NIS2 hits the mid-market: what to do now
Many companies are covered by a cyber-security directive for the first time — often without knowing it. A clear five-step roadmap out of the uncertainty.
With NIS2, the EU drastically widens the circle of regulated companies. Suddenly it's not only large corporations and classic critical-infrastructure operators who are obliged, but also many mid-sized suppliers, service providers and manufacturers. The uncomfortable truth: most of those affected don't yet know they're meant.
Am I even affected?
What matters is sector, company size and turnover. If you operate in one of the “important” or “essential” sectors and exceed the thresholds, you're obliged — whether or not the word “critical infrastructure” was ever mentioned. As a supplier to an affected company you're drawn in via supply-chain requirements too.
NIS2 is not a pure IT task. The directive explicitly holds management accountable.
The five steps out of uncertainty
- Clarify exposure: assess sector, size and supply-chain links in a structured way — not by gut feeling.
- Gap analysis: mirror the current state against the requirements (risk management, reporting paths, continuity).
- Prioritise measures: start with the gaps that carry the biggest risk and the shortest deadline.
- Build continuity provisioning: document reporting processes, emergency plans and responsibilities — and rehearse them.
- Secure evidence: document everything in a fully traceable way so you can prove it to authorities and customers.
Waiting is the most expensive option
Experience shows: organisations that start early and structured need less external help and avoid last-minute panic. The first step is unspectacular but decisive — clarity about your own exposure. That's exactly what our free self-check is for.
Related from our offering
Keep reading
AI-generated imageBCM software: business continuity management with NICA BCM — aligned with BSI Standard 200-4 and ISO 22301
Business continuity management has not been a side issue since 2020 at the latest. Anyone who wants to stay able to act in an emergency needs a clear framework — and the right tools. This article explains why structured emergency preparedness is necessary, which standards set the framework and how NICA BCM supports companies in putting it into practice.
AI-generated imageBusiness continuity management (BCM): a guide for resilient organisations
According to the Allianz Risk Barometer 2026, business interruption is one of the three biggest business risks worldwide — and it hits companies of every size. Whether cyberattacks, natural disasters or supply chain problems: without a plan, operations, reputation and customer relationships are at stake in an emergency. This guide explains how business continuity management works as a systematic approach, what regulations such as NIS2, DORA and the German KRITIS umbrella act require, and how to build an effective business continuity management system pragmatically.