NIS2 Directive Explained: EU Cybersecurity Rules for Small Companies (2026 Review)

Reviewed 16 October 2026: Rechecked the EU framework and Romanian consolidated law, including Law 123/2026, classification, reporting and penalties. Added Romania’s separate cross-border reporting duty and clarified control-review frequencies and questionnaire limits. National law and your entity’s circumstances determine the obligations.

NIS2 makes cybersecurity risk management and significant-incident reporting legal obligations for covered organisations. To work out what it means for a small company, separate direct regulation, customer contract requirements and useful security practices.

TL;DR:

• The general size screen is 50 or more annual work units OR (turnover above €10 million AND balance sheet total above €10 million), together with a covered activity.
• Small and micro-businesses can be covered under specific size-independent rules. Partner or linked companies can affect the calculation.
• Essential and important entities both have security and reporting duties. A sector label alone does not determine the classification.
• Romania’s July 2026 amendment concerns coordinated vulnerability disclosure and conditional criminal-law protection, rather than a new general size threshold.
• Project estimates do not create a grace period for obligations already in force.

What Is NIS2 (In Plain English)

NIS2, Directive (EU) 2022/2555, is the second EU Network and Information Security Directive. It entered into force in January 2023, and Member States had until 17 October 2024 to transpose it into national law.

It broadens the original NIS framework to cover more services and requires proportionate technical, operational and organisational security measures, incident reporting, management oversight and enforcement. Company obligations operate through the relevant national implementation, with certain EU sector rules also applying.

The Commission proposed targeted amendments on 20 January 2026. A proposal is not an enacted change to your obligations. This guide uses the enacted framework and the Romanian consolidated law reviewed below.

Who NIS2 Actually Affects

The Size Test: Staff OR Both Financial Ceilings

The EU SME definition defines a small enterprise using fewer than 50 staff AND (turnover of €10 million or less OR balance sheet total of €10 million or less).

Consequently, the ordinary NIS2 size screen is:

50 or more annual work units
OR
(annual turnover > €10 million AND balance sheet total > €10 million)

Turnover alone is not enough. An autonomous company with 30 annual work units, €12 million turnover and €4 million assets remains within the small financial test. With €12 million turnover and €11 million assets, both financial ceilings are exceeded. Exactly €10 million does not exceed the ceiling.

Use the proper accounting period, annual work units and ownership rules. Part-time and seasonal staff count proportionately under the EU definition. Partner or linked enterprises may require aggregation. National implementation and rules governing changes in size also matter.

Size-Independent Exceptions

Do not stop at the size test if you provide public electronic communications networks/services, trust services, DNS services or operate a TLD registry. These categories have specific size-independent coverage. Certain public bodies and entities identified as critical can also be covered regardless of size.

A small ordinary supplier to a regulated customer is not automatically directly regulated. The customer may impose security requirements through contracts, and the supplier must separately assess its own activity and any specific designation.

The 18 Covered Sectors

The directive has 11 Annex I sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space.

It has seven Annex II sectors: postal/courier services, waste management, chemicals, food production/processing/distribution, specified manufacturing, digital providers and research organisations. Check the defined entity types underneath each heading; an industry name alone is too broad.

Essential and important do not map directly to these two lists. Large Annex I entities are generally essential. Other covered entities are generally important unless a special rule or national designation applies. Qualified trust providers, DNS providers and TLD registries have size-independent essential classifications. Medium-sized cloud providers, for example, are not automatically essential simply because cloud computing is in Annex I.

Equivalent sector-specific EU rules can replace particular NIS2 risk-management, reporting or supervision provisions. Financial entities covered by DORA need to assess that interaction rather than duplicate every obligation mechanically.

Use our NIS2 self-assessment and worked size examples to document your activity, size, ownership, jurisdiction and exceptions before deciding your classification.

Three Practical Examples

• A 12-person SaaS company: Generally outside the ordinary size-based scope if it meets the small financial test and no exception or group relationship changes that result. Customer security requirements may still apply.
• An 80-person electronics manufacturer: Generally in scope as an Annex II manufacturer, subject to national law and the exact activity. It will usually be important unless specifically classified essential.
• An eight-person local services business: Generally outside direct scope if it does not provide a regulated service and has no special designation. Basic security still protects its operations.

Romania: What Changed in July 2026?

Romania implements NIS2 through OUG 155/2024, as amended and approved by Law 124/2025. DNSC is the competent national authority. Articles 5–9 set scope and classification, while Article 18 sets registration requirements.

Romanian distinctions matter. Medium-sized managed security service providers are essential under Article 5(4). Article 8 refers to Law 346/2004 for size classification but expressly excludes its Article 4⁵ public-ownership rule. Confirm the applicable accounting, staff and group-data provisions rather than importing every SME condition unchanged.

Law 123/2026, effective 6 July 2026, added an advisory committee consulted by DNSC in coordinated vulnerability disclosure. It also introduced Criminal Code Article 365¹, excluding criminal character for specified acts only when all research and reporting conditions in OUG 155 Article 36(5)–(6) are met.

Those conditions include good faith, restrictions on data access and changes, avoiding disruption and prohibited techniques, DNSC agreement for public disclosure, and reporting within 48 hours of identifying the vulnerability. The amendment is not blanket permission to test systems and did not introduce a universal new size threshold.

Covered organisations already have Article 36 duties to handle vulnerability reports, cooperate with DNSC and publish reporting contacts and terms. Producers and suppliers that are essential or important entities have additional duties for vulnerabilities affecting their own ICT products and services. Include those existing requirements in your process.

The 10 Minimum Cybersecurity Measures (Article 21)

Article 21(2) of the NIS2 Directive lists ten areas that risk-management measures must address. The controls must be appropriate and proportionate to the risks. The practical actions below are starting points, not universal statutory frequencies or a complete legal checklist.

For specified digital services, also check Implementing Regulation (EU) 2024/2690 and ENISA’s technical implementation guidance. National and sector rules may add detail.

1. Risk Analysis and Information System Security Policies

What it means: Systematically identify, analyze, and document cybersecurity risks to your IT systems.

Practically:

• Assess risks on a documented schedule appropriate to the services and applicable rules, and after material changes
• Document which systems are critical
• Identify threats (ransomware, data breaches, insider threats)
• Assess likelihood and impact
• Create a written risk management policy

Not: A 200-page document. A practical risk register showing what could go wrong, how likely, how bad, and what you’re doing about it.

2. Incident Handling

What it means: Have documented processes for detecting, responding to, and recovering from cybersecurity incidents.

Practically:

• Define what constitutes an “incident” (ransomware, data breach, DDoS, system compromise)
• Document who to contact (internal team, external support, authorities)
• Exercise incident response on an agreed risk-based schedule and after important changes
• Send an early warning within 24 hours of becoming aware of a significant incident

Significant-incident reporting: The general Article 23 schedule runs from awareness of a significant incident: early warning within 24 hours and incident notification within 72 hours, both without undue delay. The final report is due within one month after the incident notification. If the incident is still ongoing, a progress report and later final report are required. Trust service providers have a specific 24-hour notification rule.

Assess significance against the statutory criteria: severe operational disruption or financial loss for the entity, or considerable material or non-material harm to others, including potential impacts. Apply the relevant service-specific criteria as well. A blocked phishing email or routine alert is not automatically reportable simply because it occurred. In Romania, the corresponding rules are in OUG 155 Article 15. Its paragraph (3) also requires reporting, without unjustified delay and within six hours of becoming aware, information that enables the national CSIRT to establish a cross-border impact. Check this separate trigger alongside the 24-hour early warning, rather than treating 24 hours as permission to wait.

3. Business Continuity (Backup, Contingency, Crisis Management)

What it means: Ensure you can continue operating (or quickly recover) after a major incident.

Practically:

• Regular, tested backups (see: Why Your Backups Will Fail)
• Disaster recovery plan documented and tested
• Alternative systems/processes if primary systems fail
• Crisis management procedures (who decides what during an emergency)

Key: Keep evidence that restoration and continuity arrangements work. A completed backup job alone does not demonstrate recovery capability.

Checklist: The Backup Health Check can organize questions about copies, isolation and restore testing. It does not inspect your backups, test recovery or establish NIS2 compliance.

4. Supply Chain Security

What it means: Assess and manage cybersecurity risks from your suppliers and service providers.

Practically:

• List your critical suppliers (cloud providers, SaaS vendors, outsourced IT, payment processors)
• Assess their cybersecurity practices (Do they have ISO 27001? SOC 2? Basic hygiene?)
• Document security requirements in contracts
• Monitor for breaches affecting suppliers

This is where small companies feel NIS2 indirectly: Large companies push requirements down the supply chain through contracts.

Checklist: The vendor dependency questionnaire can identify questions about access, documentation and exit arrangements. It does not audit supplier security or determine NIS2 compliance.

5. Security in Acquisition, Development, and Maintenance

What it means: Build security into systems from the start, not bolt it on later. Handle vulnerabilities responsibly.

Practically:

• Security requirements in procurement (don’t buy insecure software/hardware)
• Secure software development practices (if you build software)
• Patch management process (apply security updates promptly)
• Vulnerability disclosure policy (how people report security issues to you)

6. Policies to Assess Effectiveness of Measures

What it means: Regularly check if your security measures actually work.

Practically:

• Audits or assessments at intervals justified by risk and applicable national or sector rules
• Penetration testing (external experts attempt to breach your systems)
• Review logs and monitoring data
• Measure compliance with internal policies
• Update measures based on findings

7. Basic Cyber Hygiene and Training

What it means: Everyone in the organization understands basic security practices.

Practically:

• Regular, role-appropriate cybersecurity training, with frequency set by risk and applicable requirements
• Phishing awareness training
• Unique passwords, password managers and appropriate MFA, including phishing-resistant options where supported
• Clean desk policies
• Secure configuration of laptops/workstations
• Regular patching and updates

Not rocket science: This is blocking and tackling—password managers, MFA, don’t click suspicious links, lock your laptop.

8. Cryptography and Encryption Policies

What it means: Use encryption where appropriate to protect data.

Practically:

• Encrypt sensitive data at rest (databases, file storage)
• Encrypt data in transit (HTTPS, VPNs, encrypted email for sensitive data)
• Manage encryption keys securely
• Document when and how encryption is used

Where it matters: Customer data, financial data, health data, authentication credentials.

9. Human Resources Security, Access Control, Asset Management

What it means: Control who has access to what, manage employee lifecycle, track your assets.

Practically:

• Access control: Least privilege (users only access what they need), role-based permissions, MFA for administrative access
• HR security: Background checks for sensitive roles, onboarding/offboarding procedures (revoke access when people leave)
• Asset management: Inventory of all IT assets (servers, laptops, software licenses, SaaS subscriptions)

10. Authentication and Secure Communications

What it means: Use MFA or continuous authentication, secure voice/video/text communications and secure emergency communications within the entity, where appropriate.

Practically:

• MFA for email accounts
• MFA for admin access to servers, databases, cloud platforms
• MFA for remote access (VPNs)
• Consider continuous authentication for high-risk scenarios

This is low-hanging fruit: Most modern systems support MFA. Turn it on.

What Compliance Actually Looks Like

Start with the obligations and deadlines already applicable to your entity. A security programme can run in phases, but there is no universal twelve-month grace period created by an implementation plan.

Establish Responsibility and Urgent Controls

Confirm registration, management oversight, incident reporting contacts and escalation arrangements first. Address urgent exposure: MFA, administrative access, tested backups, unsupported systems and critical patches.

In Romania, Article 18 generally requires notification to DNSC within 30 days of the provisions becoming applicable to the entity. Confirm current forms, implementing orders and your actual date. The EU’s April 2025 deadline for Member States to establish lists was not a universal registration deadline for every company.

Document the Risks and Processes

Create an asset inventory, risk assessment, incident response plan, recovery plan and supplier register. Assign owners and review dates. Record why controls are proportionate to your services and risks.

ISO 27001 or NIST CSF can provide useful existing processes and evidence. Neither a certification nor an arbitrary completion percentage proves NIS2 compliance. Check the scope and map the remaining statutory requirements explicitly.

Implement, Test and Retain Evidence

Close the identified gaps, exercise incident response and restore critical systems from backup. Record findings and remediation. Demonstrate that management reviews the risks, approves resources and receives appropriate training.

The work and cost depend on the starting position, regulated services and testing requirements. Obtain a scoped estimate after assessment rather than treating a universal euro range as an industry benchmark.

Management Accountability

Article 20 requires management bodies to approve and oversee cybersecurity risk-management measures and receive training. Liability follows the applicable national rules. Outsourcing delivery does not remove management’s responsibility.

For a practical governance routine, designate an operational owner, approve policies and risk decisions, receive regular reporting and track corrective actions. A quarterly meeting can be useful, but the directive does not prescribe one universal briefing frequency for every entity.

Romania’s Article 14 adds requirements for designated responsible people and management training. Certain essential entities must meet additional authority, independence and specialist-training conditions. Check these before assuming a general IT role or an external consultant can automatically fill the statutory position.

Penalties and a Corrected Example

For breaches of the risk-management or reporting duties, NIS2 Article 34 requires national maximum administrative fines of at least:

These are not automatic fines for every incident. National law, infringement type, seriousness and the circumstances determine the sanction. Romania uses these higher-of ceilings for specified infringements in OUG 155 Article 60(2) and has other penalty bands for other listed breaches.

Worked example: For a €50 million worldwide-turnover company, 1.4% is €700,000. The higher of €700,000 and €7 million is €7 million, the Romanian important-entity ceiling for the specified infringements. For the essential tier, 2% is €1 million and the corresponding higher ceiling is €10 million.

Management liability and, for specified essential-entity enforcement circumstances, temporary management restrictions can also apply. Their availability and procedure depend on the relevant law; they are not a universal automatic consequence of suffering a breach.

What to Do This Month

If You Appear Directly Covered

1. Document the activity, size calculation, ownership, jurisdiction and classification.
2. Confirm registration, reporting arrangements and deadlines with the competent authority.
3. Brief management and assign accountable owners with appropriate authority and training.
4. Assess the controls and evidence against applicable legal and sector requirements.
5. Fund a prioritised remediation plan that addresses existing obligations and urgent risks.

A fractional CTO can help assess infrastructure, coordinate implementation, write usable processes, test recovery and support management reporting. Check national role requirements and use specialist legal advice for unresolved scope questions.

Book a consultation for a technical gap analysis and a scoped implementation plan.

If You Are Outside Direct Scope

Keep a short record explaining why, including the exceptions checked. Review customer contracts and questionnaires separately. Reassess when you change services, ownership or size, and when relevant legislation changes.

Maintain MFA, access control, patching, staff awareness and tested backups. These controls reduce ordinary business risk whether or not NIS2 applies. Check backup health or review vendor dependency risks to identify useful starting points.

Related: Website problems that deserve an infrastructure review covers other practical gaps to investigate alongside your security programme.

Sources and Review Scope

Reviewed on 16 October 2026 against available official EU guidance and Romanian consolidated legislation. The EU provisions, national rules and practical implementation suggestions are identified separately in this guide. Other Member States have their own laws, classifications, competent authorities and procedures.

• Directive (EU) 2022/2555, Articles 2–4, 20–23 and 32–34, Annexes I–II
• European Commission SME definition and user guide
• European Commission NIS2 overview
• Implementing Regulation (EU) 2024/2690 for specified digital services
• ENISA NIS2 technical implementation guidance
• Romania OUG 155/2024, consolidated through 6 July 2026
• Romania Law 123/2026
• January 2026 proposed NIS2 amendments