It's one of the most frequent questions we hear from managers and IT directors at companies with 50 to 250 employees: "NIS2 is for critical infrastructure, for energy and telecom — does it really concern us?" The short answer is: it depends on your sector and your company size. The useful answer is that the check takes a few hours, and the cost of skipping it is wildly disproportionate to that effort.
This article walks through the applicability logic of the NIS2 Directive, the concrete obligations that follow, and realistic first steps for a mid-sized company starting from scratch.
How applicability is determined: sector plus size
Unlike the original NIS Directive, where national authorities individually designated the operators in scope, NIS2 introduces a general rule. In practice, an entity falls under the directive when two conditions are met simultaneously.
1. It operates in a sector listed in the directive's annexes. Annex I covers sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space. Annex II adds other critical sectors: postal and courier services, waste management, manufacture and distribution of chemicals, production and processing of food, manufacturing (medical devices, electronic equipment, machinery, motor vehicles and more), digital providers and research organisations.
Notice how much broader this list is than the popular image of "critical infrastructure". An automotive component plant, a food processor, a regional courier firm, a managed IT services provider or a chemical distributor are all direct candidates.
2. It exceeds the size threshold. The general rule targets medium and large entities under the European SME definition: companies with at least 50 employees, or with annual turnover and annual balance sheet total above EUR 10 million. Large entities — over 250 employees or above EUR 50 million turnover — face a stricter supervisory regime.
Combining these criteria produces two categories: essential entities and important entities. The difference does not lie in the security measures required — those are essentially the same — but in supervision. Essential entities are subject to proactive oversight, while important entities are generally checked reactively, after an incident or a complaint.
The exceptions that catch small companies too
In some cases the size threshold is irrelevant. Regardless of headcount, NIS2 can apply to providers of public electronic communications networks, trust service providers, TLD name registries, as well as entities that are the sole provider of an essential service in a Member State or whose disruption would significantly affect public safety. If you sit in one of those categories, the "we're too small" argument simply does not apply.
The indirect effect: supply chain pressure
Even if the analysis above shows you are not directly in scope, NIS2 can still reach you as a supplier. Article 21 requires in-scope entities to manage supply chain risk and the security of relationships with direct suppliers. In practice this means security questionnaires, new contractual clauses, short incident notification deadlines and sometimes evidence of certification.
Many mid-sized companies discover NIS2 not through a regulator but through an email from a large customer asking them to complete a security audit within two weeks. Being prepared in advance turns that request from a crisis into a commercial advantage.
What compliance actually involves
Article 21 of NIS2 lists a minimum set of technical, operational and organisational measures, proportionate to risk:
- risk analysis and information system security policies;
- incident handling — detection, response, documentation;
- business continuity: backup, crisis management, disaster recovery;
- supply chain security;
- security in acquisition, development and maintenance of systems, including vulnerability management;
- assessment of the effectiveness of the measures adopted;
- basic cyber hygiene practices and staff training;
- cryptography and, where appropriate, encryption policies;
- human resources security, access control and asset management;
- multi-factor authentication, secured voice, video and text communications, and secured emergency communication systems.
On top of that come the reporting duties in Article 23: an early warning within 24 hours of becoming aware of a significant incident, a more detailed notification within 72 hours, and a final report within one month. In Romania the competent authority is the National Cyber Security Directorate (DNSC), and national transposition was carried out through GEO no. 155/2024, which also includes the obligation for in-scope entities to register.
One element often underestimated: NIS2 establishes management accountability. Leadership must approve the security measures, oversee their implementation and undergo relevant training. This is no longer a topic you can fully delegate to the IT department.
First steps, in the right order
- Determine applicability in writing. Industry classification, annex sector, headcount, turnover — document the conclusion whatever it turns out to be. If a request arrives, you will have a reasoned answer ready.
- Register with the authority if you are in scope.
- Build an asset inventory. You cannot protect what you don't know you have: servers, endpoints, SaaS applications, privileged accounts, suppliers with network access.
- Run a gap assessment against the ten categories of measures in Article 21.
- Prioritise by risk, not by list order. MFA everywhere, tested backups following the 3-2-1 rule, network segmentation and an incident response plan cover the bulk of real exposure.
- Formalise it. Written policies, named owners, periodic training, retained logs. Compliance is demonstrated with documents, not intentions.
Conclusion
If you are a mid-sized company in a sector listed in the directive's annexes, the probability that NIS2 applies to you is high. If it doesn't apply directly, you will feel its requirements through your customers and partners. Either way, the measures demanded are not exotic — they are cyber hygiene practices a modern organisation should have in place regardless.
The real difficulty is not conceptual but about resources: few mid-sized companies have the internal time and specialisation to work through an applicability analysis, a gap assessment, technical implementation and the supporting documentation, all while running daily operations. That is where a partner who has already been through this process with similar organisations makes the difference — turning a legislative text into a work plan with phases, owners and realistic deadlines.