evidence behind it ready for questionnaires.
- Check what support your national SME point of contact offers.
Frequently asked questions
Does NIS2 apply to small businesses?
Mostly not. NIS2 applies to entities in the listed sectors that are at least medium-sized under the EU SME definition. Small and micro companies are out of scope unless they fall into a category covered regardless of size, such as DNS service providers or trust service providers, or are designated by their national authority.
Is a company with 50 employees covered by NIS2?
It can be. A company with 50 or more employees is no longer a small enterprise under the EU definition, so if it operates in a sector listed in Annex I or II of NIS2 it is in scope, usually as an important entity.
What does NIS2 require from an SME that is in scope?
The same duties as any in-scope entity, applied proportionately: the risk-management measures of Article 21, incident reporting within 24 hours, 72 hours and one month, management-body approval and training, and registration with the national authority.
Do SMEs outside the scope of NIS2 have to comply?
Not by law. In practice, regulated customers must manage the security of their direct suppliers, so they will ask SME suppliers for evidence of basic controls through questionnaires and contract clauses.
What support does NIS2 give SMEs?
Article 7(2)(i) requires each national cybersecurity strategy to strengthen the cyber resilience and cyber hygiene of SMEs, in particular those outside the scope of the directive, with easily accessible guidance and assistance. Recital 56 asks Member States to provide an SME point of contact.
