NIS2 in practice: what small organisations really need to prepare

NIS2 is often presented as a new list of obligations for "all companies". That wording is too broad. In Belgium, the law mainly targets entities of a certain size that provide services in specific sectors, with several exceptions.

A small non-profit (ASBL/VZW), a municipality, an IT service provider or an SME can nonetheless be affected in three different ways: directly by the law, as a supplier to an entity in scope, or simply because the required measures are useful good practice.

Start with the scope, not with a questionnaire

The Belgian law of 26 April 2024 transposes the European NIS2 directive. To find out whether an organisation is directly concerned, you need to examine at least:

• the exact nature of the service provided;
• the sector listed in the annexes;
• the size of the entity;
• linked or partner enterprises;
• the applicable exceptions;
• the place of establishment and the specific rules for certain services.

The threshold of fifty employees or ten million euros is often quoted. It should not be used on its own. The European definition of SMEs takes into account headcount, turnover, balance sheet and sometimes data from linked enterprises. Certain types of entity may also be covered regardless of their size.

If in doubt, use the information and tools of the CCB (Centre for Cybersecurity Belgium), then seek advice tailored to your organisation. A general article does not replace a legal analysis.

A small organisation can be affected without being a NIS2 entity

An organisation subject to NIS2 must manage the risks arising from its supply chain. It will therefore ask its suppliers for guarantees about access, incidents, backups, subcontractors and continuity.

The small web agency working for a hospital, the hosting provider of a municipality or the IT supplier of an energy company does not automatically become a NIS2 entity. It may, however, receive more precise contractual requirements.

This distinction matters. It allows you to answer honestly:

• "we are directly subject to NIS2";
• "we are not directly subject to it, but we apply these controls";
• "we still need to check our situation".

Declaring yourself compliant without having determined your status creates more risk than a cautious, documented answer.

The first deliverable is a map of services

Before buying a tool, describe the services that must keep running:

• email;
• website and customer portal;
• invoicing;
• shared folders;
• remote access;
• backups;
• cloud providers;
• domain names and DNS.

For each service, specify an owner, a supplier, the data processed, the administrator accounts, an acceptable downtime and the recovery method.

This map answers a simple question: if this service disappears tomorrow, who knows what to do?

Governance does not mean multiplying meetings

NIS2 places responsibility for cybersecurity at management level. In a small organisation, this can take a very concrete form:

• a quarterly review of the main risks;
• approval of priorities and budget;
• a named person in charge;
• evidence of the decisions taken;
• training suited to the decision-makers.

Management does not need to configure a firewall. It must understand the consequences of an accepted risk, check that actions are followed up and know who coordinates an incident.

Ten measures to prepare before the next client questionnaire

A small organisation can build a useful file with:

1. the list of its essential services and assets;
2. named accounts and reviewed permissions;
3. strong authentication for sensitive access;
4. an onboarding and offboarding procedure;
5. isolated backups and a tested restore;
6. documented patch management;
7. an emergency contact at each critical supplier;
8. an internal reporting procedure;
9. a one-page incident response plan;
10. a simple policy for informing the partners concerned.

These elements are more convincing than a general statement of compliance. They can be shown, dated and tested.

Suppliers must be assessed according to their role

A meeting room booking service and a hosting provider that stores all personal data do not present the same risk. Tailor the assessment:

• what data does the supplier receive;
• can it access your systems;
• does it itself depend on an essential subcontractor;
• how does it announce an incident;
• how do you get your data back;
• what happens at the end of the contract?

A long, identical questionnaire for everyone often produces superficial answers. A few questions linked to the actual service are more useful.

Incident notification must be prepared before the incident

Entities directly subject to NIS2 must notify certain significant incidents according to the CCB's process. The deadlines and the information required change as the incident unfolds.

To be able to notify correctly, the organisation must know:

• who decides that an event is significant;
• who accesses the portal or contacts the CCB;
• what information can be shared;
• how to preserve confidentiality;
• who informs clients and partners.

Waiting for the incident to look for these answers wastes precious time.

Use CyberFundamentals as a common language

The CCB's CyberFundamentals framework offers levels of measures adapted to risk. It can be used to structure a plan, to talk with a supplier and to avoid every client inventing its own definition of security.

The goal is not to pile up documents. It is to link each measure to a service, an owner and a piece of evidence.

A realistic three-month roadmap

In the first month, clarify the scope, the essential services, the owners and the administrator access.

In the second month, test a restore, fix shared accounts, enable strong authentication and contact critical suppliers.

In the third month, run a short exercise: loss of email, a compromised account or the hosting provider going down. Note what is missing and have management approve the priorities.

This progression does not by itself guarantee legal compliance. It does, however, build a verifiable and useful foundation, even for an organisation that does not fall directly within the scope of NIS2.

Official sources

• CCB - The NIS2 law in Belgium (FR)
• CCB - The NIS2 directive: for whom and why (FR)
• Safeonweb at Work - NIS2 information (FR)
• CCB - CyberFundamentals Framework (FR)