Why NIS2 Is Relevant for Your Mid-Market Business

The NIS2 Directive significantly expands the scope of affected companies. It is no longer just critical infrastructure sectors; many mid-sized companies in the DACH region now fall under these strict regulations.

Affected entities include:

  • Companies with more than 50 employees and an annual turnover of over 10 million euros.
  • Small companies (10-50 employees) in critical sectors such as energy, transport, or water.
  • Service providers that operate critical IT systems for larger companies.

The core obligation is: Risk-based IT management. You must protect your digital infrastructure in a way that prevents cyberattacks or minimizes their impact. This means more than just individual tools; it requires a holistic process.

Core Obligations of the NIS2 Directive

The Directive defines specific measures that you must implement in your IT landscape. These are divided into eight categories.

Key measures at a glance:

  • Risk Management: Regular analysis of vulnerabilities in networks and applications.
  • Incident Handling: Documented processes for reporting and handling security incidents.
  • Business Continuity: Ensuring IT availability during outages or attacks.
  • Supply Chain Security: Auditing the security of your IT service providers.
  • Cryptography: Use of encryption for data at rest and in transit.
  • Human Factors: Training employees on phishing and social engineering.

Important: Responsibility lies with the management board. You must ensure that these measures are not just IT topics but become part of the corporate strategy.

Concrete Implementation Steps for Your IT Security

To become NIS2-compliant, you need a structured approach. Here are the first four steps you should start immediately.

1. Inventory and Risk Analysis Identify all critical assets: servers, cloud instances, IoT devices, and software. Assess what targets these represent for attackers.

2. Implementation of Technical Protective Measures

  • Zero Trust Architecture: No automatic trust within the network.
  • Multi-Factor Authentication (MFA): Mandatory for all remote access and privileged accounts.
  • Patch Management: Automated updates for operating systems and applications.
  • Backup & Recovery: Separate, regular backups with tested recovery.

3. Organization and Processes Appoint a CISO or an external security officer. Create an Incident Response Plan that defines who does what in the event of an alarm. Document all decisions and measures.

4. Training and Awareness Conduct quarterly phishing simulations. Training must be verifiable. Employees are often the biggest security risk.

Roles and Responsibilities Within the Company

NIS2 makes the management board personally liable. This is a paradigm shift. It is not enough to simply inform the IT department.

Responsibilities:

  • Management Board: Must provide resources for IT security and approve the risk assessment.
  • IT Managers: Implement technical measures and monitor systems.
  • Department Heads: Ensure that their teams comply with security policies (e.g., no private USB sticks).

Recommendation: Build a Security Governance structure. This means integrating IT security into the board of directors or executive management. Regular reports on security status and risks should be standard at the C-level.

Consequences of Non-Compliance and Fines

The sanctions are significantly stricter than under the old NIS1 Directive. It is not just about fines; there are also personal consequences.

Fines:

  • Critical Enterprises: Up to 10 million euros or 2% of global annual turnover.
  • Important Enterprises (Mid-Market): Up to 7 million euros or 1.4% of global annual turnover.

Personal Liability: Managing directors can be held personally liable in cases of gross negligence or intent. This can extend to criminal prosecution if severe damage occurs due to inadequate security.

Reputational Risk: A documented security incident can undermine customer and partner confidence. NIS2 compliance is increasingly becoming a sales argument and a trust signal in tenders.

How Core IT Services Supports Your NIS2 Implementation

Implementing NIS2 requires expertise in technology, law, and process management. As an IT consultancy with a focus on Managed Services, we offer you a direct path to compliance.

Our services for NIS2:

  • IT Risk Analysis: We identify your critical assets and vulnerabilities.
  • Managed Security Services: 24/7 monitoring, firewall management, and incident response.
  • Compliance Consulting: We assist with documentation and preparation for audits.
  • Cloud & Backup: Secure, separate backup solutions and cloud strategies.

Your Benefit: You receive not just tools, but a partner who supports both the technical implementation and organizational processes. This turns NIS2 from a burden into a strategic advantage.

FAQ

Does NIS2 also apply to small mid-market companies?

Yes, provided they operate in a critical sector or meet certain size criteria. Small companies (10-50 employees) in sectors such as energy, transport, or healthcare are affected if they operate critical infrastructure. Additionally, many service providers fall under the Directive, regardless of size, if they provide IT services to critical enterprises.

What is the difference between NIS1 and NIS2?

NIS2 significantly expands the scope of affected industries and tightens obligations. While NIS1 focused on critical infrastructure, NIS2 also includes the mid-market. Furthermore, liability rules for the management board are tightened, and reporting obligations for incidents are clarified. Technical requirements for risk management have become more detailed and stricter.

How long does it take to become NIS2-compliant?

This depends on the current maturity of your IT security. For companies with a good foundation (e.g., ISO 27001), adaptation may take 3-6 months. For companies without structured IT management, 6-12 months is realistic. The most important step is a rapid inventory and risk analysis to determine the scope of measures required.

Do I need an external CISO for NIS2?

Not necessarily, but it is often sensible. Small and medium-sized enterprises rarely have the internal resources for comprehensive security governance. An external CISO or a Managed Security Service Provider (MSSP) can take over strategic alignment, risk analysis, and incident management. This relieves the internal IT department and ensures that all obligations are met.