Frequently Asked Questions

• What types of organizations need to comply with NIS 2?

  NIS 2 Directive is cracking down on organizations of all sizes. The standard categorizes businesses into two groups: Essential entities and Important entities.

  Essential entities are highlight critical sectors, including energy (electricity, oil, gas, etc.), transport (air, rail, water, road), banking, financial market infrastructures, health care, digital infrastructure (IXPs, DNS service providers, TLD name registries, cloud computing services, data centers) and public administration.

  Important entities are other integral industries such as postal and courier services, waste management, chemical manufacturing, food production, manufacturing (of certain critical products), digital providers (online marketplaces, search engines, social networking services) and research.

• How does NIS 2 impact managed service providers (MSPs)?

  NIS 2 explicitly includes MSPs within its scope, recognizing their critical role in the supply chain of essential services. This means MSPs operating in the EU (or providing services to EU clients) must:

  • Comply with the directive's security measures themselves.
  • Implement robust cybersecurity practices, including strong backup and recovery, incident response plans, and reporting procedures.
  • Manage supply chain risks by assessing and ensuring their direct suppliers and sub-processors also meet security standards.
  • Potentially offer compliance-related services to their clients, as many organizations will look to MSPs for help in achieving NIS 2 compliance.
  • Face significant penalties for non-compliance, similar to other in-scope entities.

• What are the main cybersecurity requirements under NIS 2?

  NIS 2 mandates comprehensive cybersecurity risk management measures, falling into four main areas:

  • Risk management: Organizations must implement appropriate technical, operational and organizational measures, including policies on risk analysis, information system security, incident handling, business continuity, supply chain security, security in network and information systems acquisition / maintenance, effectiveness assessment of cybersecurity measures, basic cyber hygiene, cybersecurity training, cryptography / encryption, human resources security, access control, asset management and multifactor authentication.
  • Corporate accountability: Management bodies are required to approve, oversee, and be liable for cybersecurity risk-management measures, and must receive regular cybersecurity training.
  • Reporting obligations: Essential and important entities must have processes for prompt reporting of security incidents that have a significant impact. This includes an "early warning" within 24 hours, an initial assessment within 72 hours, and a final report within one month.
  • Business continuity: Organizations must have plans for ensuring business continuity during and after major cyber incidents, including system recovery, emergency procedures, and crisis response teams.

• Is NIS 2 compliance mandatory for small and medium businesses?

  Generally, no. NIS 2 compliance is not mandatory for micro and small businesses (fewer than 50 employees and less than €10 million in annual revenue).

  However, it can become mandatory for them in specific exceptions:

  • If they are deemed a "critical entity" by a Member State, regardless of size, due to their specific risk profile or criticality.
  • If they provide services that are considered crucial to the EU economy and society, even if small.
  • Small and medium-sized enterprises (SMEs) that fall into the "Important" entity category (generally 50–250 employees or €10–50 million annual turnover) are in scope.

  Therefore, while most micro and small businesses are exempt, it's crucial for any business, regardless of size, to assess its role within critical supply chains and its direct impact on essential services to determine if NIS 2 might apply to them or their clients.