NIS2: what it actually requires of a mid-sized company

NIS2 widened the net considerably. A great many mid-sized companies that were outside the original directive are now inside this one, often without realising it — and the obligations are more specific than the headlines suggest.

Are you in scope?

Scope follows sector and size rather than turnover alone. Manufacturing, food, waste, postal services, digital providers and managed service providers are all named. If you are above roughly fifty staff in one of those sectors, assume you are in scope until somebody tells you otherwise in writing.

What it asks for

Risk management that exists on paper. Not a feeling that things are broadly fine. A documented view of what could go wrong, what you have done about it, and who decided that was enough.

Incident reporting inside tight windows. An early warning within twenty-four hours of becoming aware, a fuller notification within seventy-two. Those are short. Working out who calls whom, during an incident, is how companies miss them.

Supply chain accountability. You are expected to know which suppliers can reach your systems and what their security posture is. Evidence, not assurances.

Management responsibility. This is the part that changed. Senior management can be held personally accountable, which makes security a board conversation rather than an IT one.

What to do first

Write the incident plan. Not the policy — the plan. Who is called at two in the morning, who can authorise taking a system offline, what is said to customers, which regulator is notified and by whom. It is a page or two, and it is the difference between a bad week and a bad quarter.

Then inventory your suppliers by access rather than by spend. The largest invoice is rarely the largest risk.

A note on timing

Most of this is good practice that predates the directive. If it feels like a lot, that is usually a sign it was overdue rather than that NIS2 is unreasonable.