NIS2 is for SMEs no longer theory

Sept 29, 2026 (updated on Nov 11, 2026)

NIS2 sounds far away from your bed. A European directive for energy companies, hospitals, telecom. If your SME does not provide an essential service, surely you are not subject to it?

Legally that is correct, in many cases. And yet we notice with almost every SME we talk to that the pressure is arriving. Not from the regulatory side, but from the chain.

The questions come from customers, not from the government

Companies in the supply chain of a NIS2 organisation increasingly receive questionnaires: how does your security stand, who has access to which systems, how do you handle our data. The CCB, the Belgian cyber centre, explicitly advises every organisation in such a chain to implement at least CyberFundamentals Basic. That is the Belgian framework that connects to NIS2.

That is why the security manager of your biggest customer is now asking questions at the table that nobody asked three years ago. Whoever proves things are in order gets the job. Whoever cannot prove it drops out. That question has become purely commercial, without a single fine in play.

Insurers are moving along too. Anyone applying for cyber insurance gets questions about multifactor authentication, backups and access management. Whoever cannot answer them pays more or gets nothing.

The trigger is rarely an inspection. Usually it is an email from a customer on an ordinary working day: an attachment with questions about access, backups and incidents, and the friendly notice that the quote only follows once the answers satisfy. At that moment it is too late to start thinking.

What CyFun Basic asks in practice

CyFun Basic is not an absurd standard. It asks for the basics: strong authentication, access management, patching, backups, an incident plan and a minimum of reporting. For an SME that is achievable, provided someone keeps it up.

Concretely this means: multifactor authentication for all accounts and certainly for administrators. Roles smaller than strictly necessary, so a leaked account does not give total access. Devices that patch and are managed. Backups whose restore you actually test. And a plan for who you call when things go wrong on a Saturday evening, because that is not the moment to start looking for phone numbers.

None of these points requires a security department. They require an owner: someone who follows up, adjusts and reports what happens. For many SMEs that is the real threshold, not the technology.

What you should NOT do

Buy panic. An expensive security platform because "we fall under NIS2" while nobody has checked what is actually being asked. We have seen it a few times already: fear of the rule leads to purchases that miss the problem.

Maturity comes from follow-up, not from purchases

Because purchases alone move nothing. We recently guided an organisation that threw everything at it for a year: migrations, awareness campaigns, new systems. The CyberFundamentals self-assessment barely moved forward. Not because the work was worthless, but because the weak spots were not touched: who follows up the alerts, who tests the backups, who looks monthly at the risks that really matter? Projects do not create maturity. Follow-up does.

Anyone taking NIS2 seriously asks two questions. Not only what to buy, but above all who keeps following it up. The answer to that second question determines whether the investment is worth anything.

Management is on the hook, like it or not

Under NIS2 the responsibility lies with management, not with the IT department. In an SME this means concretely: the owner or the management team must be able to explain which risks the organisation acknowledges, which choices it makes and why. "Our IT partner handles that" is an answer that no longer passes.

That does not have to cost much time. An overview of the biggest risks, a few conscious decisions and a short list of choices suffice. What counts is that it exists and that it lives: discussed, updated and consulted as soon as budget is divided. An audit report is precisely the document that makes this conversation possible again and again.

From unknown to defensible

What you need is to know where you stand before you can prove you are worth it. An independent Security Audit places your environment next to CyberFundamentals Basic and Important, with each finding linked to the requirements. You get a report you can show a customer, insurer or auditor, and a priority plan that makes the coming months steerable.

Deliberately also Important: many organisations today still do not know how they will be classified under NIS2, and that uncertainty can last for years. A report covering both profiles stays valid whichever way it goes.

Want a first picture yourself in the meantime? The CCB's CyFun self-assessment tool is free and gives an indication of where you stand. Keep in mind that it measures what you think, not what is actually sitting in your environment. That difference is exactly the difference between a self-assessment and an independent audit.

Meanwhile, do not expect a one-month job. Going from unknown to defensible takes months: first measure, then the quick fixes, then the foundation, and only then the evidence towards customers. Our step-by-step plan from zero measurement to secure workplace describes that trajectory step by step, from the baseline measurement to the improvement plan that stays alive.

Plan your audit. The questions from the chain are coming anyway. With a report you can answer them instead of dodging them.