{"id":36905,"date":"2026-10-27T09:47:50","date_gmt":"2026-10-27T08:47:50","guid":{"rendered":"https:\/\/sits.com\/blog-nis2-fuer-den-mittelstand\/"},"modified":"2026-10-29T13:08:12","modified_gmt":"2026-10-29T12:08:12","slug":"blog-nis2-for-small-and-medium-sized-enterprise","status":"publish","type":"post","link":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/","title":{"rendered":"NIS2 Compliance for SMEs: A practical guide"},"content":{"rendered":"<section class=\"wpb-content-wrapper\"><p>[vc_row][vc_column]<h2  class=\"h2 smx-headline \">NIS2 for small and medium-sized enterprises: Why the topic is now on every agenda<\/h2>[vc_column_text]<span data-contrast=\"auto\">NIS2 significantly raises the requirements for cybersecurity and organisational resilience across many companies. While large organisations may already have established information security structures, many SMEs face a different situation: they need to meet new <\/span><a href=\"https:\/\/sits.com\/en\/blog\/cybersecurity-kpi-making-security-measurable\/\"><span data-contrast=\"none\">regulatory requirements<\/span><\/a><span data-contrast=\"auto\"> without dedicated compliance departments or large security teams.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">NIS2 can appear to be primarily about bureaucracy, documentation and additional obligations. However, the directive has a broader purpose. Companies must be able to demonstrate that they can identify and manage cyber risks, prepare for security incidents and restore their operational capability as quickly as possible if the worst happens.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The key question is therefore not whether NIS2 needs to be implemented, <\/span><b><span data-contrast=\"auto\">but how companies can do so realistically, effectively and sustainably<\/span><\/b><span data-contrast=\"auto\">.<\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">What makes the implementation of NIS2 so difficult for SMEs?<\/h2>[vc_column_text]<span data-contrast=\"auto\">Many companies start with the same questions:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<ul>\n<li><b><span data-contrast=\"auto\">Scope:<\/span><\/b><span data-contrast=\"auto\"> Does NIS2 apply to us, and which requirements are relevant?\u00a0<\/span><span data-ccp-props=\"{&quot;201341983&quot;:2,&quot;335559739&quot;:0,&quot;335559740&quot;:300}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Current position:<\/span><\/b><span data-contrast=\"auto\"> Where do we stand today, and where are the gaps?\u00a0<\/span><span data-ccp-props=\"{&quot;201341983&quot;:2,&quot;335559739&quot;:0,&quot;335559740&quot;:300}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Priorities:<\/span><\/b><span data-contrast=\"auto\"> Which requirements are most critical, and where should we begin?\u00a0<\/span><span data-ccp-props=\"{&quot;201341983&quot;:2,&quot;335559739&quot;:0,&quot;335559740&quot;:300}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Effort:<\/span><\/b><span data-contrast=\"auto\"> Which measures are required, and how much work will they involve?\u00a0<\/span><span data-ccp-props=\"{&quot;201341983&quot;:2,&quot;335559739&quot;:0,&quot;335559740&quot;:300}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Responsibility:<\/span><\/b><span data-contrast=\"auto\"> Who is responsible for implementation and oversight?<\/span><span data-ccp-props=\"{&quot;201341983&quot;:2,&quot;335559739&quot;:0,&quot;335559740&quot;:300}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">At the same time, the new requirements meet a familiar reality for many SMEs: <\/span><b><span data-contrast=\"auto\">tight budgets, overstretched IT teams and several projects running in parallel<\/span><\/b><span data-contrast=\"auto\">. This creates tension between regulatory obligations and operational feasibility. The requirements may be extensive, yet companies often lack clear priorities for deciding which measures need to be addressed first.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Many organisations already have individual security measures in place but do not know how these relate to NIS2. Policies, emergency plans, technical controls and defined processes may already exist. What is missing is a clear view of which requirements these measures already cover and where gaps remain.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The challenge is therefore rarely about starting from scratch. Existing measures need to be assessed, organised and placed within a coherent framework. This is what makes implementation demanding for those responsible. They need to understand regulatory requirements, initiate organisational change and evaluate technical risks at the same time.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">The result: <\/span><\/b><span data-contrast=\"auto\">uncertainty, delays and no clear point of entry. Without defined priorities, companies may invest considerable time and budget in measures that make only a limited contribution to reducing their most pressing risks.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">Why SMEs struggle with NIS2 compliance<\/h2>[vc_column_text]<span data-contrast=\"auto\">A common mistake is to treat NIS2 as an IT-only project. The directive covers far more than firewalls, endpoint protection and other technical security solutions. Risk management, defined responsibilities, <\/span><a href=\"https:\/\/sits.com\/en\/blog\/nis2-dora-supply-chain\/\"><span data-contrast=\"none\">supplier management<\/span><\/a><span data-contrast=\"auto\">, emergency preparedness, <\/span><a href=\"https:\/\/sits.com\/en\/security-advisory\/security-awareness\/\"><span data-contrast=\"none\">security awareness<\/span><\/a><span data-contrast=\"auto\"> and documentation all play an important role. Many companies begin with extensive analyses or long lists of measures. These can create transparency, but they often fail to answer the most important question:<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Which measures will deliver the greatest benefit for security and compliance right now?<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Without prioritisation, assessments can quickly produce dozens of open tasks. Those responsible become overwhelmed, decisions are postponed and important measures lose momentum.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">The most common mistakes in NIS2 implementation<\/h2>[vc_column_text]<\/p>\n<h3><b><span data-contrast=\"auto\">Mistake 1: Trying to tackle everything at once<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Companies attempting to implement all requirements in parallel can quickly need more resources than they have available. A staged approach makes it easier to prioritise risks and measures according to their relevance.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Mistake 2: Confusing compliance with security<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Complete documentation alone does not protect a company from cyberattacks. Equally, modern security solutions are not enough without traceable processes and clearly assigned responsibilities. Security and compliance need to be addressed together.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Mistake 3: Ignoring existing structures<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Many companies already have security measures, policies and established processes. Failing to take these into account creates duplicate work and makes implementation more expensive than necessary.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Mistake 4: Failing to define clear responsibilities<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><a href=\"https:\/\/sits.com\/en\/digital-challenges\/nis2-as-a-service\/\"><span data-contrast=\"none\">NIS2 affects several areas<\/span><\/a><span data-contrast=\"auto\"> across a company. Without clear ownership, decisions are delayed and measures lose momentum and accountability.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Mistake 5: Treating implementation as a one-off project<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Cybersecurity and resilience cannot be completed once and then marked as finished. Processes need to be reviewed, adapted and developed on an ongoing basis.<\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">Typical NIS2 challenges for SMEs and practical first steps<\/h2>[vc_column_text]<span class=\"TextRun SCXW129222186 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW129222186 BCX8\">The challenges associated with <\/span><\/span><a class=\"Hyperlink SCXW129222186 BCX8\" href=\"https:\/\/sits.com\/en\/blog\/nis2aas-support-for-nis2-implementation\/\" rel=\"noreferrer noopener\"><span class=\"TextRun Underlined SCXW129222186 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW129222186 BCX8\" data-ccp-charstyle=\"Hyperlink\">NIS2 implementation<\/span><\/span><\/a><span class=\"TextRun SCXW129222186 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW129222186 BCX8\"> rarely arise from one requirement alone. Projects tend to lose momentum when regulatory obligations, limited <\/span><span class=\"NormalTextRun ContextualSpellingAndGrammarErrorV2Themed SCXW129222186 BCX8\">resources<\/span><span class=\"NormalTextRun SCXW129222186 BCX8\"> and a lack of direction come together. Looking at common starting points helps companies <\/span><span class=\"NormalTextRun SCXW129222186 BCX8\">identify<\/span><span class=\"NormalTextRun SCXW129222186 BCX8\"> where to <\/span><span class=\"NormalTextRun ContextualSpellingAndGrammarErrorV2Themed SCXW129222186 BCX8\">begin<\/span><span class=\"NormalTextRun SCXW129222186 BCX8\"> and which steps matter most at the outset<\/span><span class=\"NormalTextRun SCXW129222186 BCX8\">.<\/span><\/span><span class=\"EOP Selected SCXW129222186 BCX8\" data-ccp-props=\"{}\">\u00a0<\/span>[\/vc_column_text][vc_raw_html]JTNDc3R5bGUlM0UlMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMCU3QiUwQSUyMCUyMCUyMCUyMGJvcmRlci1jb2xsYXBzZSUzQSUyMGNvbGxhcHNlJTNCJTBBJTIwJTIwJTIwJTIwd2lkdGglM0ElMjAxMDAlMjUlM0IlMEElMjAlMjAlMjAlMjBmb250LWZhbWlseSUzQSUyMHNhbnMtc2VyaWYlM0IlMEElMjAlMjAlN0QlMEElMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMHRoJTJDJTBBJTIwJTIwdGFibGUudGhyZWF0LWluZm8tdGFibGUlMjB0ZCUyMCU3QiUwQSUyMCUyMCUyMCUyMGJvcmRlciUzQSUyMDJweCUyMHNvbGlkJTIwJTIzZmZmZmZmMzMlM0IlMEElMjAlMjAlMjAlMjBwYWRkaW5nJTNBJTIwMjBweCUzQiUwQSUyMCUyMCUyMCUyMGNvbG9yJTNBJTIwJTIzZmZmZmZmJTNCJTBBJTIwJTIwJTIwJTIwdmVydGljYWwtYWxpZ24lM0ElMjB0b3AlM0IlMEElMjAlMjAlN0QlMEElMEElMjAlMjB0YWJsZS50aHJlYXQtaW5mby10YWJsZSUyMHRoZWFkJTIwdGglMjAlN0IlMEElMjAlMjAlMjAlMjBiYWNrZ3JvdW5kLWNvbG9yJTNBJTIwJTIzZGVkYzAwJTNCJTBBJTIwJTIwJTIwJTIwY29sb3IlM0ElMjAlMjMwMDAwMDAlM0IlMEElMjAlMjAlMjAlMjBmb250LXdlaWdodCUzQSUyMGJvbGQlM0IlMEElMjAlMjAlMjAlMjB0ZXh0LWFsaWduJTNBJTIwbGVmdCUzQiUwQSUyMCUyMCU3RCUwQSUwQSUyMCUyMHRhYmxlLnRocmVhdC1pbmZvLXRhYmxlJTIwdGJvZHklMjB0ZCUyMCU3QiUwQSUyMCUyMCUyMCUyMGJhY2tncm91bmQtY29sb3IlM0ElMjAlMjMwYzJmNDglM0IlMEElMjAlMjAlN0QlMEElM0MlMkZzdHlsZSUzRSUwQSUwQSUzQ3RhYmxlJTIwY2xhc3MlM0QlMjJ0aHJlYXQtaW5mby10YWJsZSUyMiUzRSUwQSUyMCUyMCUzQ3RoZWFkJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0aCUzRUNoYWxsZW5nZSUzQyUyRnRoJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGglM0VVbmRlcmx5aW5nJTIwY2F1c2UlM0MlMkZ0aCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RoJTNFRmlyc3QlMjBzdGVwJTNDJTJGdGglM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUzQyUyRnRoZWFkJTNFJTBBJTIwJTIwJTNDdGJvZHklM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFVW5jZXJ0YWludHklMjBhYm91dCUyMHdoZXRoZXIlMjBOSVMyJTIwYXBwbGllcyUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VUaGUlMjBsZWdpc2xhdGlvbiUyMGhhcyUyMG5vdCUyMHlldCUyMGJlZW4lMjBhc3Nlc3NlZCUyMGluJTIwcmVsYXRpb24lMjB0byUyMHRoZSUyMGNvbXBhbnklM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFQ29uZHVjdCUyMGElMjBzY29wZSUyMGFzc2Vzc21lbnQlMjBhbmQlMjByZXZpZXclMjB0aGUlMjBjdXJyZW50JTIwcG9zaXRpb24lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUzQyUyRnRyJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVRvbyUyMG1hbnklMjBvcGVuJTIwbWVhc3VyZXMlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFR2FwJTIwYW5hbHlzZXMlMjB3aXRob3V0JTIwcHJpb3JpdGlzYXRpb24lM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFRXZhbHVhdGUlMjByaXNrcyUyMGFuZCUyMG1lYXN1cmVzJTIwYWNjb3JkaW5nJTIwdG8lMjB0aGVpciUyMGJ1c2luZXNzJTIwaW1wYWN0JTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0MlMkZ0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RyJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VMaW1pdGVkJTIwcmVzb3VyY2VzJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVNtYWxsJTIwSVQlMjBhbmQlMjBzZWN1cml0eSUyMHRlYW1zJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRURpdmlkZSUyMG1lYXN1cmVzJTIwaW50byUyMG1hbmFnZWFibGUlMjBpbXBsZW1lbnRhdGlvbiUyMHBhY2thZ2VzJTIwYW5kJTIwYXNzaWduJTIwY2xlYXIlMjBvd25lcnNoaXAlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUyMCUyMCUzQyUyRnRyJTNFJTBBJTIwJTIwJTIwJTIwJTNDdHIlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVVuY2xlYXIlMjByZXNwb25zaWJpbGl0aWVzJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRVNldmVyYWwlMjBkZXBhcnRtZW50cyUyMGFyZSUyMGFmZmVjdGVkJTJDJTIwd2l0aCUyMG5vJTIwY2VudHJhbCUyMGNvb3JkaW5hdGlvbiUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTNDdGQlM0VEZWZpbmUlMjBjbGVhciUyMHJvbGVzJTIwYW5kJTIwcmVzcG9uc2liaWxpdGllcyUyQyUyMHRoZW4lMjBtYW5hZ2UlMjBpbXBsZW1lbnRhdGlvbiUyMGFjY29yZGluZyUyMHRvJTIwcHJpb3JpdGllcyUyMGFuZCUyMG93bmVyc2hpcCUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFRG9jdW1lbnRhdGlvbiUyMHdvcmtsb2FkJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRU5vJTIwZXN0YWJsaXNoZWQlMjBwcm9jZXNzJTIwZm9yJTIwY29sbGVjdGluZyUyMGV2aWRlbmNlJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRU1ha2UlMjBzeXN0ZW1hdGljJTIwdXNlJTIwb2YlMjBleGlzdGluZyUyMGRvY3VtZW50YXRpb24lMjBhbmQlMjBldmlkZW5jZSUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUzQ3RkJTNFTWFpbnRhaW5pbmclMjBwcm9ncmVzcyUyMG92ZXIlMjB0aW1lJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRUZvY3VzJTIwb24lMjBpc29sYXRlZCUyMHByb2plY3RzJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlMjAlMjAlM0N0ZCUzRU1vdmUlMjBtZWFzdXJlcyUyMGludG8lMjByZWd1bGFyJTIwb3BlcmF0aW9ucyUyMHVzaW5nJTIwdGhlJTIwUGxhbi1Eby1DaGVjay1BY3QlMjBjeWNsZSUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDJTJGdHIlM0UlMEElMjAlMjAlM0MlMkZ0Ym9keSUzRSUwQSUzQyUyRnRhYmxlJTNF[\/vc_raw_html][vc_column_text]<span class=\"EOP Selected SCXW55919673 BCX8\" data-ccp-props=\"{}\"><span class=\"TextRun SCXW79919876 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW79919876 BCX8\">The table shows that many challenges are not created or resolved by adding more tools.<\/span><span class=\"NormalTextRun SCXW79919876 BCX8\"> At the beginning, a clear overview, defined <\/span><span class=\"NormalTextRun SCXW79919876 BCX8\">priorities<\/span><span class=\"NormalTextRun SCXW79919876 BCX8\"> and assigned responsibilities often matter more than <\/span><span class=\"NormalTextRun SCXW79919876 BCX8\">new technology<\/span><span class=\"NormalTextRun SCXW79919876 BCX8\">.<\/span><\/span><span class=\"EOP Selected SCXW79919876 BCX8\" data-ccp-props=\"{}\">\u00a0<\/span> <\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">Where investments in NIS2 pay off first<\/h2>[vc_column_text]<span data-contrast=\"auto\">Not every measure has the same impact on a company\u2019s resilience. Trying to address every requirement at once can make it difficult to maintain an overview and may tie up resources in areas that currently offer limited value.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">A better starting point is to strengthen the areas that provide a foundation for later measures. Once responsibilities are clear, risks are visible and processes are documented, further requirements become easier to manage. The following areas therefore deserve particular attention:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Governance and Responsibilities<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Information security needs clear ownership. The company should define who makes decisions, assesses risks and steers individual measures. Without fixed responsibilities, tasks remain unresolved, decisions take longer and important topics move back and forth between departments.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Emergency planning and compliance with reporting deadlines<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">A security incident cannot always be prevented. What matters is how quickly a company can respond, comply with the applicable reporting obligations and <\/span><span data-contrast=\"none\">maintain business operations<\/span><span data-contrast=\"auto\">. Clear procedures, named contacts and tested emergency plans provide direction when fast decisions are required. Reporting processes should also specify who assesses an incident, who initiates the relevant notifications and which information needs to be available.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Risk Management<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Companies need to understand which systems, processes and information are especially critical to their operations. This knowledge allows them to prioritise protective measures based on actual exposure. A clear view of risk also supports better decisions about budgets and resources. Investment can then be directed towards the areas where disruption, data loss or compromised systems would have the greatest business impact.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Awareness and Security Culture<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Technical controls lose effectiveness when employees cannot recognise risks or are unfamiliar with security procedures. <\/span><a href=\"https:\/\/sits.com\/en\/security-advisory\/security-awareness\/\"><span data-contrast=\"none\">A shared understanding of information security<\/span><\/a><span data-contrast=\"auto\"> helps reduce errors, identify incidents earlier and embed security requirements in day-to-day work. Awareness measures should reflect the company\u2019s actual risks and the responsibilities of different roles. Employees in finance, IT, management or operations may encounter different attack scenarios and therefore need relevant guidance.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><strong>Documentation and verifiable evidence\u00a0<\/strong><\/h3>\n<p><span data-contrast=\"auto\">Measures need to be documented in a traceable way. Documentation creates visibility around decisions, responsibilities and completed actions. It also supports internal coordination, audits and the provision of evidence to customers, partners or authorities. The aim is not to produce documents for their own sake. Records need to show what was decided, why the decision was made, who is responsible and how the effectiveness of a measure is reviewed.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">Practical examples from typical SME scenarios<\/h2>[vc_column_text]<\/p>\n<h3><b><span data-contrast=\"auto\">Scenario 1: The company with security structures that have grown over time<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Over several years, new security measures have been introduced, responsibilities have been distributed and individual requirements have been addressed through separate projects. Today, no one has a complete overview of which NIS2 requirements are already covered and where action is still required.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The first step is to create transparency around existing processes, policies and security measures. Once these have been mapped against the relevant requirements, the company can distinguish genuine gaps from areas that only need better documentation or coordination.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Scenario 2: The small IT team<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">In many SMEs, the same team manages IT operations, user support, ongoing projects and IT security. There is little capacity within day-to-day operations for an extensive compliance project such as NIS2 implementation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The company needs to address its most significant risks first and allocate available resources where they will have the greatest impact. Organisational and technical measures also need to be coordinated according to defined priorities, with responsibilities assigned in a way that avoids conflicts of interest.\u00a0<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3><b><span data-contrast=\"auto\">Scenario 3: Multiple locations with different processes<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Companies with several locations may have different security processes, responsibilities and documentation standards. One location may assess and document risks on a regular basis, while another uses its own procedures or assigns responsibility to different roles.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The company first needs a shared framework for roles, processes and minimum requirements. This creates the basis for managing security measures and evidence consistently across all locations while allowing local teams to retain processes that meet the agreed standard.<\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">How SMEs can assess their NIS2 readiness<\/h2>[vc_column_text]<span data-contrast=\"auto\">Organisations may already have more of the required foundations in place than they realise. Many companies have invested in information security, <\/span><a href=\"https:\/\/sits.com\/en\/security-advisory\/business-continuity-management\/\"><span data-contrast=\"none\">emergency preparedness<\/span><\/a><span data-contrast=\"auto\"> and cyber defence over recent years. Policies, processes, technical controls or defined responsibilities may already cover important elements of NIS2.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Indicators of a solid maturity level include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<ul>\n<li><span data-contrast=\"auto\">Responsibilities are clearly assigned<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Risks are reviewed regularly<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Security measures are documented<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Incidents are handled through defined processes<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Employees receive guidance on security risks<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Improvements are managed continuously<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">If several of these elements are already in place, the company may have a strong foundation for the remaining requirements. The next task is not to replace everything that exists. <\/span><b><span data-contrast=\"auto\">Existing measures should be developed further<\/span><\/b><span data-contrast=\"auto\">, <\/span><b><span data-contrast=\"auto\">gaps need to be closed<\/span><\/b><span data-contrast=\"auto\"> and <\/span><b><span data-contrast=\"auto\">individual activities have to be brought together<\/span><\/b><span data-contrast=\"auto\"> within a <\/span><b><span data-contrast=\"auto\">traceable overall strategy<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">Choosing external support: What companies should consider<\/h2>[vc_column_text]<span data-contrast=\"auto\">Implementing NIS2 may require additional expertise or capacity. The key question is which type of support fits the company\u2019s actual situation. Not every organisation needs a large-scale project, while a one-off consultation may not provide enough support for implementation and ongoing operation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">External support should fit the company\u2019s existing structures, security maturity and available resources. The aim should be to relieve pressure on internal teams while <\/span><b><span data-contrast=\"auto\">strengthening the organisation\u2019s ability to manage the requirements over the long term<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Important criteria include:<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<ul>\n<li><span data-contrast=\"auto\">Consideration of existing structures<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">An understanding of the realities facing SMEs<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Clear and traceable prioritisation<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Realistic implementation recommendations<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Long-term operational suitability<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Expertise in both security and compliance<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">The focus should be on implementing the right measures at the right time. Effective support makes dependencies visible, translates recommendations into manageable tasks and helps internal teams retain control of decisions and implementation.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">Conclusion<\/h2>[vc_column_text]<span data-contrast=\"auto\">NIS2 presents many SMEs with the same challenge: extensive requirements need to be met with limited resources. Implementing isolated measures or focusing exclusively on formal compliance will not provide the necessary level of security and resilience.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Companies should approach NIS2 as a <\/span><b><span data-contrast=\"auto\">strategic development of their security and resilience structures<\/span><\/b><span data-contrast=\"auto\">. A clear view of the current position comes first, followed by risk-based priorities and improvements delivered in manageable stages.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Practical implementation and compliance are not competing goals. Companies that build on existing structures, prioritise measures according to their impact and coordinate organisational and technical requirements can make sustainable progress without overwhelming their teams.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The exact route to NIS2 compliance will vary from one organisation to another. One principle applies across these different starting points: <\/span><b><span data-contrast=\"auto\">the greatest progress comes from a clear plan, realistic priorities and continuous improvement, not from trying to achieve perfection from day one.<\/span><\/b><span data-ccp-props=\"{}\">\u00a0<\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]<h2  class=\"h2 smx-headline \">How SITS supports organisations with their NIS2 implementation<\/h2>[vc_column_text]<a href=\"https:\/\/sits.com\/en\/about-us\/\"><span data-contrast=\"none\">SITS<\/span><\/a><span data-contrast=\"auto\"> helps companies assess their current maturity level, identify relevant areas for action and prioritise and implement the next steps. The approach is based on the <\/span><b><span data-contrast=\"auto\">company\u2019s individual starting point<\/span><\/b><span data-contrast=\"auto\">, rather than a generic catalogue of measures. The process begins with a <\/span><a href=\"https:\/\/sits.com\/en\/security-advisory\/security-assessments\/\"><span data-contrast=\"none\">security assessment<\/span><\/a><span data-contrast=\"auto\"> covering existing processes, organisational structures and technical security measures in relation to the NIS2 requirements. The assessment provides the basis for identifying gaps and distinguishing urgent measures from medium-term development areas.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The results are used to create a roadmap showing which measures can be implemented in the short term, which topics require medium-term planning and where existing structures can be reused or developed further. This helps companies balance <\/span><b><span data-contrast=\"auto\">effort and value<\/span><\/b><span data-contrast=\"auto\"> while directing available resources towards the areas with the greatest need for action.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Implementation support can then be adapted to the company\u2019s requirements. Depending on the starting point, this may include assistance with evaluating areas for action, prioritising measures, coordinating ongoing activities or tracking progress. Additional implementation packages are available across Governance &amp; Compliance, <\/span><a href=\"https:\/\/sits.com\/en\/security-advisory\/security-awareness\/\"><span data-contrast=\"none\">Security &amp; Awareness<\/span><\/a><span data-contrast=\"auto\"> and Resilience &amp; Operations. Companies can select the support that matches their current situation, maturity level and available capacity.<\/span>[\/vc_column_text]<div class=\"smx_global_spacer size-s\"><\/div>\n<h3  class=\"h3 smx-headline \">Would you like to know where your organisation currently stands regarding NIS2?<\/h3>[vc_column_text]<span class=\"TextRun SCXW170391131 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW170391131 BCX8\">Schedule a free <\/span><span class=\"NormalTextRun SCXW170391131 BCX8\">initial<\/span><span class=\"NormalTextRun SCXW170391131 BCX8\"> consultation and receive a thorough assessment of your current situation and possible next steps<\/span><span class=\"NormalTextRun SCXW170391131 BCX8\">.<\/span><\/span><span class=\"EOP Selected SCXW170391131 BCX8\" data-ccp-props=\"{}\">\u00a0<\/span>[\/vc_column_text]<div class=\"btn-wrapper \">\n    <div class=\"btn btn--inverted btn--green\">\n        <a href=\"https:\/\/sits.com\/en\/request-consultation\/\" class=\"btn-text\" title=\"CONTACT US NOW\">\n            CONTACT US NOW        <\/a>\n        <div><\/div>\n    <\/div> \n<\/div><div class=\"smx_global_spacer size-s\"><\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column][vc_column_text css=\".vc_custom_1793266662314{border-radius: 3px !important;}\"]<\/p>\n<h3><span class=\"TextRun SCXW250949646 BCX8\" lang=\"DE-DE\" xml:lang=\"DE-DE\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW250949646 BCX8\"><strong> <span class=\"TextRun SCXW80948107 BCX8\" lang=\"DE-DE\" xml:lang=\"DE-DE\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW80948107 BCX8\">About the Author<\/span><\/span><\/strong><br \/>\n<\/span><\/span><\/h3>\n<p><span class=\"TextRun SCXW250949646 BCX8\" lang=\"DE-DE\" xml:lang=\"DE-DE\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW250949646 BCX8\"><br \/>\n<span class=\"TextRun SCXW248816240 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW248816240 BCX8\">Kirstin Butters<\/span><\/span><span class=\"TextRun SCXW248816240 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"> <span class=\"NormalTextRun SCXW248816240 BCX8\">is an ISMS consultant who supports public- and <\/span><span class=\"NormalTextRun ContextualSpellingAndGrammarErrorV2Themed SCXW248816240 BCX8\">private-sector<\/span> <span class=\"NormalTextRun SpellingErrorV2Themed SCXW248816240 BCX8\">organisations<\/span><span class=\"NormalTextRun SCXW248816240 BCX8\"> as an external Information Security Officer. Her areas of expertise include <\/span><\/span><a class=\"Hyperlink SCXW248816240 BCX8\" href=\"https:\/\/sits.com\/en\/blog\/iso-27001-certification-without-delay\/\" rel=\"noreferrer noopener\"><span class=\"TextRun Underlined SCXW248816240 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW248816240 BCX8\" data-ccp-charstyle=\"Hyperlink\">ISO 27001<\/span><\/span><\/a><span class=\"TextRun SCXW248816240 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW248816240 BCX8\">, <\/span><\/span><a class=\"Hyperlink SCXW248816240 BCX8\" href=\"https:\/\/sits.com\/en\/blog\/grundschutz-plus-plus-bsi-it-baseline-protection\/\" rel=\"noreferrer noopener\"><span class=\"TextRun Underlined SCXW248816240 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW248816240 BCX8\" data-ccp-charstyle=\"Hyperlink\">BSI IT-Grundschutz<\/span><\/span><\/a><span class=\"TextRun SCXW248816240 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW248816240 BCX8\"> and TISAX<\/span><span class=\"NormalTextRun SCXW248816240 BCX8\">. <\/span><span class=\"NormalTextRun SCXW248816240 BCX8\">She also supports the implementation of NIS requirements within the municipal waste management operations of the <\/span><\/span><a class=\"Hyperlink SCXW248816240 BCX8\" href=\"https:\/\/sits.com\/en\/customer-stories\/nis-2-implementation-county-goslar\/\" rel=\"noreferrer noopener\"><span class=\"TextRun Underlined SCXW248816240 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW248816240 BCX8\" data-ccp-charstyle=\"Hyperlink\">Goslar district<\/span><\/span><\/a><span class=\"TextRun SCXW248816240 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW248816240 BCX8\"> and helps <\/span><span class=\"NormalTextRun SpellingErrorV2Themed SCXW248816240 BCX8\">organisations<\/span><span class=\"NormalTextRun SCXW248816240 BCX8\"> align regulatory requirements with security measures that work in practice<\/span><span class=\"NormalTextRun SCXW248816240 BCX8\">.<\/span><\/span><br \/>\n<\/span><\/span>[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column]<div class=\"smx_global_spacer size-s\"><\/div>\n<div class=\"accordion_section\">\n    <div class=\"accordion_head\">\n        <div class=\"accordion_icon\">\n                    <\/div>\n        <div class=\"h2 smx-headline\">\n        FAQs    <\/div>\n    <div class=\"subheadline\">\n            <\/div>\n<\/div>\n<div class=\"accordion_wrapper\">\n                    <button class=\"accordion\">Do we need a certification for NIS2?<\/button>\n                <div class=\"panel\">\n                    <p>No. NIS2 requires companies to implement suitable organisational and technical measures and be able to demonstrate that these measures are in place. A formal certification is not generally required. Established standards such as ISO 27001 can still provide a useful structure for implementation. They can help companies manage requirements systematically, assign responsibilities and document existing processes in a traceable way.<\/p>\n                <\/div>\n                            <button class=\"accordion\">Can SITS confirm that our company is NIS2-compliant? <\/button>\n                <div class=\"panel\">\n                    <p>Yes, SITS can assess and document a company\u2019s current implementation status through an attestation process. There is currently no official NIS2 certification, but an attestation can show that the company has addressed the relevant requirements systematically and had its implementation reviewed by independent specialists. The assessment reflects the company\u2019s position at the time of the review. It can also identify areas where measures or evidence need further development.<\/p>\n                <\/div>\n                            <button class=\"accordion\">Do we need to appoint an information security officer? <\/button>\n                <div class=\"panel\">\n                    <p>Not necessarily. However, the company should clearly define who coordinates implementation, evaluates risks and acts as the central point of contact for NIS2-related activities. For SMEs, clear ownership is an important factor in maintaining progress. The responsible role needs sufficient authority and access to the relevant departments, information and decision makers.<\/p>\n                <\/div>\n                            <button class=\"accordion\">Does NIS2 automatically mean more bureaucracy?<\/button>\n                <div class=\"panel\">\n                    <p>Documentation and verifiable evidence form part of the NIS2 requirements. Their purpose is to create visibility around responsibilities, risks, decisions and implemented security measures. Companies can reduce the workload by building on existing policies, processes and records. Clear documentation can also improve internal coordination and make future reviews easier to manage.<\/p>\n                <\/div>\n                            <button class=\"accordion\">Can a company implement NIS2 in stages?<\/button>\n                <div class=\"panel\">\n                    <p>Yes. In practice, implementation can be organised through prioritised packages of measures rather than one large project. A risk-based approach allows the company to address its most important areas first, account for dependencies and develop other requirements over time. Each stage should still have clear responsibilities, defined outcomes and a process for monitoring progress. <\/p>\n                <\/div>\n                            <button class=\"accordion\">What is the best first step?<\/button>\n                <div class=\"panel\">\n                    <p>For most companies, the starting point is a structured review of the current position. This should cover existing processes, policies, responsibilities, technical controls and available documentation. Once the current position is clear, the company can identify gaps, assess their relevance and decide which measures should be prioritised. This creates a practical basis for the implementation roadmap.<\/p>\n                <\/div>\n            <\/div>\n<div class=\"accordion_footer\">\n    <\/div>\n<\/div>[\/vc_column][\/vc_row]<\/p>\n<\/section>","protected":false},"excerpt":{"rendered":"<p>[vc_row][vc_column][vc_column_text]NIS2 significantly raises the requirements for cybersecurity and organisational resilience across many companies. While large organisations may already have established information security structures, many SMEs face a different situation: they need to meet new regulatory requirements without dedicated compliance departments or large security teams.\u00a0 NIS2 can appear to be primarily about bureaucracy, documentation and additional [&hellip;]<\/p>\n","protected":false},"author":32,"featured_media":37227,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":"","_members_access_role":[],"_members_access_error":""},"categories":[229],"tags":[],"class_list":["post-36905","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nis2-en"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>NIS2 Compliance for SMEs: Assess gaps &amp; implement requirements | SITS<\/title>\n<meta name=\"description\" content=\"Learn how SMEs can assess NIS2 readiness, identify compliance gaps, prioritise cyber risks and build a practical roadmap for implementing NIS2 requirements.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NIS2 Compliance for SMEs: Assess gaps &amp; implement requirements | SITS\" \/>\n<meta property=\"og:description\" content=\"Learn how SMEs can assess NIS2 readiness, identify compliance gaps, prioritise cyber risks and build a practical roadmap for implementing NIS2 requirements.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/\" \/>\n<meta property=\"og:site_name\" content=\"SITS\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-27T08:47:50+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-29T12:08:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Blog.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"1787\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Marwa Felfel\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Marwa Felfel\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/\"},\"author\":{\"name\":\"Marwa Felfel\",\"@id\":\"https:\/\/sits.com\/en\/#\/schema\/person\/34837e785891a971e6828c8adfa503ea\"},\"headline\":\"NIS2 Compliance for SMEs: A practical guide\",\"datePublished\":\"2026-10-27T08:47:50+00:00\",\"dateModified\":\"2026-10-29T12:08:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/\"},\"wordCount\":3280,\"publisher\":{\"@id\":\"https:\/\/sits.com\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Blog.jpg\",\"articleSection\":[\"NIS2\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/\",\"url\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/\",\"name\":\"NIS2 Compliance for SMEs: Assess gaps & implement requirements | SITS\",\"isPartOf\":{\"@id\":\"https:\/\/sits.com\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Blog.jpg\",\"datePublished\":\"2026-10-27T08:47:50+00:00\",\"dateModified\":\"2026-10-29T12:08:12+00:00\",\"description\":\"Learn how SMEs can assess NIS2 readiness, identify compliance gaps, prioritise cyber risks and build a practical roadmap for implementing NIS2 requirements.\",\"breadcrumb\":{\"@id\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#primaryimage\",\"url\":\"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Blog.jpg\",\"contentUrl\":\"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Blog.jpg\",\"width\":1000,\"height\":1787},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\/\/sits.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NIS2 Compliance for SMEs: A practical guide\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/sits.com\/en\/#website\",\"url\":\"https:\/\/sits.com\/en\/\",\"name\":\"SITS\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/sits.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/sits.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/sits.com\/en\/#organization\",\"name\":\"SITS\",\"url\":\"https:\/\/sits.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/sits.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/sits.com\/wp-content\/uploads\/2024\/04\/sits-logo-new.svg\",\"contentUrl\":\"https:\/\/sits.com\/wp-content\/uploads\/2024\/04\/sits-logo-new.svg\",\"width\":557,\"height\":322,\"caption\":\"SITS\"},\"image\":{\"@id\":\"https:\/\/sits.com\/en\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/sits.com\/en\/#\/schema\/person\/34837e785891a971e6828c8adfa503ea\",\"name\":\"Marwa Felfel\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/sits.com\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/6cf30e752dbc94e12a77dd0991f67551982f595bbc0bc833cd87d728b62193b5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/6cf30e752dbc94e12a77dd0991f67551982f595bbc0bc833cd87d728b62193b5?s=96&d=mm&r=g\",\"caption\":\"Marwa Felfel\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"NIS2 Compliance for SMEs: Assess gaps & implement requirements | SITS","description":"Learn how SMEs can assess NIS2 readiness, identify compliance gaps, prioritise cyber risks and build a practical roadmap for implementing NIS2 requirements.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/","og_locale":"en_GB","og_type":"article","og_title":"NIS2 Compliance for SMEs: Assess gaps & implement requirements | SITS","og_description":"Learn how SMEs can assess NIS2 readiness, identify compliance gaps, prioritise cyber risks and build a practical roadmap for implementing NIS2 requirements.","og_url":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/","og_site_name":"SITS","article_published_time":"2026-10-27T08:47:50+00:00","article_modified_time":"2026-10-29T12:08:12+00:00","og_image":[{"width":1000,"height":1787,"url":"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Blog.jpg","type":"image\/jpeg"}],"author":"Marwa Felfel","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Marwa Felfel","Estimated reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#article","isPartOf":{"@id":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/"},"author":{"name":"Marwa Felfel","@id":"https:\/\/sits.com\/en\/#\/schema\/person\/34837e785891a971e6828c8adfa503ea"},"headline":"NIS2 Compliance for SMEs: A practical guide","datePublished":"2026-10-27T08:47:50+00:00","dateModified":"2026-10-29T12:08:12+00:00","mainEntityOfPage":{"@id":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/"},"wordCount":3280,"publisher":{"@id":"https:\/\/sits.com\/en\/#organization"},"image":{"@id":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#primaryimage"},"thumbnailUrl":"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Blog.jpg","articleSection":["NIS2"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/","url":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/","name":"NIS2 Compliance for SMEs: Assess gaps & implement requirements | SITS","isPartOf":{"@id":"https:\/\/sits.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#primaryimage"},"image":{"@id":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#primaryimage"},"thumbnailUrl":"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Blog.jpg","datePublished":"2026-10-27T08:47:50+00:00","dateModified":"2026-10-29T12:08:12+00:00","description":"Learn how SMEs can assess NIS2 readiness, identify compliance gaps, prioritise cyber risks and build a practical roadmap for implementing NIS2 requirements.","breadcrumb":{"@id":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#primaryimage","url":"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Blog.jpg","contentUrl":"https:\/\/sits.com\/wp-content\/uploads\/2026\/10\/Beitragsbild-Blog.jpg","width":1000,"height":1787},{"@type":"BreadcrumbList","@id":"https:\/\/sits.com\/en\/blog\/nis2-for-smes-a-guide\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/sits.com\/en\/"},{"@type":"ListItem","position":2,"name":"NIS2 Compliance for SMEs: A practical guide"}]},{"@type":"WebSite","@id":"https:\/\/sits.com\/en\/#website","url":"https:\/\/sits.com\/en\/","name":"SITS","description":"","publisher":{"@id":"https:\/\/sits.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sits.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/sits.com\/en\/#organization","name":"SITS","url":"https:\/\/sits.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/sits.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/sits.com\/wp-content\/uploads\/2024\/04\/sits-logo-new.svg","contentUrl":"https:\/\/sits.com\/wp-content\/uploads\/2024\/04\/sits-logo-new.svg","width":557,"height":322,"caption":"SITS"},"image":{"@id":"https:\/\/sits.com\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/sits.com\/en\/#\/schema\/person\/34837e785891a971e6828c8adfa503ea","name":"Marwa Felfel","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/sits.com\/en\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6cf30e752dbc94e12a77dd0991f67551982f595bbc0bc833cd87d728b62193b5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6cf30e752dbc94e12a77dd0991f67551982f595bbc0bc833cd87d728b62193b5?s=96&d=mm&r=g","caption":"Marwa Felfel"}}]}},"_links":{"self":[{"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/posts\/36905","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/users\/32"}],"replies":[{"embeddable":true,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/comments?post=36905"}],"version-history":[{"count":15,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/posts\/36905\/revisions"}],"predecessor-version":[{"id":37226,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/posts\/36905\/revisions\/37226"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/media\/37227"}],"wp:attachment":[{"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/media?parent=36905"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/categories?post=36905"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sits.com\/en\/wp-json\/wp\/v2\/tags?post=36905"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}