NIS2 for small businesses: requirements, checklist and timeline
The NIS2 Directive extends mandatory cybersecurity to thousands of medium-sized companies, and indirectly to their suppliers. Here, in plain words: who is in scope, the 10 measures to put in place, the incident reporting deadlines, management liability, where French transposition stands and a checklist to start now.
Up to date as of 6 October 2026
- employees: the general threshold
- 50
- sectors in scope
- 18
- measures in Article 21
- 10
- for the early warning
- 24h
Does NIS2 apply to my company?
Three criteria combine: your sector, your size and your place in the supply chain of customers who are themselves in scope.
Essential entities
As a rule, large companies in highly critical sectors (Annex I): at least 250 employees, or more than €50M turnover and more than €43M balance sheet total. Proactive supervision (audits, inspections) and the highest fines.
Important entities
Medium-sized companies in Annex I and II sectors (at least 50 employees, or more than €10M turnover and balance sheet total), and large companies in Annex II. Same security measures, reactive supervision.
Regardless of size
Some entities are covered even when small: DNS service providers, top-level domain name registries, trust service providers, public electronic communications providers, or entities designated by the State (for example the sole provider of an essential service).
The 18 sectors of the Directive
Annex I, sectors of high criticality
Annex II, other critical sectors
The knock-on effect on suppliers
Even out of scope, a small business can be caught by NIS2: Article 21(2)(d) requires entities in scope to secure their supply chain. Customers subject to NIS2 will send you security questionnaires, add clauses to your contracts and ask for evidence (audit reports, training certificates). Managed service providers, SaaS vendors, hosting companies and IT contractors come first.
The thresholds and sectors above are those of the Directive. Each Member State’s transposition law sets the final scope. In France, ANSSI offers an “Am I concerned?” simulator on MonEspaceNIS2.
The 10 required measures, turned into concrete actions
Article 21 requires measures that are “appropriate and proportionate” to the risk, with ten at a minimum. Here is what they mean in practice for a small business, and what KrakenShield can do for you, without claiming to cover what belongs to your organisation.
- a
Risk analysis and security policy
In practice: List your assets and sensitive data, identify plausible threats, set priorities and write a short security policy approved by management.
With KrakenShield: The SSL/TLS audit includes the public footprint of your domains (hosting, DNS, email, exposed subdomains): an attacker’s view to feed your analysis.
- b
Incident handling
In practice: A written procedure: who detects, who decides, who informs the authority and customers, with contact details and retained logs. Then one exercise a year.
With KrakenShield: The “Incident response” chapter of the Cyber A to Z guide walks you through it.
- c
Business continuity and crisis management
In practice: Backups with one offline copy, restores tested regularly, a recovery plan and a printed crisis contact list.
With KrakenShield: We do not sell backup tools: the “Ransomware” chapter explains the 3-2-1 rule and restore testing.
- d
Supply chain security
In practice: List your critical suppliers, assess their security and write requirements into contracts (incident notification, patching, access).
With KrakenShield: The SSL/TLS and privacy audits work on any public website, with no ownership check: you can assess a supplier’s web front. Code analysis finds vulnerable dependencies in your software.
- e
Security in acquisition, development and maintenance
In practice: Apply patches, look for vulnerabilities in your applications and dependencies, organise their disclosure and remediation.
With KrakenShield: Agent-based code analysis (vulnerable dependencies, SAST, the code never leaves your server) and an orchestrated non-destructive penetration test, on a verified domain with a signed mandate. A watch on exploited CVEs in the Knowledge Center.
- f
Assessing the effectiveness of measures
In practice: Measure regularly: technical audits, simple indicators, a yearly management review.
With KrakenShield: Re-run an audit after each fix and track your A+ to F grade over time. Every audit produces a PDF report to keep as evidence.
- g
Cyber hygiene and training
In practice: Train all staff in the right reflexes (phishing, passwords, reporting) and keep proof of training.
With KrakenShield: KrakenShield Academy: 12 awareness modules, an exam and a certificate verifiable by QR code, with a dashboard and export; paid in Kredits per enrolled employee.
- h
Cryptography and encryption
In practice: An encryption policy: TLS 1.2 or 1.3 only, certificates tracked and renewed, sensitive data encrypted at rest.
With KrakenShield: The SSL/TLS audit (testssl.sh engine, grading aligned with SSL Labs) checks protocols, cipher suites, certificate and HSTS.
- i
HR security, access control, asset management
In practice: Least privilege, joiners and leavers handled the same day, an inventory of hardware, accounts and online services.
With KrakenShield: The public footprint reveals forgotten subdomains and services, often missing from the inventory.
- j
Multi-factor authentication and secure communications
In practice: MFA on email, remote access and admin accounts; secure messaging and video calls, a fallback communication channel.
With KrakenShield: The Academy module “Passwords, MFA and passkeys” trains your teams on MFA.
Reporting a significant incident: 24h, 72h, 1 month
An incident is “significant” if it severely disrupts your services, causes financial loss, or causes considerable damage to others. Deadlines run from the moment you become aware of it.
- 24h
Early warning
Report to the authority or CSIRT: is the incident malicious, could it affect other countries?
- 72h
Incident notification
Initial assessment: severity, impact and, where available, indicators of compromise.
- 1 month
Final report
Detailed description, likely root cause, measures taken. A progress report if the incident is still ongoing.
In France, the bill designates ANSSI as the national authority. Where appropriate, you must also inform affected customers without undue delay. Prepare your incident response
Management liability
- Management bodies approve the cybersecurity measures and oversee their implementation.
- They can be held liable for infringements: delegating to a provider does not transfer that responsibility.
- Members of management bodies must follow training; the Directive encourages the same for all staff.
- For essential entities, the authority can go as far as a temporary ban from managerial functions (Article 32).
Fines
| Category | Maximum fine (at least) | Supervision |
|---|---|---|
| Essential entity | €10M or 2% of worldwide annual turnover, whichever is higher | Proactive: audits, inspections, requests for evidence |
| Important entity | €7M or 1.4% of worldwide annual turnover, whichever is higher | Reactive: after an incident or a report |
These ceilings are the minimums set by the Directive. The amounts that apply are those of each national law.
Where does NIS2 stand in France on 6 October 2026?
On 6 October 2026, NIS2 has not yet been transposed in France. The bill on the resilience of critical infrastructure and strengthening cybersecurity, which also transposes the CER Directive and the directive accompanying DORA, is still waiting for its plenary debate in the National Assembly.
“Resilience” bill presented in the Council of Ministers and tabled in the Senate, under the accelerated procedure.
Transposition deadline set by the Directive, missed by France.
Adopted by the Senate at first reading.
Adopted by the National Assembly’s special committee.
ANSSI opens entity pre-registration on MonEspaceNIS2.
ANSSI publishes ReCyF (Référentiel Cyber France), the measures it recommends to meet the NIS2 objectives, as a working document.
The European Commission refers France (along with Spain, Ireland and the Netherlands) to the Court of Justice of the EU and asks for financial penalties.
The Conference of Presidents removes the debate planned for 7 October from the agenda. No new date has been set so far; the rapporteur hopes to reschedule it “within fifteen days or three weeks”.
Next: a vote in the National Assembly, a possible agreement with the Senate, promulgation, then decrees and orders setting out the obligations and compliance deadlines. In the meantime, ReCyF and the checklist below give a solid basis.
Sources (7)
- Next, “Caramba, encore raté : la transposition de NIS2 est de nouveau repoussée” (in French), updated 6 October 2026
- French National Assembly, file of the bill on the resilience of critical infrastructure and strengthening cybersecurity (in French), consulted 6 October 2026
- European Commission, referral of Ireland, Spain, France and the Netherlands to the Court of Justice, 8 July 2026
- ANSSI, the NIS 2 Directive (ReCyF published on 17 March 2026, in French), consulted 6 October 2026
- ANSSI, “NIS 2 : les entités assujetties peuvent se pré-enregistrer” (in French), 24 November 2025
- MonEspaceNIS2, progress of the NIS 2 transposition (in French), updated 19 September 2025
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23, 32 and 34, 14 December 2022
15 actions to get ready, starting now
Tick them off as you go. These actions follow from the Directive and remain valid whatever the final wording of national law.
- Academy
- Public footprint
- Governance
- MFA
- Ransomware
- Incident response
- SSL/TLS audit
- Fix DMARC
- Code and software supply chain
- Penetration testing
Ticked boxes are not saved: print the page or copy the list into your tracking tool.
NIS2: your questions
How do I know if NIS2 applies to my company?
Cross-check your sector (18 sectors listed in Annexes I and II of the Directive) with your size: as a rule, at least 50 employees, or more than €10M turnover and balance sheet total. Some activities are covered regardless of size, such as DNS service providers. In France, ANSSI offers a simulator on MonEspaceNIS2.
Does NIS2 already apply in France?
Not yet. On 6 October 2026, the transposition bill, adopted by the Senate on 12 March 2025, is still waiting for its plenary debate in the National Assembly: the one planned for 7 October was postponed with no new date. The obligations will apply once the law is promulgated and its decrees published.
Does a business with fewer than 50 employees have to comply with NIS2?
In principle no, with exceptions (DNS providers, trust service providers, entities designated by the State). But if your customers are subject to NIS2, they will require security guarantees from their suppliers: in practice, many small businesses will have to apply part of the measures.
What are the NIS2 incident reporting deadlines?
For a significant incident: an early warning within 24 hours, an incident notification with an initial assessment within 72 hours, then a final report within one month of the notification. In France, the bill designates ANSSI as the national authority.
What fines does NIS2 provide for?
The Directive requires maximum fines of at least €10M or 2% of worldwide annual turnover for essential entities, and at least €7M or 1.4% for important entities, whichever is higher. Each national law sets the amounts that apply.
Are managers personally liable?
Yes, Article 20 provides that management bodies approve the cybersecurity measures, oversee their implementation and can be held liable for infringements. They must also follow cybersecurity training.
Is KrakenShield enough to comply with NIS2?
No, no tool makes you compliant on its own: NIS2 also requires governance, procedures and contracts. KrakenShield covers technical and evidence measures (SSL/TLS and privacy audits, code analysis, non-destructive penetration testing) and staff training with the Academy, with PDF reports to show your customers or the authority.
Continue with the Knowledge Center
Cyber law in France and Europe
GDPR, NIS2, DORA, Cyber Resilience Act and AI Act: who is in scope and by when.
ReadSecuring an SME
Concrete priorities when you have neither a CISO nor a big budget.
ReadCheck your website’s security
What an SSL/TLS audit checks and how to fix the six most common issues.
ReadKrakenShield Academy
Certified awareness training for all staff, proof of training included.
ReadStart by measuring your exposed surface.
Create your account, run a first SSL/TLS audit of your domain and get, in minutes, an A+ to F grade, your public footprint and a PDF report for your NIS2 file.
Run an audit, a code analysis or an awareness campaign from your console.
Free sign-up, no credit card, with 10 free Kredits from the BETATEST2026 launch offer while it is active. Hosted in Europe.
General information, not legal advice. This page presents the NIS2 Directive and the state of its French transposition as of 6 October 2026. Texts change: check their status before any decision and get advice from a lawyer for your situation.