NIS2 for small and medium-sized enterprises: Why the topic is now on every agenda
NIS2 significantly raises the requirements for cybersecurity and organisational resilience across many companies. While large organisations may already have established information security structures, many SMEs face a different situation: they need to meet new regulatory requirements without dedicated compliance departments or large security teams.
NIS2 can appear to be primarily about bureaucracy, documentation and additional obligations. However, the directive has a broader purpose. Companies must be able to demonstrate that they can identify and manage cyber risks, prepare for security incidents and restore their operational capability as quickly as possible if the worst happens.
The key question is therefore not whether NIS2 needs to be implemented, but how companies can do so realistically, effectively and sustainably.
What makes the implementation of NIS2 so difficult for SMEs?
Many companies start with the same questions:
- Scope: Does NIS2 apply to us, and which requirements are relevant?
- Current position: Where do we stand today, and where are the gaps?
- Priorities: Which requirements are most critical, and where should we begin?
- Effort: Which measures are required, and how much work will they involve?
- Responsibility: Who is responsible for implementation and oversight?
At the same time, the new requirements meet a familiar reality for many SMEs: tight budgets, overstretched IT teams and several projects running in parallel. This creates tension between regulatory obligations and operational feasibility. The requirements may be extensive, yet companies often lack clear priorities for deciding which measures need to be addressed first.
Many organisations already have individual security measures in place but do not know how these relate to NIS2. Policies, emergency plans, technical controls and defined processes may already exist. What is missing is a clear view of which requirements these measures already cover and where gaps remain.
The challenge is therefore rarely about starting from scratch. Existing measures need to be assessed, organised and placed within a coherent framework. This is what makes implementation demanding for those responsible. They need to understand regulatory requirements, initiate organisational change and evaluate technical risks at the same time.
The result: uncertainty, delays and no clear point of entry. Without defined priorities, companies may invest considerable time and budget in measures that make only a limited contribution to reducing their most pressing risks.
Why SMEs struggle with NIS2 compliance
A common mistake is to treat NIS2 as an IT-only project. The directive covers far more than firewalls, endpoint protection and other technical security solutions. Risk management, defined responsibilities, supplier management, emergency preparedness, security awareness and documentation all play an important role. Many companies begin with extensive analyses or long lists of measures. These can create transparency, but they often fail to answer the most important question:
Which measures will deliver the greatest benefit for security and compliance right now?
Without prioritisation, assessments can quickly produce dozens of open tasks. Those responsible become overwhelmed, decisions are postponed and important measures lose momentum.
The most common mistakes in NIS2 implementation
Mistake 1: Trying to tackle everything at once
Companies attempting to implement all requirements in parallel can quickly need more resources than they have available. A staged approach makes it easier to prioritise risks and measures according to their relevance.
Mistake 2: Confusing compliance with security
Complete documentation alone does not protect a company from cyberattacks. Equally, modern security solutions are not enough without traceable processes and clearly assigned responsibilities. Security and compliance need to be addressed together.
Mistake 3: Ignoring existing structures
Many companies already have security measures, policies and established processes. Failing to take these into account creates duplicate work and makes implementation more expensive than necessary.
Mistake 4: Failing to define clear responsibilities
NIS2 affects several areas across a company. Without clear ownership, decisions are delayed and measures lose momentum and accountability.
Mistake 5: Treating implementation as a one-off project
Cybersecurity and resilience cannot be completed once and then marked as finished. Processes need to be reviewed, adapted and developed on an ongoing basis.
Typical NIS2 challenges for SMEs and practical first steps
The challenges associated with NIS2 implementation rarely arise from one requirement alone. Projects tend to lose momentum when regulatory obligations, limited resources and a lack of direction come together. Looking at common starting points helps companies identify where to begin and which steps matter most at the outset.
| Challenge | Underlying cause | First step |
|---|---|---|
| Uncertainty about whether NIS2 applies | The legislation has not yet been assessed in relation to the company | Conduct a scope assessment and review the current position |
| Too many open measures | Gap analyses without prioritisation | Evaluate risks and measures according to their business impact |
| Limited resources | Small IT and security teams | Divide measures into manageable implementation packages and assign clear ownership |
| Unclear responsibilities | Several departments are affected, with no central coordination | Define clear roles and responsibilities, then manage implementation according to priorities and ownership |
| Documentation workload | No established process for collecting evidence | Make systematic use of existing documentation and evidence |
| Maintaining progress over time | Focus on isolated projects | Move measures into regular operations using the Plan-Do-Check-Act cycle |
The table shows that many challenges are not created or resolved by adding more tools. At the beginning, a clear overview, defined priorities and assigned responsibilities often matter more than new technology.
Where investments in NIS2 pay off first
Not every measure has the same impact on a company’s resilience. Trying to address every requirement at once can make it difficult to maintain an overview and may tie up resources in areas that currently offer limited value.
A better starting point is to strengthen the areas that provide a foundation for later measures. Once responsibilities are clear, risks are visible and processes are documented, further requirements become easier to manage. The following areas therefore deserve particular attention:
Governance and Responsibilities
Information security needs clear ownership. The company should define who makes decisions, assesses risks and steers individual measures. Without fixed responsibilities, tasks remain unresolved, decisions take longer and important topics move back and forth between departments.
Emergency planning and compliance with reporting deadlines
A security incident cannot always be prevented. What matters is how quickly a company can respond, comply with the applicable reporting obligations and maintain business operations. Clear procedures, named contacts and tested emergency plans provide direction when fast decisions are required. Reporting processes should also specify who assesses an incident, who initiates the relevant notifications and which information needs to be available.
Risk Management
Companies need to understand which systems, processes and information are especially critical to their operations. This knowledge allows them to prioritise protective measures based on actual exposure. A clear view of risk also supports better decisions about budgets and resources. Investment can then be directed towards the areas where disruption, data loss or compromised systems would have the greatest business impact.
Awareness and Security Culture
Technical controls lose effectiveness when employees cannot recognise risks or are unfamiliar with security procedures. A shared understanding of information security helps reduce errors, identify incidents earlier and embed security requirements in day-to-day work. Awareness measures should reflect the company’s actual risks and the responsibilities of different roles. Employees in finance, IT, management or operations may encounter different attack scenarios and therefore need relevant guidance.
Documentation and verifiable evidence
Measures need to be documented in a traceable way. Documentation creates visibility around decisions, responsibilities and completed actions. It also supports internal coordination, audits and the provision of evidence to customers, partners or authorities. The aim is not to produce documents for their own sake. Records need to show what was decided, why the decision was made, who is responsible and how the effectiveness of a measure is reviewed.
Practical examples from typical SME scenarios
Scenario 1: The company with security structures that have grown over time
Over several years, new security measures have been introduced, responsibilities have been distributed and individual requirements have been addressed through separate projects. Today, no one has a complete overview of which NIS2 requirements are already covered and where action is still required.
The first step is to create transparency around existing processes, policies and security measures. Once these have been mapped against the relevant requirements, the company can distinguish genuine gaps from areas that only need better documentation or coordination.
Scenario 2: The small IT team
In many SMEs, the same team manages IT operations, user support, ongoing projects and IT security. There is little capacity within day-to-day operations for an extensive compliance project such as NIS2 implementation.
The company needs to address its most significant risks first and allocate available resources where they will have the greatest impact. Organisational and technical measures also need to be coordinated according to defined priorities, with responsibilities assigned in a way that avoids conflicts of interest.
Scenario 3: Multiple locations with different processes
Companies with several locations may have different security processes, responsibilities and documentation standards. One location may assess and document risks on a regular basis, while another uses its own procedures or assigns responsibility to different roles.
The company first needs a shared framework for roles, processes and minimum requirements. This creates the basis for managing security measures and evidence consistently across all locations while allowing local teams to retain processes that meet the agreed standard.
How SMEs can assess their NIS2 readiness
Organisations may already have more of the required foundations in place than they realise. Many companies have invested in information security, emergency preparedness and cyber defence over recent years. Policies, processes, technical controls or defined responsibilities may already cover important elements of NIS2.
Indicators of a solid maturity level include:
- Responsibilities are clearly assigned
- Risks are reviewed regularly
- Security measures are documented
- Incidents are handled through defined processes
- Employees receive guidance on security risks
- Improvements are managed continuously
If several of these elements are already in place, the company may have a strong foundation for the remaining requirements. The next task is not to replace everything that exists. Existing measures should be developed further, gaps need to be closed and individual activities have to be brought together within a traceable overall strategy.
Choosing external support: What companies should consider
Implementing NIS2 may require additional expertise or capacity. The key question is which type of support fits the company’s actual situation. Not every organisation needs a large-scale project, while a one-off consultation may not provide enough support for implementation and ongoing operation.
External support should fit the company’s existing structures, security maturity and available resources. The aim should be to relieve pressure on internal teams while strengthening the organisation’s ability to manage the requirements over the long term.
Important criteria include:
- Consideration of existing structures
- An understanding of the realities facing SMEs
- Clear and traceable prioritisation
- Realistic implementation recommendations
- Long-term operational suitability
- Expertise in both security and compliance
The focus should be on implementing the right measures at the right time. Effective support makes dependencies visible, translates recommendations into manageable tasks and helps internal teams retain control of decisions and implementation.
Conclusion
NIS2 presents many SMEs with the same challenge: extensive requirements need to be met with limited resources. Implementing isolated measures or focusing exclusively on formal compliance will not provide the necessary level of security and resilience.
Companies should approach NIS2 as a strategic development of their security and resilience structures. A clear view of the current position comes first, followed by risk-based priorities and improvements delivered in manageable stages.
Practical implementation and compliance are not competing goals. Companies that build on existing structures, prioritise measures according to their impact and coordinate organisational and technical requirements can make sustainable progress without overwhelming their teams.
The exact route to NIS2 compliance will vary from one organisation to another. One principle applies across these different starting points: the greatest progress comes from a clear plan, realistic priorities and continuous improvement, not from trying to achieve perfection from day one.
How SITS supports organisations with their NIS2 implementation
SITS helps companies assess their current maturity level, identify relevant areas for action and prioritise and implement the next steps. The approach is based on the company’s individual starting point, rather than a generic catalogue of measures. The process begins with a security assessment covering existing processes, organisational structures and technical security measures in relation to the NIS2 requirements. The assessment provides the basis for identifying gaps and distinguishing urgent measures from medium-term development areas.
The results are used to create a roadmap showing which measures can be implemented in the short term, which topics require medium-term planning and where existing structures can be reused or developed further. This helps companies balance effort and value while directing available resources towards the areas with the greatest need for action.
Implementation support can then be adapted to the company’s requirements. Depending on the starting point, this may include assistance with evaluating areas for action, prioritising measures, coordinating ongoing activities or tracking progress. Additional implementation packages are available across Governance & Compliance, Security & Awareness and Resilience & Operations. Companies can select the support that matches their current situation, maturity level and available capacity.
Would you like to know where your organisation currently stands regarding NIS2?
Schedule a free initial consultation and receive a thorough assessment of your current situation and possible next steps.
About the Author
Kirstin Butters is an ISMS consultant who supports public- and private-sector organisations as an external Information Security Officer. Her areas of expertise include ISO 27001, BSI IT-Grundschutz and TISAX. She also supports the implementation of NIS requirements within the municipal waste management operations of the Goslar district and helps organisations align regulatory requirements with security measures that work in practice.
No. NIS2 requires companies to implement suitable organisational and technical measures and be able to demonstrate that these measures are in place. A formal certification is not generally required. Established standards such as ISO 27001 can still provide a useful structure for implementation. They can help companies manage requirements systematically, assign responsibilities and document existing processes in a traceable way.
Yes, SITS can assess and document a company’s current implementation status through an attestation process. There is currently no official NIS2 certification, but an attestation can show that the company has addressed the relevant requirements systematically and had its implementation reviewed by independent specialists. The assessment reflects the company’s position at the time of the review. It can also identify areas where measures or evidence need further development.
Not necessarily. However, the company should clearly define who coordinates implementation, evaluates risks and acts as the central point of contact for NIS2-related activities. For SMEs, clear ownership is an important factor in maintaining progress. The responsible role needs sufficient authority and access to the relevant departments, information and decision makers.
Documentation and verifiable evidence form part of the NIS2 requirements. Their purpose is to create visibility around responsibilities, risks, decisions and implemented security measures. Companies can reduce the workload by building on existing policies, processes and records. Clear documentation can also improve internal coordination and make future reviews easier to manage.
Yes. In practice, implementation can be organised through prioritised packages of measures rather than one large project. A risk-based approach allows the company to address its most important areas first, account for dependencies and develop other requirements over time. Each stage should still have clear responsibilities, defined outcomes and a process for monitoring progress.
For most companies, the starting point is a structured review of the current position. This should cover existing processes, policies, responsibilities, technical controls and available documentation. Once the current position is clear, the company can identify gaps, assess their relevance and decide which measures should be prioritised. This creates a practical basis for the implementation roadmap.
