NIS2: the cybersecurity law that affects you even if it doesn’t apply to you
One Monday, an email arrives from your best client. Attached: a security questionnaire. Deadline: 15 days.
Do you use two-factor authentication on every account? When did you last test restoring a backup? Who reports an incident within 24 hours? And nobody in your company knows what to answer.
If it hasn’t happened to you yet, it will. It has a name: NIS2. And it affects you even if the law doesn’t mention you.
What NIS2 is
NIS2 is Directive (EU) 2022/2555: the European cybersecurity rulebook for businesses. It replaces the first NIS, from 2016, covers far more companies and requires specific measures.
Fines reach €10 million or 2% of worldwide turnover, whichever is higher. And management is personally accountable: “IT handles that” no longer cuts it.
Does it apply to me?
Directly, if you’re a medium-sized or large company (50 employees or more, or over €10 million in turnover and balance sheet) in a critical sector: energy, transport, banking, health, water, digital infrastructure, managed IT services, public administration, waste, chemicals, food, manufacturing or research, among others.
If you’re unsure whether you’re in scope, ask a lawyer, not a blog.
“It doesn’t apply to me.” Are you sure?
Here’s the catch. NIS2 requires the companies it covers to look after their suppliers’ security. In other words, yours.
If you sell software, IT services or maintenance to a hospital, an energy company, a local council or a mid-sized factory, they’re going to ask. And answering badly won’t get you fined. It’ll lose you the client.
What they’ll ask for
The directive sets out ten measures. These five are the ones you’ll see most, and you can start on them this week:
1. Two-factor authentication on every account. Start with email and banking.
2. Backups that actually restore. An untested backup isn’t a backup: it’s a hope.
3. An inventory: what devices and accounts you have, and who can get into each one.
4. Software kept up to date and vulnerabilities patched.
5. A written plan for when you’re attacked: who decides and who gets told. An in-scope company has 24 hours to send the first alert.
And in Spain?
Spain had to write it into national law by 17 October 2024 and still hasn’t. The Government approved a draft bill in January 2025, but it never reached Parliament, and with the general election on 29 November it will be down to the next Government. Meanwhile, in July 2026, the European Commission decided to take Spain to the EU Court of Justice over the delay.
Can you wait for the official gazette? Your bigger clients aren’t waiting: they’re already writing it into their contracts.
An attack gives no warning. Your client does: fifteen days.
If you want a hand
We handle the technical side. Cybersecurity audits that tell you what to fix first, in plain language. And maintenance to keep it fixed: updates, daily backups and monitoring.
INCIBE, Spain’s National Cybersecurity Institute, has validated our cybersecurity services and lists us in its catalogue of cybersecurity companies.
If one of those questionnaires has landed in your inbox and you don’t know where to start, tell us about it. A founder replies within 24 working hours.
