NIS2 for SMEs: obligations, penalties and compliance checklist

The NIS2 directive has applied across the European Union since October 2024. Thousands of French SMEs that were outside the original NIS1 directive now have cybersecurity obligations. The penalties are steep: up to EUR 10 million or 2% of global annual turnover for the most serious breaches.

Yet according to a CESIN study published in 2025, fewer than 30% of affected French SMEs have started working on NIS2 compliance. The text is dense and technical, and few resources are written for small and mid-sized businesses. Most available guides target large corporations with dedicated cybersecurity teams.

This guide is written for SME executives and IT managers. It covers:

• Who is actually affected, with a simple decision tree to check whether your company is in scope
• The 10 obligations from Article 21, explained in plain language
• The penalties and the new personal liability for executives
• The compliance timeline and its deadlines
• A 20-point checklist organized by priority, to structure your action plan

It draws on the official text of Directive (EU) 2022/2555 of 14 December 2022, recommendations from ANSSI (France’s national cybersecurity agency, cyber.gouv.fr) and ENISA publications.

NIS2 in brief

• The NIS2 directive, in force across the European Union since October 2024, expands the number of entities in scope from roughly 15,000 to approximately 160,000 across the EU. According to ANSSI, between 10,000 and 15,000 French companies are directly affected.
• In the listed sectors, NIS2 applies from medium size upward: 50 employees or more, or both annual turnover and annual balance sheet above EUR 10 million.
• NIS2 penalties reach up to EUR 10 million or 2% of global annual turnover for the most serious breaches, and Article 20 makes executives personally liable for approving and supervising cybersecurity measures.
• NIS2 sets strict incident notification deadlines: an initial alert within 24 hours of becoming aware of a significant incident, a full notification within 72 hours, and a final report within one month.
• According to a CESIN study published in 2025, fewer than 30% of affected French SMEs have started their NIS2 compliance work.

What is the NIS2 directive?

The NIS2 directive, officially Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022, is the European regulatory framework for the cybersecurity of network and information systems. It replaces the first NIS directive adopted in 2016, with a much wider scope and stricter requirements.

Why NIS2 replaces NIS1

The 2016 NIS1 directive laid the first foundations for a coordinated approach to cybersecurity in Europe. It had significant limitations:

• The scope was narrow: only “operators of essential services” (OES) and digital service providers were covered, roughly 15,000 entities across the entire EU.
• Transposition was inconsistent: each member state interpreted the directive differently.
• Penalties were not harmonized and often too low to deter anyone.
• Incident notification mechanisms were slow and fragmented.

NIS2 addresses these weaknesses. The number of entities in scope grows from 15,000 to approximately 160,000 across the EU, including tens of thousands in France. According to ANSSI, between 10,000 and 15,000 French companies are directly within the new directive’s scope.

The French context

In France, NIS2 is transposed by the law on critical infrastructure resilience and cybersecurity; check cyber.gouv.fr for the status of the implementing texts. ANSSI (Agence nationale de la sécurité des systèmes d’information) is the competent authority, responsible for supervision, audits, and penalties. ANSSI has published guidance documents and set up a registration portal for affected entities.

French legislators chose a faithful transposition of the European text, without significantly easing obligations. French SMEs are therefore subject to the same requirements as their European counterparts, a point that some industry groups contested during consultations.

Who is affected by NIS2 in France?

Unlike NIS1, the NIS2 directive uses objective criteria of size and sector to determine who falls within scope. Authorities no longer designate entities case by case.

Size criteria

NIS2 applies to two categories of entities, determined by their size:

Category	Employees	Annual turnover	Annual balance sheet
Medium entities	50 to 249 employees	EUR 10M to 50M	EUR 10M to 43M
Large entities	250+ employees	> EUR 50M	> EUR 43M

The thresholds follow the EU definition of SMEs (Recommendation 2003/361/EC). A company is at least medium-sized if it has 50 employees or more, or if both its turnover and its balance sheet exceed EUR 10 million. A company with 45 employees, EUR 12 million in turnover and a EUR 11 million balance sheet is therefore in scope.

Essential sectors (Annex I of the directive)

The so-called “highly critical” sectors are subject to the strictest requirements:

Sector	Example activities
Energy	Electricity, oil, gas, hydrogen, district heating
Transport	Aviation, rail, maritime, road
Banking	Credit institutions
Financial market infrastructure	Trading platforms, central counterparties
Healthcare	Hospitals, laboratories, medical device manufacturers
Drinking water	Supply and distribution
Wastewater	Collection, treatment, discharge
Digital infrastructure	DNS, registries, cloud, data centers, CDN, ISPs
ICT service management	Managed service providers (MSP/MSSP)
Public administration	Central government entities
Space	Operators of ground-based infrastructure

Important sectors (Annex II of the directive)

The so-called “critical” sectors face similar obligations but lower penalties:

Sector	Example activities
Postal and courier services	Mail, parcels, logistics
Waste management	Collection, treatment, recycling
Chemical manufacturing, production and distribution	Industrial chemistry, agrochemicals
Food production and distribution	Agri-food, retail
Manufacturing	Medical devices, electronics, machinery, automotive, transport equipment
Digital service providers	Marketplaces, search engines, social networks
Research	Research organizations

Special cases: covered regardless of size

Certain entities fall within NIS2 scope regardless of their size:

• DNS service providers
• Top-level domain (TLD) name registries
• Qualified trust service providers
• Providers of public electronic communications networks
• Entities identified as critical under the CER directive

Is my company affected? A simplified decision tree

To determine whether your SME falls within NIS2 scope, ask yourself these questions:

1. Does your company operate in one of the sectors listed above? If not, you are probably not directly affected (but see point 3).
2. Is your company at least medium-sized (50 employees or more, or both turnover and balance sheet above EUR 10M)? If yes, you are in scope.
3. Are you a subcontractor or supplier to an affected entity? Even if you are not directly in scope, your NIS2-regulated clients will demand cybersecurity guarantees under the supply chain security obligation (Article 21.2.d). This is the cascade effect of NIS2.

If in doubt, use the MonEspaceNIS2 portal set up by ANSSI for self-assessment.

The 10 NIS2 obligations for companies

Article 21 of the NIS2 directive defines 10 categories of measures that affected entities must implement. These measures must be proportionate to the company’s size, its risk exposure, and the potential severity of incidents.

Here are the 10 obligations, explained in practical terms for an SME.

1. Risk analysis and security policy (Article 21.2.a)

What the text says: entities must adopt policies on risk analysis and information system security.

In practice for your SME: map your digital assets (servers, workstations, SaaS applications, sensitive data), assess the risks to each, and document a formal security policy. Management must approve this document and review it at least once a year.

2. Incident management (Article 21.2.b)

What the text says: entities must implement security incident management procedures.

In practice: you need a documented process for detecting, analyzing, containing, and remediating security incidents. NIS2 sets strict notification deadlines:

• Initial alert within 24 hours of becoming aware of a significant incident
• Full notification within 72 hours, with an initial assessment of the incident
• Final report within one month of the notification, with detailed analysis and measures taken

3. Business continuity (Article 21.2.c)

What the text says: entities must ensure the continuity of their activities, including backup management, disaster recovery, and crisis management.

In practice: document a business continuity plan (BCP) and a disaster recovery plan (DRP). Test your backups regularly, because you only know a backup works once you have restored from it. After a ransomware attack, you must be able to restore your critical systems within a defined timeframe.

4. Supply chain security (Article 21.2.d)

What the text says: entities must manage risks related to their suppliers and service providers.

In practice: inventory your critical suppliers (hosting provider, software vendor, maintenance contractor). Assess their cybersecurity level. Add security clauses to your contracts. For SMEs this obligation has the widest reach, because of the cascade effect: even companies outside the NIS2 scope will need to demonstrate their cyber maturity to their regulated clients.

5. Security of network and information system acquisition, development, and maintenance (Article 21.2.e)

What the text says: entities must integrate security throughout the lifecycle of their information systems.

In practice: if you develop software, build security in from the design phase (security by design). If you purchase solutions, assess their security before deployment. Apply security patches within reasonable timeframes.

6. Assessment of cybersecurity risk management effectiveness (Article 21.2.f)

What the text says: entities must regularly assess the effectiveness of their cybersecurity measures.

In practice: you must show that your protections work. For the human side, phishing simulation is one way to do it: regular tests of how employees handle malicious emails produce documented, auditable metrics.

Regular simulation campaigns with their reports give an auditor concrete evidence for this obligation. Click rates and their trend over time show whether your awareness measures have an effect. The same logic applies to the other measures: vulnerability scans, backup restore tests and incident response exercises.

7. Cyber hygiene practices and training (Article 21.2.g)

What the text says: entities must implement basic cyber hygiene practices and cybersecurity training.

In practice: NIS2 makes employee training mandatory. Every staff member must be trained in the basics: recognizing a phishing email, using strong passwords, reporting a suspicious incident. A once-a-year slide deck is hard to defend as sufficient; plan regular, short sessions throughout the year.

This is the obligation most directly linked to anti-phishing. According to the IBM Cost of a Data Breach Report 2025, phishing is the most common initial attack vector (16% of breaches). For a detailed guide on setting up a training program, see our article on employee cybersecurity training.

8. Cryptography and encryption policies (Article 21.2.h)

What the text says: entities must define policies on the use of cryptography, including encryption.

In practice: encrypt sensitive data at rest and in transit. Use HTTPS everywhere, encrypt laptop hard drives, and use email encryption for confidential data. Document your key management policy.

9. Human resources security, access control, and asset management (Article 21.2.i)

What the text says: entities must secure human resources processes and manage access appropriately.

In practice: apply the principle of least privilege, so each employee only has access to the resources their role requires. Set up onboarding and offboarding procedures to grant and revoke access. Review access rights regularly, particularly for privileged accounts.

10. Multi-factor authentication and secure communications (Article 21.2.j)

What the text says: entities must use multi-factor authentication (MFA) or continuous authentication, and secure communications.

In practice: deploy MFA on all critical accounts: business email, VPN access, line-of-business applications, cloud admin consoles. Prefer phishing-resistant MFA (FIDO2, WebAuthn) over SMS, which is vulnerable to SIM swapping.

Penalties and executive liability

NIS2 penalties are much heavier than under NIS1.

Financial penalties

Maximum fine amounts vary by entity category:

Category	Maximum fine	Alternative
Essential entity	EUR 10,000,000	2% of global annual turnover (whichever is higher)
Important entity	EUR 7,000,000	1.4% of global annual turnover (whichever is higher)

For an SME with EUR 20 million in turnover, the maximum fine is EUR 7 million as an important entity, or EUR 10 million as an essential entity. These are theoretical maximums, set high on purpose so that penalties deter.

Personal liability of executives

For SME leaders, this is probably the provision that matters most. Article 20 of the directive states that:

• The management bodies of affected entities must approve cybersecurity risk management measures
• They must supervise the implementation of these measures
• They can be held liable for infringements
• They must themselves follow cybersecurity training to be able to assess risks

For serious violations by essential entities, NIS2 allows a temporary ban on exercising management functions. NIS2 compliance is therefore a governance issue that directly engages the executive’s personal liability.

ANSSI’s powers

In France, ANSSI has extensive powers to enforce NIS2:

• Audits and inspections: ANSSI can conduct on-site or remote audits, including unannounced ones
• Injunctions: it can order compliance under penalty
• Administrative fines: without going through the courts, within the prescribed limits
• Publication of penalties: publishing the decision with the company’s name can cause more reputational damage than the fine itself
• Activity suspension: in the most serious cases, for essential entities

NIS2 compliance timeline

Here are the dates that matter:

Date	What happens
14 December 2022	Adoption of Directive (EU) 2022/2555 by the European Parliament and the Council
17 October 2024	Deadline for transposition into national law in all member states; NIS2 officially applies
2025	France adopts its transposition law. ANSSI publishes guidance and opens the MonEspaceNIS2 registration portal. ANSSI prioritizes support over immediate enforcement
2026	Affected entities must be registered with ANSSI. First audits are expected. Incident notification obligations are fully enforceable
2027 and beyond	Financial penalties expected to be applied in full, with more systematic audits and publication of non-compliant entities

Start before the audits do. Companies that begin now can spread the work over several quarters, and their clients increasingly ask for cyber guarantees across the supply chain anyway.

NIS2 compliance checklist for SMEs

This 20-point checklist follows the obligations of Article 21. It is organized by category so you can structure your action plan and track progress.

Governance

• Appoint a cybersecurity lead. Even part-time, someone must be the identified point person. This doesn’t have to be a full-time CISO (see FAQ), but someone who drives the topic day to day.
• Train executives in cybersecurity. Article 20 of NIS2 explicitly requires this. Board members must understand cyber risks and be able to assess proposed measures.
• Document the security policy: a formal document, approved by management, describing the principles, roles, and responsibilities for cybersecurity, reviewed at least annually.
• Set up a cyber steering committee that meets at least quarterly, bringing together management, the cybersecurity lead, and business unit heads to review metrics and approve actions.

Risk management

• Conduct a risk analysis. Identify threats, vulnerabilities, and potential impacts on your operations. Use a recognized methodology (EBIOS RM, the risk analysis method recommended by ANSSI, or ISO 27005).
• Map critical assets: a complete inventory of your information systems, applications, sensitive data, and interconnections. You cannot protect what you don’t know about.
• Assess supply chain risks. List your critical suppliers, evaluate their cyber maturity, and add security requirements to your contracts.
• Document remediation measures. For each identified risk, record the chosen response (accept, reduce, transfer, avoid) and the implementation plan.

Protection

• Deploy multi-factor authentication (MFA) on all critical access points: email, VPN, line-of-business applications, cloud admin consoles. This is the top priority.
• Encrypt sensitive data at rest (drives, databases) and in transit (HTTPS, VPN). Document the key management policy.
• Segment networks. Separate administration, production, and guest networks to limit lateral movement after a compromise.
• Keep tested backups. Follow the 3-2-1 rule (3 copies, 2 different media, 1 offsite copy) and test restoration at least quarterly.

Training and testing

• Set up an awareness program: regular training for all employees on cybersecurity basics, in short sessions spread over the year.
• Run regular phishing simulations. Assessing the effectiveness of measures (Article 21.2.f) requires concrete testing, and phishing simulation campaigns produce documented metrics.
• Measure and document progress. Track click rates and reporting over time. These metrics are part of your evidence for an ANSSI auditor.
• Train employees on incident reporting. Every staff member must know how and to whom to report a suspicious email or abnormal behavior. See our guide to phishing simulation in the workplace for how to structure this program.

Detection and response

• Write an incident management process: a documented procedure covering who does what, in what order, with what tools. Include ANSSI contact details and the relevant CSIRT.
• Prepare notification templates. NIS2 requires an alert within 24 hours, then a notification within 72 hours. Prepare the forms in advance so you don’t lose time during a crisis.
• Test the incident response plan with a tabletop exercise at least every six months. Simulate different scenarios, such as ransomware, account compromise or a data breach.
• Document lessons learned. After every real or simulated incident, write a post-mortem and update your procedures.

NIS2 and phishing

NIS2 does not single out phishing, but phishing is the most common initial attack vector (16% of breaches, IBM Cost of a Data Breach Report 2025), and two Article 21 obligations apply to it directly.

Article 21.2.f (effectiveness assessment) requires regular testing of your defenses. For the human side, phishing simulation is the most direct way to measure it. Regular campaigns with their reports give an auditor something concrete to review.

Article 21.2.g (training and cyber hygiene) makes employee training mandatory. Training assigned right after an employee clicks a simulated phishing email reaches them when the mistake is fresh, and the reminders and completion records document that training actually took place.

Reporting matters too. When employees can forward a suspicious email and get a verdict back, they report more, and your incident management process (Article 21.2.b) gets earlier warning.

For detailed statistics on phishing’s impact on businesses, see our article Phishing in the workplace: 2026 statistics, examples, and solutions.

What nophi.sh covers, and what it doesn’t

NIS2 requires much more than training. Risk analysis, backups, MFA, encryption, supplier management and incident response are all outside what nophi.sh does. nophi.sh helps with the phishing part of two obligations (21.2.f and 21.2.g) and with reporting suspicious emails.

Article 21.2.f: assessing effectiveness

nophi.sh sends phishing simulations built from 80 ready-made scenarios in French and English across 16 categories, and you can write your own. Results show the open, click and credential-submission funnel, repeat clickers and people who haven’t been tested yet, broken down by department and manager team.

Article 21.2.g: training

Anyone who fails a test is automatically assigned a short training module, based on rules you set by category and action. Reminders go out on day 3 and day 6, then the manager is notified. The built-in course “Phishing awareness: the fundamentals” (5 lessons and a 10-question quiz, 80% to pass) is available in French and English, and you can build your own courses.

Reporting suspicious emails

Employees forward a suspicious email to the nophi.sh verification address, or use the Microsoft 365 Report button pointed at it. An AI verdict with its reasons comes back, usually in under a minute, and your security contacts are alerted. nophi.sh does not filter or block email; it works alongside your existing filter.

Audit evidence

nophi.sh produces a PDF audit report (executive summary, trends, risk distribution, departments, training follow-up) and CSV exports. You can use them as evidence in your NIS2, ISO 27001 (A.6.3) or DORA audits, alongside the documentation for the other obligations.

See the compliance page for details, or start a 14-day free trial (full product, no credit card).

Frequently asked questions about NIS2

Is my 60-employee consulting firm affected by NIS2?

It depends on your sector. Consulting as such is not listed in Annex I or II of the directive. However, if your firm provides managed IT services (MSP), cybersecurity services (MSSP), or operates in a listed sector (healthcare consulting, energy consulting), you may fall within scope. And if your clients are subject to NIS2, they will likely demand security guarantees under the supply chain obligation (Article 21.2.d), even if you are not directly regulated.

What is the difference between an essential entity and an important entity?

The difference mainly concerns the level of supervision and penalties. Essential entities (Annex I sectors, large companies) face proactive supervision: ANSSI can audit them at any time, including unannounced inspections. Important entities (Annex II sectors, mid-sized companies) face a reactive regime: ANSSI intervenes after an incident or report. Maximum penalties are also higher for essential entities (EUR 10M vs EUR 7M).

When will NIS2 penalties start being enforced in France?

The directive has applied since October 2024; check cyber.gouv.fr for the status of the French implementing texts. ANSSI indicated it would prioritize a supportive approach initially, but penalties are legally enforceable from the moment of transposition. The first formal audits are expected in 2026. Compliance takes months, so start before an audit is announced.

Does NIS2 apply to subcontractors of regulated entities?

Not directly: a subcontractor that is not itself in a covered sector and does not exceed the size thresholds is not formally subject to NIS2. Indirectly, yes: Article 21.2.d requires regulated entities to secure their supply chain. In practice, your NIS2-regulated clients will impose contractual security requirements (audits, certifications, technical guarantees). This cascade effect potentially reaches hundreds of thousands of SMEs across Europe.

How do I prove NIS2 compliance to an auditor?

NIS2 compliance is proven through documentation. You must be able to present: your security policy approved by management, your risk analysis, your incident management procedures, your simulation and training reports, your asset inventory, your supplier contracts with security clauses, and your steering committee minutes. The auditor will check consistency between documentation and the measures actually in place. Phishing simulation reports that show metrics improving over time are useful evidence for the training and effectiveness obligations, but they cover only part of what an auditor will review.

What budget should I plan for NIS2 compliance?

The budget varies considerably depending on company size and current maturity level. According to ENISA, European SMEs spend on average between EUR 50,000 and EUR 200,000 on initial NIS2 compliance, then between EUR 20,000 and EUR 80,000 per year for maintenance. This covers risk analysis, technical tools, training, audits, and staff time. It is a significant investment. For comparison, the average cost of a data breach is USD 4.44 million worldwide according to the IBM Cost of a Data Breach Report 2025.

NIS2 and GDPR: where do they overlap?

NIS2 and GDPR are distinct. GDPR protects personal data; NIS2 protects networks and information systems. They overlap in many places: a personal data breach caused by phishing is both a NIS2 incident (notification to ANSSI within 24 hours) and a GDPR violation (notification to CNIL, France’s data protection authority, within 72 hours). Many technical measures are shared: encryption, access control, training. SMEs that are already GDPR-compliant have part of the documentation and governance work done.

Do I need a dedicated CISO to comply with NIS2?

NIS2 does not explicitly require a full-time CISO (Chief Information Security Officer). The directive requires that a person be identified as responsible for cybersecurity and that management be involved. For an SME of 50 to 100 employees, an IT manager trained in cybersecurity, supported by automated tools and possibly an external provider (MSSP), can be sufficient. What matters is that the role is formally assigned and documented, and that the person has the time and resources needed.

If a phishing incident occurs despite your preventive measures, see our phishing incident response guide for step-by-step instructions.

Where to start this month

According to the Hiscox Cyber Readiness Report 2025, 57% of SMEs suffered at least one cyberattack in the past 12 months. If NIS2 applies to you, these four steps get the work moving:

1. Check your scope on the MonEspaceNIS2 portal and register if you are an essential or important entity.
2. Name your cybersecurity lead and put NIS2 on the agenda of the next management meeting (Article 20).
3. Enable MFA on email and remote access if it isn’t already on.
4. Run a first phishing simulation to get a baseline click rate, and schedule regular short training sessions for the year.

nophi.sh covers the phishing simulation and training part of that list. Start a 14-day free trial: full product, no credit card, and your first campaign can go out the same day.