The question a smaller-business director asks is almost always binary: “am I covered by NIS2?”. The answer rarely is. Most often it is: “not directly, and that will not change much”. Here is why.
The directive requires the entities it regulates to control the security of their supply chain. A company supplying a regulated entity therefore inherits requirements — not through the law, but through the contract binding it to its client.
What the directive provides
Adopted in 2022, the directive known as NIS 2 succeeds a 2016 text that covered only a restricted number of operators. It widens the field considerably, distinguishes two categories of entity and raises the level of requirement.
- essential entities, in sectors deemed highly critical — energy, transport, health, water, banking, digital infrastructure, public administration
- important entities, in broader critical sectors — production, food, waste management, postal services, manufacturing, digital services
Membership combines a sector of activity and a size criterion. The European reference thresholds are those of the medium-sized enterprise: fifty employees and €10 million in turnover or balance sheet to enter the field, two hundred and fifty employees or €50 million to fall into the more demanding category.
Exceptions exist, independent of size, for activities whose failure would have major consequences.
Where French transposition stands
A directive does not apply directly: it must be transposed. In France, that transposition runs through a so-called resilience act, which carries three European texts at once — network security, resilience of critical entities, and operational resilience of the financial sector.
The framework is then completed by decrees and orders setting the sector lists, the thresholds adopted, the registration arrangements with the national authority and the inspection timetable. It is this second tier that makes the obligations enforceable.
The practical consequence for a company: the date that counts is not the directive’s, nor even the act’s, but that of the implementing texts naming it. Until they are published, the timetable stays indicative — and it is prudent to check the state of publication rather than rely on an article, this one included.
An obligation that is not yet enforceable arrives all the same — through your client’s specification.
What the supply chain changes
This is the most underestimated mechanism. A regulated entity must assess and manage the risks attached to its direct suppliers. It can only do so by asking them.
- a security questionnaire to complete, often at tender stage, and now capable of eliminating you
- contract clauses: incident notification within a short deadline, right of audit, requirements on further subcontractors
- evidence rather than declarations: a written policy, an incident log, dated restore tests
A smaller business can therefore find itself contractually bound by obligations close to those of a regulated entity, without ever appearing on any list. Refusing to answer costs you the contract, not a fine.
What a company outside the perimeter is well advised to do
Nothing resembling a compliance programme. Four items are enough to answer most questionnaires, and they have a use of their own independently of NIS2:
- knowing who to call in an incident, and within what deadline to warn a client
- having a backup restored at least once, with the date of the test
- keeping the list of privileged accounts, with a name against each
- having written down, on two pages, what is done and what is not — an honest statement is worth more than a borrowed policy
The last point deserves emphasis. A security document copied from a template describes an organisation that does not exist. It does not fool an auditor, and it exposes you more than admitting to a modest but real arrangement.
The link with what you already have
The four points above assume you know what you have. That is exactly what an infrastructure audit records — and it starts, as it happens, with what nobody knows any more.
None of these four points can be handled independently of the state of the estate. A company that does not know which accounts hold extended rights, or whether its backups restore, cannot answer them — and that is exactly what an infrastructure audit records.
Common questions
Who is covered by NIS2?
Essential and important entities in sectors deemed critical, subject to a size criterion: the European reference thresholds start at fifty employees and €10 million in turnover or balance sheet. Most small businesses are not directly covered.
Is a small business outside NIS2 still affected?
Often, yes, through contracts. A regulated entity must manage its suppliers’ security: it passes on security questionnaires, incident-notification clauses and audit rights. Refusing to answer costs you business, not a fine.
How should a supplier prepare for NIS2?
Without launching a compliance project: know whom to call in an incident and how quickly to notify a client, have a backup restored at least once, keep a list of privileged access rights, and write honestly on two pages what is done and what is not.