12 Sept 2026

NIS2: what a 30-person company actually has to do

The directive reads like it is written for banks. Here is the practical list for a small business that supplies one.

NIS2 pulls in suppliers of essential entities, which means a small company can inherit obligations through a single enterprise customer. In practice the requirements collapse into four things: know your assets, control access, be able to detect and report an incident within 24 hours, and prove it.

Start with the register

An asset register and a risk register are where every audit begins. Neither needs a tool; a maintained spreadsheet passes.

Then the controls

MFA everywhere, patching with evidence, backups you have restored, and a written incident procedure someone has read.