Top 5 Action Points to Stay Ahead
You might not be officially classified as an “essential entity” under the new NIS-2 Directive — but that doesn’t mean you’re off the hook.
If your customers are considered essential entities, they are now required to assess the cybersecurity readiness of their suppliers. That includes you.
So, what should you do next? Here are the top 5 strategic steps every EU SME should take to stay competitive, compliant, and cyber-ready:
- Know Your Customers’ Status Find out if your clients fall under the NIS-2 “essential entities” category. If they do, your compliance directly supports theirs — and your continued partnership.
- Understand National Cyber Regulations Every EU country is implementing NIS-2 slightly differently. Stay informed about your local requirements so you’re not caught off guard.
- Engage With Your National Cybersecurity Agency Subscribe to updates and threat alerts. Integrating their intelligence into your cybersecurity practices shows maturity — and adds value for your customers.
- Update Your Incident Response Policy Ensure you’re prepared to report major security incidents not only to national authorities but also to your key customers — transparently and on time.
- Align Threat Assessments with Risk Reviews Document how you evaluate new threats and make sure it fits into your annual information security risk assessment. It’s not just best practice — it’s smart business.
NIS-2 is not just regulation — it’s your competitive edge. Position yourself as a trusted, secure partner in your customers’ supply chain. Start now.
More tips and details on how to implement or assess your NIS-2 readiness. For expert NIS2 verification or implementation, contact Compleye.com
Find below an overview of status of implementation of national cybersecurity laws in the Netherlands, Belgium, France, Germany, Finland, Norway, Denmark et Sweden.
Les Pays-Bas
The Netherlands’ Cybersecurity Act (“Cyberbeveiligingswet”) is expected in Q3 2025, delayed from October 2024. It mandates 24-hour incident reporting and supply chain risk assessments for essential entities like domain registries. Enforcement awaits national law, but SMEs can prepare now with NCSC-NL’s threat intelligence.
Belgium
Belgium transposed NIS2 by October 2024, with the Centre for Cybersecurity Belgium (CCB) overseeing compliance. SMEs must register by March 2025 and implement management-approved security measures. Non-compliance risks fines up to €10M or 2% of global turnover.
France
France is aligning NIS2 with DORA and CER, with adoption expected by mid-2025. The ANSSI will enforce rules, including audits and risk management for critical sectors like public administration. Fines may reach €10M. SMEs can use ANSSI’s self-assessment tools to prepare.
Germany
Germany’s NIS2UmsuCG law, set for March 2025, impacts ~30,000 companies under BSI oversight. It strengthens KRITIS regulations with strict reporting and audits. SMEs should align with C5 cloud security standards for compliance.
Finland
Finland’s Cybersecurity Act, expected in Q1/Q2 2025, centralizes risk management and incident reporting under Traficom/NCSC-FI. SMEs must register and update risk models post-transposition. Subscribe to NCSC-FI alerts for updates.
Norway
Norway, an EEA member, is drafting NIS2-aligned legislation post-2024 consultation, with no firm timeline. The NCSC Norway provides threat advisories to help SMEs prepare for upcoming rules and CER integration.
Denmark
Denmark’s NIS2 bill, effective March 2025, includes sector-specific rules for telecom and energy, overseen by the Centre for Cyber Security. Financial sector compliance aligns with DORA. Sign up for alerts to stay informed.
Sweden
Sweden’s Cybersecurity Act, expected January 2025, covers 18 sectors with strict supplier security and reporting rules. The MSB enforces compliance with GDPR-style sanctions. SMEs should prepare for expanded public sector requirements.
