We have 20 people. Can we ignore NIS2?

Usually a 20-person company sits outside the size threshold. The exceptions are DNS, a registry, a trust service, or public communications, which count at any size. If your customers are in scope, though, their questionnaires are your version of NIS2. Meeting the ten measures early costs less than retrofitting them under a deal deadline.

Is NIS2 the same in every EU country?

No. It's a directive, so each member state wrote its own law, with its own registration duty, authority, and sometimes stricter rules. The measures and the reporting clock are the same everywhere. I recommend checking the national law where the company is based. For cross-border sales, the law where the customers sit matters too.

Does ISO 27001 cover it?

It covers most of the measures and provides the evidence trail. It doesn't cover the reporting deadlines or the management training on its own. With ISO 27001 already in place, the gap usually sits in incident timing, supply chain assessment, and proof that the management body signed off.

What would you fix first?

Identity and backups. That means multi-factor authentication on every human and break-glass account, and a backup the team has actually restored. They close the most risk per day of work. They're also the first two things any assessor asks about. Which of the two could your team show today?

All guides

Guide

NIS2 for startups and scale-ups

What the NIS2 directive asks of a startup's cloud platform, how to tell whether a company is in scope or a supplier to one that is, and what to fix first.

NIS2 is the EU's cybersecurity directive for the sectors that keep a country running: energy, transport, banking, health, water, digital infrastructure, cloud and managed services, and more. Each member state turned it into national law, with a deadline of 17 October 2024, and several were late. The law puts the duty on the company's management, with fines that scale with turnover. It asks for a short list of security measures that belong in any startup's platform anyway, plus incident reporting on a clock.

I'm starting to see a lot of startups sit below the size threshold and never hear from a regulator. They meet NIS2 through a customer instead. An entity in scope has to manage the security of its supply chain, so its vendor questionnaires now carry NIS2 language. I wrote this guide for both cases: a company in scope, or a company that sells to one.

This is an engineer's reading of the rules. I wrote it to help teams decide whether the rules touch their platform. It isn't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.

Does it apply to you?

If one of these lines describes your company, the rest of this guide applies. If none does, the rule probably sits outside your company. A thirty-minute call confirms that faster than the text can.

We run a service in one of the listed sectors (energy, transport, banking, health, drinking or waste water, digital infrastructure, ICT services, space, postal, waste, chemicals, food, manufacturing, digital providers such as marketplaces or search, or research). We also have 50 or more staff or more than €10 million in annual turnover or balance sheet.
We run DNS, a top-level domain registry, a qualified trust service, or a public electronic communications network. These count regardless of size.
We're a cloud, data centre, managed service, or managed security provider. The directive calls these digital infrastructure and ICT service management, and the size rule still applies.
We sell to a bank, hospital, utility, telecom, or public body. Their security questionnaire now asks about incident reporting times, supply chain controls, and management accountability. That's NIS2 reaching us through a customer.
We're a subsidiary or supplier of a group in scope. Groups push the measures down the chain.

What it asks of your platform

Ten measures, read as a cloud platform

Article 21 lists what an entity has to have: a risk analysis and security policy, incident handling, backups and business continuity, supply chain security, secure development and change management, a way to test whether the controls work, cyber hygiene and training, a cryptography policy, access control and asset management, and multi-factor authentication where it fits. On AWS, Azure, or Google Cloud, that maps to an organisation with guardrails and identity with MFA. It also means encrypted and tested backups, infrastructure in code, searchable logging, and a patch cadence with a record.

Reporting on a 24-hour, 72-hour, and one-month clock

A significant incident has to reach the national CSIRT or authority as an early warning within 24 hours. A fuller notification follows within 72 hours, and a final report within a month. That clock needs alerting that wakes someone, logs that survive the incident, and a runbook that names who calls whom. I build the detection first. The reporting form is the easy part.

Management owns it

The directive makes the management body approve the measures, oversee them, and take training. Fines go up to €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important ones. For a founder, that turns the security posture into a board topic with a written risk register. It's not a ticket in the backlog.

Supply chain in both directions

A company in scope has to assess its own suppliers, including its cloud provider and the SaaS tools in the critical path. A supplier can expect requests for its controls, its incident process, and its own vendor list. A short, honest security page and a filled-in questionnaire template save weeks of back and forth per deal.

How I help

The engineering behind the guide. Each one starts with a map of the platform as it runs today.

Book a call

Platform engineering

I make the cloud you already run calmer, cheaper, and understood by more than one person on the team.

Cloud security hardening

I find the gaps in your cloud accounts, identity, network, and data, rank them by what an attacker reaches first, and close them with your team.

DORA

What the Digital Operational Resilience Act asks of a fintech's cloud platform, and what its contract rules mean for suppliers to banks and insurers.

EU AI Act

How the EU AI Act sorts AI systems into risk tiers, which tier your product is likely in, when the rules apply, and what they mean for the way a team builds.

GDPR

What the GDPR asks of a startup's cloud platform in engineering terms: controller or processor, the records to keep, and the controls that prove it.

EU data residency on AWS, Azure, and Google Cloud

How to keep customer data in EU regions on AWS, Azure, and Google Cloud, what still leaves, and the controls that prove it to a customer or auditor.

We have 20 people. Can we ignore NIS2?: Usually a 20-person company sits outside the size threshold. The exceptions are DNS, a registry, a trust service, or public communications, which count at any size. If your customers are in scope, though, their questionnaires are your version of NIS2. Meeting the ten measures early costs less than retrofitting them under a deal deadline.
Is NIS2 the same in every EU country?: No. It's a directive, so each member state wrote its own law, with its own registration duty, authority, and sometimes stricter rules. The measures and the reporting clock are the same everywhere. I recommend checking the national law where the company is based. For cross-border sales, the law where the customers sit matters too.
Does ISO 27001 cover it?: It covers most of the measures and provides the evidence trail. It doesn't cover the reporting deadlines or the management training on its own. With ISO 27001 already in place, the gap usually sits in incident timing, supply chain assessment, and proof that the management body signed off.
What would you fix first?: Identity and backups. That means multi-factor authentication on every human and break-glass account, and a backup the team has actually restored. They close the most risk per day of work. They're also the first two things any assessor asks about. Which of the two could your team show today?

Let's talk.

A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?

Book a call See pricing

Prefer email or phone? hello@netninjas.eu or +31 6 45984313